|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
Koneessani on Trojan.Win32.Patched.aa HJT-log
|
|
|
AkAntA
Junior Member
|
21. toukokuuta 2008 @ 19:19 |
Linkki tähän viestiin
|
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:18:20, on 21.5.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\WINDOWS\ATKKBService.exe
D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
D:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
D:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
D:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
D:\WINDOWS\system32\nvsvc32.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
D:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsrw.exe
D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
D:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\WgaTray.exe
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\htpatch.exe
D:\WINDOWS\system32\RunDll32.exe
D:\Program Files\TW-IA300C ADSL\CnxDslTb.exe
D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe
D:\PROGRA~1\SONERA~1\ANTI-S~1\fsaw.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
K:\Hewlett\Digital Imaging\Unload\hpqcmon.exe
K:\Hewlett\HP Share-to-Web\hpgs2wnd.exe
D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
D:\WINDOWS\system32\RUNDLL32.EXE
D:\Program Files\QuickTime\QTTask.exe
D:\WINDOWS\system32\ctfmon.exe
K:\valve\steam\steam.exe
D:\Program Files\Sonera Tietoturva\FSGUI\fsguidll.exe
D:\Program Files\MSN Messenger\MsnMsgr.Exe
K:\Hewlett\HP Share-to-Web\hpgs2wnf.exe
D:\Program Files\redline\gameutil.exe
D:\Program Files\HotKey\HotKey.exe
D:\Program Files\Logitech\SetPoint\SetPoint.exe
D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
K:\mIRC\mirc.exe
D:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
D:\Program Files\Mozilla Firefox\firefox.exe
K:\jtn\fasdfadsfdas\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [HTpatch] D:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] D:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [CnxDslTaskBar] "D:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ScanRegistry] D:\W
O4 - HKLM\..\Run: [F-Secure Manager] "D:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "D:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [RedLine Taskbar] D:\Program Files\RedLine\Taskbar.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "D:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CamMonitor] K:\Hewlett\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] K:\Hewlett\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [j2291439] rundll32 D:\WINDOWS\system32\j2291439.dll sook
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] K:\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "k:\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ProBNC] "D:\Documents and Settings\Jani\Työpöytä\arkku\Arkku IP Updater\sysupdate.exe"
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [FTPUploader] F:\ftpuploader\FTPUploader.exe /s
O4 - HKCU\..\Run: [Free Download Manager] F:\Free Download Manager\fdm.exe -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: mIRC.lnk = K:\mIRC\mirc.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DllCmd32.lnk = C:\jetsuite\DLLCMD32.EXE
O4 - Global Startup: gameutil.exe.lnk = ?
O4 - Global Startup: HotKey Driver.lnk = D:\Program Files\HotKey\HotKey.exe
O4 - Global Startup: HP LaserJet 3100 Status.lnk = C:\jetsuite\JETSTAT.EXE
O4 - Global Startup: Logitech SetPoint.lnk = D:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sonera Tietoturva.lnk = D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
O8 - Extra context menu item: &Estä tämä kohoikkuna - D:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - D:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - D:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab
O16 - DPF: {861FDA2A-2B57-4BDA-8B8B-305C9D5D8604} (_Multimedia Player) - http://stream.pussyharem.com/stream/mmp2.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O20 - Winlogon Notify: abbaeeea - D:\WINDOWS\system32\abbaeeea.dll (file missing)
O21 - SSODL: JxuZgsR - {31451BE6-9BEF-B14C-E3AC-AEAC623890C5} - D:\WINDOWS\System32\ddloa.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - D:\WINDOWS\ATKKBService.exe
O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Process Monitor (LVPrcSrv) - Unknown owner - d:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe (file missing)
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - D:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - K:\sissari\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - K:\sissari\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe
O23 - Service: ServiceLayer - Nokia. - D:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - D:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O24 - Desktop Component 0: (no name) - file:///D:/DOCUME~1/Jani/LOCALS~1/Temp/msohtml1/05/clip_image001.jpg
O24 - Desktop Component 2: (no name) - file://localhost/D:/Documents%20and%20Settings/Jani/Työpöytä/countdown.html
O24 - Desktop Component 3: sieni.us - Lyhyitä ja hauskoja flasheja, epileptikkojen paratiisi! - http://sieni.us/?id=6
--
End of file - 12143 bytes
|
|
Hujo
Suspended permanently
|
21. toukokuuta 2008 @ 19:55 |
Linkki tähän viestiin
|
Lataa TÄSTÄ VundoFix.exe työpöydällesi.
Tupla-klikkaa VundoFix.exe ajaaksesi sen.
Klikkaa Scan for Vundo valintaa.
Kun skannaus on valmis, klikkaa Fix Vundo valintaa.
Sinulta kysytään haluatko poistaa filut - klikkaa YES.
Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.
Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.
==============
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.
===============
Javan päivitys ja välimuistin tyhjennys:
1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
Niissä pitäisi olla seuraava kuva vieressä: 
3. Valitse kaikki entiset Java versiosi ja valitse Poista.
4. Asenna uusin Java päivitys seuraavasta linkistä..
5. Käynnistä kone uudelleen asennuksen jälkeen:
http://java.sun.com/javase/downloads/index.jsp
Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u6
Paina Download
Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.
6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).
7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.
(Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).
8. Varmista että kaikki kaksi valintaa ovat rastitettuja:
*Applications and Applets
*Trace and Log Files
Ja paina OK -nappia
9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.
10. Klikkaa OK jättääksesi Java asetusikkunasi.
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 21. toukokuuta 2008 @ 19:57
|
|
AkAntA
Junior Member
|
22. toukokuuta 2008 @ 16:15 |
Linkki tähän viestiin
|
|
Vundosta ei logia.
Malwarebytes' Anti-Malware log:
Malwarebytes' Anti-Malware 1.12
Tietokantaversio: 722
Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|F:\|G:\|H:\|K:\|)
Tarkistetut kohteet: 253529
Kulunut aika: 2 hour(s), 28 minute(s), 43 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 19
Saastuneita rekisteriarvoja: 1
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 4
Saastuneita tiedostoja: 8
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
HKEY_CLASSES_ROOT\mywebsearch.htmlpanel (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.htmlpanel.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\asearchassist.adefaultsearch.1 (Adware.Accoona) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\abar.abarband.1 (Adware.Accoona) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\aldd (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Juan (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\CAC (Malware.Trace) -> Quarantined and deleted successfully.
Saastuneita rekisteriarvoja:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{376719f4-5fb2-4b1d-9859-b3864a1648a9} (Trojan.Vundo) -> Quarantined and deleted successfully.
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
D:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
D:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
D:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
D:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.
Saastuneita tiedostoja:
H:\Documents and Settings\Tomi\Local Settings\Temp\GLK16.tmp (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
H:\Documents and Settings\Tomi\Local Settings\Temp\GLK1E.tmp (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
H:\Documents and Settings\Tomi\Local Settings\Temp\GLKE.tmp (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
D:\Program Files\MyWebSearch\bar\History\search2 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
D:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
D:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
D:\WINDOWS\SVCHOST.0XE (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\WINLOGON.EXE.$DIS (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
|
|
Hujo
Suspended permanently
|
22. toukokuuta 2008 @ 17:42 |
Linkki tähän viestiin
|
Vundofix lokin pitäs löytyä tuolta
C:\vundofix.txt
==============
Poista lisää poista sovelutuksesta
MyWebSearch <--- jos tuo sieltä löytyy
Poista vikasiedossa kansio
D:\Program Files\MyWebSearch
==============
Uudelleen nimeäminen
1. Klikkaa hiiren oikealla painikkeella HijackThis ikonia.
2. Valitse Uudelleennineä/ Rename.
3. Kirjoita scanner.exe
=========
scannaa uusi hjt:n loki
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 22. toukokuuta 2008 @ 17:43
|
|
AkAntA
Junior Member
|
22. toukokuuta 2008 @ 19:18 |
Linkki tähän viestiin
|
Tuollaista kansiota ei löytynyt tuosta polusta.
-------VundoFix Log---------
VundoFix V6.5.10
Checking Java version...
Java version is 1.5.0.4
Old versions of java are exploitable and should be removed.
Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.
Scan started at 20:07:05 21.5.2008
Listing files found while scanning....
No infected files were found.
---------------HJT Log-----------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:15:19, on 22.5.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\WINDOWS\ATKKBService.exe
D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
D:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
D:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
D:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
D:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsrw.exe
D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
D:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
D:\WINDOWS\system32\WgaTray.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\htpatch.exe
D:\WINDOWS\system32\RunDll32.exe
D:\Program Files\TW-IA300C ADSL\CnxDslTb.exe
D:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe
D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
K:\Hewlett\Digital Imaging\Unload\hpqcmon.exe
K:\Hewlett\HP Share-to-Web\hpgs2wnd.exe
D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
D:\Program Files\QuickTime\QTTask.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\MSN Messenger\MsnMsgr.Exe
K:\Hewlett\HP Share-to-Web\hpgs2wnf.exe
D:\PROGRA~1\SONERA~1\ANTI-S~1\fsaw.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\redline\gameutil.exe
D:\Program Files\Sonera Tietoturva\FSGUI\fsguidll.exe
D:\Program Files\HotKey\HotKey.exe
D:\Program Files\Logitech\SetPoint\SetPoint.exe
D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
K:\mIRC\mirc.exe
D:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS\system32\msiexec.exe
K:\jtn\fasdfadsfdas\scanner.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [HTpatch] D:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] D:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [CnxDslTaskBar] "D:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ScanRegistry] D:\W
O4 - HKLM\..\Run: [F-Secure Manager] "D:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "D:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [RedLine Taskbar] D:\Program Files\RedLine\Taskbar.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "D:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CamMonitor] K:\Hewlett\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] K:\Hewlett\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [j2291439] rundll32 D:\WINDOWS\system32\j2291439.dll sook
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] K:\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "k:\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ProBNC] "D:\Documents and Settings\Jani\Työpöytä\arkku\Arkku IP Updater\sysupdate.exe"
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [FTPUploader] F:\ftpuploader\FTPUploader.exe /s
O4 - HKCU\..\Run: [Free Download Manager] F:\Free Download Manager\fdm.exe -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: mIRC.lnk = K:\mIRC\mirc.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DllCmd32.lnk = C:\jetsuite\DLLCMD32.EXE
O4 - Global Startup: gameutil.exe.lnk = ?
O4 - Global Startup: HotKey Driver.lnk = D:\Program Files\HotKey\HotKey.exe
O4 - Global Startup: HP LaserJet 3100 Status.lnk = C:\jetsuite\JETSTAT.EXE
O4 - Global Startup: Logitech SetPoint.lnk = D:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sonera Tietoturva.lnk = D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
O8 - Extra context menu item: &Estä tämä kohoikkuna - D:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - D:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - D:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab
O16 - DPF: {861FDA2A-2B57-4BDA-8B8B-305C9D5D8604} (_Multimedia Player) - http://stream.pussyharem.com/stream/mmp2.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O20 - Winlogon Notify: abbaeeea - D:\WINDOWS\system32\abbaeeea.dll (file missing)
O21 - SSODL: JxuZgsR - {31451BE6-9BEF-B14C-E3AC-AEAC623890C5} - D:\WINDOWS\System32\ddloa.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - D:\WINDOWS\ATKKBService.exe
O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Process Monitor (LVPrcSrv) - Unknown owner - d:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe (file missing)
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - D:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - K:\sissari\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - K:\sissari\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe
O23 - Service: ServiceLayer - Nokia. - D:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - D:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O24 - Desktop Component 0: (no name) - file:///D:/DOCUME~1/Jani/LOCALS~1/Temp/msohtml1/05/clip_image001.jpg
O24 - Desktop Component 2: (no name) - file://localhost/D:/Documents%20and%20Settings/Jani/Työpöytä/countdown.html
O24 - Desktop Component 3: sieni.us - Lyhyitä ja hauskoja flasheja, epileptikkojen paratiisi! - http://sieni.us/?id=6
--
End of file - 12166 bytes
|
|
Hujo
Suspended permanently
|
22. toukokuuta 2008 @ 21:45 |
Linkki tähän viestiin
|
Poista tuo vanha vundofixsi ja lataa uusi tuolta ylempää
punasesta txt
=================
scannaa hjt:llä paina Fix checked
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O4 - HKLM\..\Run: [j2291439] rundll32 D:\WINDOWS\system32\j2291439.dll sook
O20 - Winlogon Notify: abbaeeea - D:\WINDOWS\system32\abbaeeea.dll (file missing)
O21 - SSODL: JxuZgsR - {31451BE6-9BEF-B14C-E3AC-AEAC623890C5} - D:\WINDOWS\System32\ddloa.dll (file missing)
O24 - Desktop Component 0: (no name) - file:///D:/DOCUME~1/Jani/LOCALS~1/Temp/msohtml1/05/clip_image001.jpg
O24 - Desktop Component 2: (no name) - file://localhost/D:/Documents%20and%20Settings/Jani/Työpöytä/countdown.html
O24 - Desktop Component 3: sieni.us - Lyhyitä ja hauskoja flasheja, epileptikkojen paratiisi! - http://sieni.us/?id=6
================
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Voiko tietsikka koskaan toimia?
|
|
AkAntA
Junior Member
|
26. toukokuuta 2008 @ 17:09 |
Linkki tähän viestiin
|
----VundoFix Log------
VundoFix V7.0.5
Scan started at 16:51:08 26.5.2008
Listing files found while scanning....
No infected files were found.
------ComboFix Log--------
ComboFix 08-05-25.4 - Jani 2008-05-26 16:30:48.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.490 [GMT 3:00]
Running from: D:\Documents and Settings\Jani\Työpöytä\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
D:\WINDOWS\system32\cqgyntgw.ini
D:\WINDOWS\system32\gln.dll
D:\WINDOWS\system32\iaqgafox.ini
D:\WINDOWS\system32\kounchnu.ini
D:\WINDOWS\system32\llnmp.bak1
D:\WINDOWS\system32\llnmp.bak2
D:\WINDOWS\system32\llnmp.ini
D:\WINDOWS\system32\mcrh.tmp
D:\WINDOWS\system32\MSINET.oca
D:\WINDOWS\system32\pdbxtfaq.ini
D:\WINDOWS\system32\rwnonkmg.ini
D:\WINDOWS\system32\sogaxsiw.ini
D:\WINDOWS\system32\uttss.bak1
D:\WINDOWS\system32\uttss.bak2
D:\WINDOWS\system32\uttss.ini
D:\WINDOWS\system32\uttss.ini2
D:\WINDOWS\system32\vdawftqc.ini
D:\WINDOWS\system32\vphifdqe.ini
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_DOMAINSERVICE
((((( Tiedostot, jotka on luotu seuraavalla aikav?lill?: 2008-04-26 to 2008-05-26 )))))))))))))))))
.
2008-05-26 16:36 . 2008-05-26 16:36 505,856 --------- D:\WINDOWS\system32\WINLOGON.EXE.$DIS
2008-05-21 20:24 . 2008-05-21 20:24 <KANSIO> d-------- D:\Documents and Settings\Jani\Application Data\Malwarebytes
2008-05-21 20:24 . 2008-05-21 20:24 <KANSIO> d-------- D:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-21 20:24 . 2008-05-05 20:46 27,048 --a------ D:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-21 20:24 . 2008-05-05 20:46 15,864 --a------ D:\WINDOWS\system32\drivers\mbam.sys
2008-05-21 20:07 . 2008-05-21 20:07 <KANSIO> d-------- D:\VundoFix Backups
2008-05-21 18:53 . 2008-05-21 18:53 54,156 --ah----- D:\WINDOWS\QTFont.qfn
2008-05-21 18:53 . 2008-05-21 18:53 1,409 --a------ D:\WINDOWS\QTFont.for
2008-05-20 18:03 . 2008-05-20 18:03 127 --a------ D:\WINDOWS\system32\MRT.INI
2008-04-28 15:05 . 2007-08-18 10:54 380,928 --a------ D:\WINDOWS\system32\ac3filter.acm
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-23 11:23 --------- d-----w D:\Documents and Settings\Jani\Application Data\uTorrent
2008-05-22 16:13 --------- d-----w D:\Program Files\Common Files\Adobe
2008-05-22 16:11 --------- d-----w D:\Documents and Settings\Jani\Application Data\AdobeUM
2008-05-21 15:30 110,080 ------w D:\WINDOWS\system32\services.exe
2008-05-20 19:08 58,368 ------w D:\WINDOWS\system32\spoolsv.exe
2008-05-20 19:08 16,896 ------w D:\WINDOWS\system32\svchost.exe
2008-05-20 15:46 14,336 ----a-w D:\WINDOWS\system32\lsass.exe
2008-04-25 12:46 --------- d--h--w D:\Program Files\InstallShield Installation Information
2008-04-23 07:47 --------- d-----w D:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-04-22 08:55 --------- d-----w D:\Documents and Settings\Jani\Application Data\Media Player Classic
2008-04-22 06:34 --------- d-----w D:\Documents and Settings\Admin2\Application Data\ispnews
2008-04-21 08:16 --------- d-----w D:\Documents and Settings\Admin2\Application Data\PC Suite
2008-04-21 08:16 --------- d-----w D:\Documents and Settings\Admin2\Application Data\Logitech
2008-04-20 10:33 --------- d-----w D:\Documents and Settings\Jani\Application Data\Nokia Multimedia Player
2008-04-19 06:47 --------- d-----w D:\Program Files\Microsoft IntelliType Pro
2008-04-18 18:08 --------- d-----w D:\Program Files\MSN Messenger
2008-04-17 08:14 --------- d-----w D:\Documents and Settings\Jani\Application Data\Winamp
2008-04-09 08:38 --------- d-----w D:\Program Files\Winamp
2008-03-25 04:51 621,344 ----a-w D:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w D:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w D:\WINDOWS\system32\win32k.sys
2008-03-01 13:01 826,368 ----a-w D:\WINDOWS\system32\wininet.dll
2007-06-14 11:01 263,220 -csha-w D:\WINDOWS\system32\pmnll.dll.vir
.
------- Sigcheck -------
2008-05-20 22:08 16896 8d2a8f002bddf7413d8ddd3cfe58932a D:\WINDOWS\system32\svchost.exe
md5deep: D:\WINDOWS\system32\winlogon.exe: Permission denied
2008-05-21 18:30 110080 145d8cf51eab341a676e551c04a1505e D:\WINDOWS\system32\services.exe
2008-05-20 18:46 14336 3df6efbe297e056a2142fa89a46bbb0f D:\WINDOWS\system32\lsass.exe
.
(((((((((((((((((((((((((((((( Rekisterin k?ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji? arvoja ja laillisia oletusarvoja ei n?ytet?
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-09-14 19:12 15360]
"Steam"="k:\valve\steam\steam.exe" [2008-03-28 16:45 1271032]
"ProBNC"="D:\Documents and Settings\Jani\Työpöytä\arkku\Arkku IP Updater\sysupdate.exe" [ ]
"msnmsgr"="D:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
"FTPUploader"="F:\ftpuploader\FTPUploader.exe" [ ]
"Free Download Manager"="F:\Free Download Manager\fdm.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HTpatch"="D:\WINDOWS\htpatch.exe" [2002-10-30 12:40 28672]
"SiSUSBRG"="D:\WINDOWS\SiSUSBrg.exe" [2002-07-12 19:15 106496]
"Cmaudio"="cmicnfg.cpl" []
"CnxDslTaskBar"="D:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe" [2003-05-12 14:24 454656]
"NeroFilterCheck"="D:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50 155648]
"F-Secure Manager"="D:\Program Files\Sonera Tietoturva\Common\FSM32.exe" [2005-05-09 10:05 118833]
"F-Secure TNB"="D:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" [2005-06-02 16:05 700416]
"News Service"="D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe" [2005-05-31 15:45 356352]
"RedLine Taskbar"="D:\Program Files\RedLine\Taskbar.exe" [2003-02-09 19:56 22528]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-12-10 12:45 49152 D:\WINDOWS\KHALMNPR.Exe]
"ATIPTA"="D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
"F-Secure Startup Wizard"="D:\Program Files\Sonera Tietoturva\FSGUI\FSSW.exe" [2005-11-18 15:57 372736]
"NvCplDaemon"="D:\WINDOWS\system32\NvCpl.dll" [2007-09-17 02:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 02:07 1626112 D:\WINDOWS\system32\nwiz.exe]
"HP Software Update"="D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"CamMonitor"="K:\Hewlett\Digital Imaging\\Unload\hpqcmon.exe" [2002-10-07 00:23 90112]
"Share-to-Web Namespace Daemon"="K:\Hewlett\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 10:42 69632]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"NvMediaCenter"="D:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 02:07 81920]
"QuickTime Task"="D:\Program Files\QuickTime\QTTask.exe" [2007-12-11 11:56 286720]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [ ]
"PCSuiteTrayApplication"="K:\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 13:20 227328]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-09-14 19:12 15360]
"Nokia.PCSync"="K:\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 15:58 1744896]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
D:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll 2005-01-31 15:13 49152 D:\PROGRA~1\COMMON~1\Stardock\MCPStub.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
--a------ 2004-08-22 17:05 81920 K:\Daemon Tools\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
D:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\itype]
--a------ 2005-12-04 16:38 437008 D:\Program Files\Microsoft IntelliType Pro\itype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2007-03-23 13:20 227328 K:\Nokia\Nokia PC Suite 6\LaunchApplication.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
--a------ 2006-09-25 18:50 20053544 D:\Program Files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
"SandraTheSrv"=3 (0x3)
"SandraDataSrv"=3 (0x3)
"MySql"=2 (0x2)
"MDM"=2 (0x2)
"jsdaemon"=2 (0x2)
"iPodService"=3 (0x3)
"FirebirdServerDefaultInstance"=3 (0x3)
"FirebirdGuardianDefaultInstance"=2 (0x2)
"CallerIP"=3 (0x3)
"AFSEGTGF Windows Service"=2 (0x2)
"Adobe LM Service"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"K:\\Skype\\Phone\\Skype.exe"=
"K:\\Hamachi\\hamachi.exe"=
"K:\\jtn\\utorrent.exe"=
"D:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"D:\\Program Files\\MSN Messenger\\livecall.exe"=
"K:\\WoW\\World of Warcraft\\BackgroundDownloader.exe"=
"K:\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"D:\\Program Files\\Skype\\Phone\\Skype.exe"=
"D:\\Program Files\\Sonera Tietoturva\\backweb\\4436233\\Program\\fspex.exe"=
"K:\\mIRC\\mirc.exe"=
"K:\\Valve\\Steam\\SteamApps\\0_blingbling_0\\counter-strike\\hl.exe"=
"F:\\HLSW\\hlsw.exe"=
"D:\\Program Files\\Internet Explorer\\iexplore.exe"=
"K:\\The All-Seeing Eye\\eye.exe"=
"K:\\Valve\\steamapps\\kapu90\\counter-strike\\hl.exe"=
"K:\\Valve\\Steam\\SteamApps\\weetbixx\\counter-strike\\hl.exe"=
"F:\\DC++\\DCPlusPlus.exe"=
"K:\\Valve\\steamapps\\weetbixx\\counter-strike\\hl.exe"=
"K:\\sissari\\SiSoftware Sandra Lite XIIc\\Win32\\RpcDataSrv.exe"=
"K:\\sissari\\SiSoftware Sandra Lite XIIc\\RpcSandraSrv.exe"=
"K:\\Valve\\Steam\\SteamApps\\weetbixx\\counter-strike source\\hl2.exe"=
"K:\\Valve\\Steam\\SteamApps\\samasungu\\counter-strike source\\hl2.exe"=
"K:\\Valve\\Steam\\steam.exe"=
"D:\\WINDOWS\\system32\\dpvsetup.exe"=
"D:\\WINDOWS\\system32\\rtcshare.exe"=
"D:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"K:\\jtn\\P-660HW-D1_340AGL3C0_0100_Bridge.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"3724:TCP"= 3724:TCP:Blizzard Downloader
"612:TCP"= 612:TCP:Blizzard Downloader
"6881:TCP"= 6881:TCP:Blizzard Downloader
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R0 FSFW;F-Secure Firewall Driver;D:\WINDOWS\system32\drivers\fsdfw.sys [2005-08-22 16:05]
R1 bbcap;bbcap;D:\WINDOWS\system32\DRIVERS\bbcap.sys [2005-08-13 14:33]
R1 js1284;js1284;D:\WINDOWS\system32\drivers\js1284.sys [1998-06-01 13:54]
R1 jsmux;jsmux;D:\WINDOWS\system32\drivers\jsmux.sys [1998-06-01 13:54]
R1 jsscan;jsscan;D:\WINDOWS\system32\drivers\jsscan.sys [1998-06-01 13:54]
R2 BackWeb Plug-in - 4436233;Sonera Tietoturva;D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE [2006-02-23 12:11]
R2 F-Secure Filter;F-Secure File System Filter;D:\Program Files\Sonera Tietoturva\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 18:14]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;D:\Program Files\Sonera Tietoturva\Anti-Virus\Win2K\FSgk.sys [2008-03-17 14:28]
R2 F-Secure Recognizer;F-Secure File System Recognizer;D:\Program Files\Sonera Tietoturva\Anti-Virus\Win2K\FSrec.sys [2004-12-17 12:34]
R2 jsfax;jsfax;D:\WINDOWS\system32\drivers\jsfax.sys [1998-06-01 13:54]
R2 jspclcap;jspclcap;D:\WINDOWS\system32\drivers\jspclcap.sys [1998-06-01 13:54]
R3 CnxTgR;Conexant AccessRunner PCI ADSL Interface Device Driver;D:\WINDOWS\system32\DRIVERS\CnxTgR.sys [2003-05-12 13:54]
S3 CnxTgN;Conexant AccessRunner PCI ADSL LAN Adapter Driver;D:\WINDOWS\system32\DRIVERS\CnxTgN.sys [2003-05-12 14:02]
S3 CnxTgP;Conexant AccessRunner PCI ADSL LAN Adapter Filter Driver;D:\WINDOWS\system32\DRIVERS\CnxTgP.sys [2003-05-12 13:56]
S3 PCASp50;PCASp50 NDIS Protocol Driver;D:\WINDOWS\system32\Drivers\PCASp50.sys []
S3 Probe;Probe;D:\WINDOWS\system32\DRIVERS\probe.sys [2004-01-12 11:18]
S3 teamviewervpn;TeamViewer VPN Adapter;D:\WINDOWS\system32\DRIVERS\teamviewervpn.sys [2008-01-25 12:12]
S4 AFSEGTGF Windows Service;AFSEGTGF Windows Service;D:\WINDOWS\system32\dsuyd.exe []
S4 CallerIP;Visualware CallerIP;F:\CallerIP\cip-nt.exe []
S4 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;D:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe []
S4 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;D:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe []
S4 jsdbg;jsdbg;D:\WINDOWS\system32\drivers\jsdbg.sys [1998-06-01 13:54]
.
'Ajoitetut teht?v?t'-kansion sis?lt?
"2008-04-23 19:32:01 D:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- D:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-26 16:38:47
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MySql]
"ImagePath"="K:/MySQL/bin/mysqld-nt.exe"
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MySql]
"ImagePath"="K:/MySQL/bin/mysqld-nt.exe"
[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\OMSCAN]
"ImagePath"="\Sys"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
-> D:\WINDOWS\system32\winlogon.exe
PROCESS: D:\WINDOWS\explorer.exe
-> D:\Program Files\Logitech\SetPoint\GameHook.dll
-> ?:\WINDOWS\system32\MLANG.dll
.
------------------------ Other Running Processes ------------------------
.
D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\WINDOWS\ATKKBService.exe
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fsbwsys.exe
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32.exe
D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
D:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
D:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
D:\WINDOWS\system32\wdfmgr.exe
D:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
D:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
D:\Program Files\Sonera Tietoturva\Anti-Virus\FSRW.exe
D:\Program Files\Sonera Tietoturva\FWES\program\fsdfwd.exe
D:\Program Files\Common Files\Stardock\SDMCP.exe
D:\WINDOWS\system32\WgaTray.exe
D:\Program Files\Sonera Tietoturva\Anti-Virus\FSAV32.exe
D:\WINDOWS\system32\rundll32.exe
D:\Program Files\TW-IA300C ADSL\CnxDslTb.exe
D:\PROGRA~1\SONERA~1\ANTI-S~1\FSAW.exe
K:\Hewlett\Digital Imaging\Unload\HpqCmon.exe
D:\WINDOWS\system32\rundll32.exe
K:\Hewlett\HP Share-to-Web\hpgs2wnf.exe
D:\Program Files\Sonera Tietoturva\FSGUI\fsguidll.exe
D:\Program Files\RedLine\GameUtil.exe
D:\Program Files\HotKey\HotKey.exe
D:\Program Files\Logitech\SetPoint\SetPoint.exe
D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
D:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
.
**************************************************************************
.
Completion time: 2008-05-26 16:48:20 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-26 13:47:52
Pre-Run: 3,467,718,656 tavua vapaana
Post-Run: 3,660,259,328 tavua vapaana
268 --- E O F --- 2008-05-26 13:24:07
|
|
Hujo
Suspended permanently
|
26. toukokuuta 2008 @ 17:16 |
Linkki tähän viestiin
|
|
ajas combofix uudelleen
Voiko tietsikka koskaan toimia?
|
|
AkAntA
Junior Member
|
26. toukokuuta 2008 @ 17:38 |
Linkki tähän viestiin
|
Täs on tulos
ComboFix 08-05-25.4 - Jani 2008-05-26 17:30:52.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.575 [GMT 3:00]
Running from: D:\Documents and Settings\Jani\Työpöytä\ComboFix.exe
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-04-26 to 2008-05-26 )))))))))))))))))
.
2008-05-26 16:36 . 2008-05-26 16:36 505,856 --------- D:\WINDOWS\system32\WINLOGON.EXE.$DIS
2008-05-21 20:24 . 2008-05-21 20:24 <KANSIO> d-------- D:\Documents and Settings\Jani\Application Data\Malwarebytes
2008-05-21 20:24 . 2008-05-21 20:24 <KANSIO> d-------- D:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-21 20:24 . 2008-05-05 20:46 27,048 --a------ D:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-21 20:24 . 2008-05-05 20:46 15,864 --a------ D:\WINDOWS\system32\drivers\mbam.sys
2008-05-21 20:07 . 2008-05-21 20:07 <KANSIO> d-------- D:\VundoFix Backups
2008-05-21 18:53 . 2008-05-21 18:53 54,156 --ah----- D:\WINDOWS\QTFont.qfn
2008-05-21 18:53 . 2008-05-21 18:53 1,409 --a------ D:\WINDOWS\QTFont.for
2008-05-20 18:03 . 2008-05-20 18:03 127 --a------ D:\WINDOWS\system32\MRT.INI
2008-04-28 15:05 . 2007-08-18 10:54 380,928 --a------ D:\WINDOWS\system32\ac3filter.acm
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-23 11:23 --------- d-----w D:\Documents and Settings\Jani\Application Data\uTorrent
2008-05-22 16:13 --------- d-----w D:\Program Files\Common Files\Adobe
2008-05-22 16:11 --------- d-----w D:\Documents and Settings\Jani\Application Data\AdobeUM
2008-05-21 15:30 110,080 ------w D:\WINDOWS\system32\services.exe
2008-05-20 19:08 58,368 ------w D:\WINDOWS\system32\spoolsv.exe
2008-05-20 19:08 16,896 ------w D:\WINDOWS\system32\svchost.exe
2008-05-20 15:46 14,336 ----a-w D:\WINDOWS\system32\lsass.exe
2008-04-25 12:46 --------- d--h--w D:\Program Files\InstallShield Installation Information
2008-04-23 07:47 --------- d-----w D:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-04-22 08:55 --------- d-----w D:\Documents and Settings\Jani\Application Data\Media Player Classic
2008-04-22 06:34 --------- d-----w D:\Documents and Settings\Admin2\Application Data\ispnews
2008-04-21 08:16 --------- d-----w D:\Documents and Settings\Admin2\Application Data\PC Suite
2008-04-21 08:16 --------- d-----w D:\Documents and Settings\Admin2\Application Data\Logitech
2008-04-20 10:33 --------- d-----w D:\Documents and Settings\Jani\Application Data\Nokia Multimedia Player
2008-04-19 06:47 --------- d-----w D:\Program Files\Microsoft IntelliType Pro
2008-04-18 18:08 --------- d-----w D:\Program Files\MSN Messenger
2008-04-17 08:14 --------- d-----w D:\Documents and Settings\Jani\Application Data\Winamp
2008-04-09 08:38 --------- d-----w D:\Program Files\Winamp
2008-03-25 04:51 621,344 ----a-w D:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w D:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w D:\WINDOWS\system32\win32k.sys
2008-03-01 13:01 826,368 ----a-w D:\WINDOWS\system32\wininet.dll
2007-06-14 11:01 263,220 -csha-w D:\WINDOWS\system32\pmnll.dll.vir
.
------- Sigcheck -------
2008-05-20 22:08 16896 8d2a8f002bddf7413d8ddd3cfe58932a D:\WINDOWS\system32\svchost.exe
md5deep: D:\WINDOWS\system32\winlogon.exe: Permission denied
2008-05-21 18:30 110080 145d8cf51eab341a676e551c04a1505e D:\WINDOWS\system32\services.exe
2008-05-20 18:46 14336 3df6efbe297e056a2142fa89a46bbb0f D:\WINDOWS\system32\lsass.exe
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-09-14 19:12 15360]
"Steam"="k:\valve\steam\steam.exe" [2008-03-28 16:45 1271032]
"ProBNC"="D:\Documents and Settings\Jani\Työpöytä\arkku\Arkku IP Updater\sysupdate.exe" [ ]
"msnmsgr"="D:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
"FTPUploader"="F:\ftpuploader\FTPUploader.exe" [ ]
"Free Download Manager"="F:\Free Download Manager\fdm.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HTpatch"="D:\WINDOWS\htpatch.exe" [2002-10-30 12:40 28672]
"SiSUSBRG"="D:\WINDOWS\SiSUSBrg.exe" [2002-07-12 19:15 106496]
"Cmaudio"="cmicnfg.cpl" []
"CnxDslTaskBar"="D:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe" [2003-05-12 14:24 454656]
"NeroFilterCheck"="D:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50 155648]
"F-Secure Manager"="D:\Program Files\Sonera Tietoturva\Common\FSM32.exe" [2005-05-09 10:05 118833]
"F-Secure TNB"="D:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" [2005-06-02 16:05 700416]
"News Service"="D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe" [2005-05-31 15:45 356352]
"RedLine Taskbar"="D:\Program Files\RedLine\Taskbar.exe" [2003-02-09 19:56 22528]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-12-10 12:45 49152 D:\WINDOWS\KHALMNPR.Exe]
"ATIPTA"="D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
"F-Secure Startup Wizard"="D:\Program Files\Sonera Tietoturva\FSGUI\FSSW.exe" [2005-11-18 15:57 372736]
"NvCplDaemon"="D:\WINDOWS\system32\NvCpl.dll" [2007-09-17 02:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 02:07 1626112 D:\WINDOWS\system32\nwiz.exe]
"HP Software Update"="D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"CamMonitor"="K:\Hewlett\Digital Imaging\\Unload\hpqcmon.exe" [2002-10-07 00:23 90112]
"Share-to-Web Namespace Daemon"="K:\Hewlett\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 10:42 69632]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"NvMediaCenter"="D:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 02:07 81920]
"QuickTime Task"="D:\Program Files\QuickTime\QTTask.exe" [2007-12-11 11:56 286720]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [ ]
"PCSuiteTrayApplication"="K:\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 13:20 227328]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-09-14 19:12 15360]
"Nokia.PCSync"="K:\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 15:58 1744896]
D:\Documents and Settings\Jani\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
mIRC.lnk - K:\mIRC\mirc.exe [2006-10-31 17:09:18 1949696]
D:\Documents and Settings\All Users\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
Adobe Gamma Loader.lnk - D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-06-05 17:20:04 110592]
Adobe Reader Speed Launch.lnk - D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
DllCmd32.lnk - C:\jetsuite\DLLCMD32.EXE [2007-09-04 14:20:35 12035]
gameutil.exe.lnk - D:\Program Files\redline\gameutil.exe [2003-07-10 17:04:14 26624]
HotKey Driver.lnk - D:\Program Files\HotKey\HotKey.exe [2005-06-05 16:34:11 36864]
HP LaserJet 3100 Status.lnk - C:\jetsuite\JETSTAT.EXE [2007-09-04 14:20:35 108291]
Logitech SetPoint.lnk - D:\Program Files\Logitech\SetPoint\SetPoint.exe [2005-07-28 23:15:42 434176]
Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 12:01:04 83360]
Sonera Tietoturva.lnk - D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe [2005-07-07 20:53:57 32807]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
D:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll 2005-01-31 15:13 49152 D:\PROGRA~1\COMMON~1\Stardock\MCPStub.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
--a------ 2004-08-22 17:05 81920 K:\Daemon Tools\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
D:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\itype]
--a------ 2005-12-04 16:38 437008 D:\Program Files\Microsoft IntelliType Pro\itype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2007-03-23 13:20 227328 K:\Nokia\Nokia PC Suite 6\LaunchApplication.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
--a------ 2006-09-25 18:50 20053544 D:\Program Files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
"SandraTheSrv"=3 (0x3)
"SandraDataSrv"=3 (0x3)
"MySql"=2 (0x2)
"MDM"=2 (0x2)
"jsdaemon"=2 (0x2)
"iPodService"=3 (0x3)
"FirebirdServerDefaultInstance"=3 (0x3)
"FirebirdGuardianDefaultInstance"=2 (0x2)
"CallerIP"=3 (0x3)
"AFSEGTGF Windows Service"=2 (0x2)
"Adobe LM Service"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"K:\\Skype\\Phone\\Skype.exe"=
"K:\\Hamachi\\hamachi.exe"=
"K:\\jtn\\utorrent.exe"=
"D:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"D:\\Program Files\\MSN Messenger\\livecall.exe"=
"K:\\WoW\\World of Warcraft\\BackgroundDownloader.exe"=
"K:\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"D:\\Program Files\\Skype\\Phone\\Skype.exe"=
"D:\\Program Files\\Sonera Tietoturva\\backweb\\4436233\\Program\\fspex.exe"=
"K:\\mIRC\\mirc.exe"=
"K:\\Valve\\Steam\\SteamApps\\0_blingbling_0\\counter-strike\\hl.exe"=
"F:\\HLSW\\hlsw.exe"=
"D:\\Program Files\\Internet Explorer\\iexplore.exe"=
"K:\\The All-Seeing Eye\\eye.exe"=
"K:\\Valve\\steamapps\\kapu90\\counter-strike\\hl.exe"=
"K:\\Valve\\Steam\\SteamApps\\weetbixx\\counter-strike\\hl.exe"=
"F:\\DC++\\DCPlusPlus.exe"=
"K:\\Valve\\steamapps\\weetbixx\\counter-strike\\hl.exe"=
"K:\\sissari\\SiSoftware Sandra Lite XIIc\\Win32\\RpcDataSrv.exe"=
"K:\\sissari\\SiSoftware Sandra Lite XIIc\\RpcSandraSrv.exe"=
"K:\\Valve\\Steam\\SteamApps\\weetbixx\\counter-strike source\\hl2.exe"=
"K:\\Valve\\Steam\\SteamApps\\samasungu\\counter-strike source\\hl2.exe"=
"K:\\Valve\\Steam\\steam.exe"=
"D:\\WINDOWS\\system32\\dpvsetup.exe"=
"D:\\WINDOWS\\system32\\rtcshare.exe"=
"D:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"K:\\jtn\\P-660HW-D1_340AGL3C0_0100_Bridge.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"3724:TCP"= 3724:TCP:Blizzard Downloader
"612:TCP"= 612:TCP:Blizzard Downloader
"6881:TCP"= 6881:TCP:Blizzard Downloader
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R0 FSFW;F-Secure Firewall Driver;D:\WINDOWS\system32\drivers\fsdfw.sys [2005-08-22 16:05]
R1 bbcap;bbcap;D:\WINDOWS\system32\DRIVERS\bbcap.sys [2005-08-13 14:33]
R1 js1284;js1284;D:\WINDOWS\system32\drivers\js1284.sys [1998-06-01 13:54]
R1 jsmux;jsmux;D:\WINDOWS\system32\drivers\jsmux.sys [1998-06-01 13:54]
R1 jsscan;jsscan;D:\WINDOWS\system32\drivers\jsscan.sys [1998-06-01 13:54]
R2 BackWeb Plug-in - 4436233;Sonera Tietoturva;D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE [2006-02-23 12:11]
R2 F-Secure Filter;F-Secure File System Filter;D:\Program Files\Sonera Tietoturva\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 18:14]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;D:\Program Files\Sonera Tietoturva\Anti-Virus\Win2K\FSgk.sys [2008-03-17 14:28]
R2 F-Secure Recognizer;F-Secure File System Recognizer;D:\Program Files\Sonera Tietoturva\Anti-Virus\Win2K\FSrec.sys [2004-12-17 12:34]
R2 jsfax;jsfax;D:\WINDOWS\system32\drivers\jsfax.sys [1998-06-01 13:54]
R2 jspclcap;jspclcap;D:\WINDOWS\system32\drivers\jspclcap.sys [1998-06-01 13:54]
R3 CnxTgR;Conexant AccessRunner PCI ADSL Interface Device Driver;D:\WINDOWS\system32\DRIVERS\CnxTgR.sys [2003-05-12 13:54]
S3 CnxTgN;Conexant AccessRunner PCI ADSL LAN Adapter Driver;D:\WINDOWS\system32\DRIVERS\CnxTgN.sys [2003-05-12 14:02]
S3 CnxTgP;Conexant AccessRunner PCI ADSL LAN Adapter Filter Driver;D:\WINDOWS\system32\DRIVERS\CnxTgP.sys [2003-05-12 13:56]
S3 PCASp50;PCASp50 NDIS Protocol Driver;D:\WINDOWS\system32\Drivers\PCASp50.sys []
S3 Probe;Probe;D:\WINDOWS\system32\DRIVERS\probe.sys [2004-01-12 11:18]
S3 teamviewervpn;TeamViewer VPN Adapter;D:\WINDOWS\system32\DRIVERS\teamviewervpn.sys [2008-01-25 12:12]
S4 AFSEGTGF Windows Service;AFSEGTGF Windows Service;D:\WINDOWS\system32\dsuyd.exe []
S4 CallerIP;Visualware CallerIP;F:\CallerIP\cip-nt.exe []
S4 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;D:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe []
S4 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;D:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe []
S4 jsdbg;jsdbg;D:\WINDOWS\system32\drivers\jsdbg.sys [1998-06-01 13:54]
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-04-23 19:32:01 D:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- D:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-26 17:34:00
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MySql]
"ImagePath"="K:/MySQL/bin/mysqld-nt.exe"
[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MySql]
"ImagePath"="K:/MySQL/bin/mysqld-nt.exe"
[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\OMSCAN]
"ImagePath"="\Sys"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
-> D:\WINDOWS\system32\winlogon.exe
PROCESS: D:\WINDOWS\explorer.exe
-> D:\Program Files\Logitech\SetPoint\GameHook.dll
.
Completion time: 2008-05-26 17:36:58
ComboFix-quarantined-files.txt 2008-05-26 14:35:48
ComboFix2.txt 2008-05-26 13:48:22
Pre-Run: 3,669,950,464 tavua vapaana
Post-Run: 3,676,381,184 tavua vapaana
219 --- E O F --- 2008-05-26 13:24:07
|
|
Hujo
Suspended permanently
|
26. toukokuuta 2008 @ 18:13 |
Linkki tähän viestiin
|
Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
Lainaus:
File::
D:\WINDOWS\system32\pmnll.dll.vir
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
Voiko tietsikka koskaan toimia?
|
|
AkAntA
Junior Member
|
26. toukokuuta 2008 @ 18:29 |
Linkki tähän viestiin
|
ComboFix 08-05-25.4 - Jani 2008-05-26 18:19:54.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.515 [GMT 3:00]
Running from: D:\Documents and Settings\Jani\Työpöytä\ComboFix.exe
Command switches used :: D:\Documents and Settings\Jani\Työpöytä\CFScript.txt
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
D:\WINDOWS\system32\pmnll.dll.vir
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
D:\WINDOWS\system32\pmnll.dll.vir
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-04-26 to 2008-05-26 )))))))))))))))))
.
2008-05-26 18:06 . 2007-10-24 01:47 282,112 --a------ D:\WINDOWS\system32\TBD1BB2.tmp
2008-05-26 16:36 . 2008-05-26 16:36 505,856 --------- D:\WINDOWS\system32\WINLOGON.EXE.$DIS
2008-05-21 20:24 . 2008-05-21 20:24 <KANSIO> d-------- D:\Documents and Settings\Jani\Application Data\Malwarebytes
2008-05-21 20:24 . 2008-05-21 20:24 <KANSIO> d-------- D:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-21 20:24 . 2008-05-05 20:46 27,048 --a------ D:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-21 20:24 . 2008-05-05 20:46 15,864 --a------ D:\WINDOWS\system32\drivers\mbam.sys
2008-05-21 20:07 . 2008-05-21 20:07 <KANSIO> d-------- D:\VundoFix Backups
2008-05-21 18:53 . 2008-05-26 18:13 54,156 --ah----- D:\WINDOWS\QTFont.qfn
2008-05-21 18:53 . 2008-05-21 18:53 1,409 --a------ D:\WINDOWS\QTFont.for
2008-05-20 18:03 . 2008-05-20 18:03 127 --a------ D:\WINDOWS\system32\MRT.INI
2008-04-28 15:05 . 2007-08-18 10:54 380,928 --a------ D:\WINDOWS\system32\ac3filter.acm
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-26 15:02 --------- d-----w D:\Documents and Settings\Jani\Application Data\uTorrent
2008-05-22 16:13 --------- d-----w D:\Program Files\Common Files\Adobe
2008-05-22 16:11 --------- d-----w D:\Documents and Settings\Jani\Application Data\AdobeUM
2008-05-21 15:30 110,080 ------w D:\WINDOWS\system32\services.exe
2008-05-20 19:08 58,368 ------w D:\WINDOWS\system32\spoolsv.exe
2008-05-20 19:08 16,896 ------w D:\WINDOWS\system32\svchost.exe
2008-05-20 15:46 14,336 ----a-w D:\WINDOWS\system32\lsass.exe
2008-04-25 12:46 --------- d--h--w D:\Program Files\InstallShield Installation Information
2008-04-23 07:47 --------- d-----w D:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-04-22 08:55 --------- d-----w D:\Documents and Settings\Jani\Application Data\Media Player Classic
2008-04-22 06:34 --------- d-----w D:\Documents and Settings\Admin2\Application Data\ispnews
2008-04-21 08:16 --------- d-----w D:\Documents and Settings\Admin2\Application Data\PC Suite
2008-04-21 08:16 --------- d-----w D:\Documents and Settings\Admin2\Application Data\Logitech
2008-04-20 10:33 --------- d-----w D:\Documents and Settings\Jani\Application Data\Nokia Multimedia Player
2008-04-19 06:47 --------- d-----w D:\Program Files\Microsoft IntelliType Pro
2008-04-18 18:08 --------- d-----w D:\Program Files\MSN Messenger
2008-04-17 08:14 --------- d-----w D:\Documents and Settings\Jani\Application Data\Winamp
2008-04-09 08:38 --------- d-----w D:\Program Files\Winamp
2008-03-25 04:51 621,344 ----a-w D:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w D:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w D:\WINDOWS\system32\win32k.sys
2008-03-01 13:01 826,368 ----a-w D:\WINDOWS\system32\wininet.dll
.
------- Sigcheck -------
2008-05-20 22:08 16896 8d2a8f002bddf7413d8ddd3cfe58932a D:\WINDOWS\system32\svchost.exe
md5deep: D:\WINDOWS\system32\winlogon.exe: Permission denied
2008-05-21 18:30 110080 145d8cf51eab341a676e551c04a1505e D:\WINDOWS\system32\services.exe
2008-05-20 18:46 14336 3df6efbe297e056a2142fa89a46bbb0f D:\WINDOWS\system32\lsass.exe
.
((((((((((((((((((((((((((((( snapshot@2008-05-26_16.47.25.15 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-26 13:20:34 69,120 ----a-w D:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2008-05-26 15:04:26 69,120 ----a-w D:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- 2008-05-26 13:20:41 72,192 ----a-w D:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2008-05-26 15:04:33 72,192 ----a-w D:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
- 2008-05-26 13:20:21 4,444,160 ----a-w D:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
+ 2008-05-26 15:04:11 4,444,160 ----a-w D:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
- 2008-05-26 13:20:43 483,840 ----a-w D:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
+ 2008-05-26 15:04:36 483,840 ----a-w D:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
- 2008-05-26 13:20:27 3,036,160 ----a-w D:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
+ 2008-05-26 15:04:18 3,036,160 ----a-w D:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
- 2008-05-26 13:20:47 258,048 ----a-w D:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2008-05-26 15:04:39 258,048 ----a-w D:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2008-05-26 13:20:47 113,664 ----a-w D:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
+ 2008-05-26 15:04:39 113,664 ----a-w D:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
- 2008-05-26 13:20:41 261,120 ----a-w D:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
+ 2008-05-26 15:04:34 261,120 ----a-w D:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
- 2008-05-26 13:20:25 5,431,296 ----a-w D:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
+ 2008-05-26 15:04:16 5,431,296 ----a-w D:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
- 2008-05-26 13:20:32 10,752 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2008-05-26 15:04:23 10,752 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
- 2008-05-26 13:20:26 507,904 ----a-w D:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
+ 2008-05-26 15:04:17 507,904 ----a-w D:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
- 2008-05-26 13:20:34 13,312 ----a-w D:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2008-05-26 15:04:25 13,312 ----a-w D:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
- 2008-05-26 13:20:37 8,192 ----a-w D:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2008-05-26 15:04:29 8,192 ----a-w D:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
- 2008-05-26 13:20:38 77,824 ----a-w D:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
+ 2008-05-26 15:04:30 77,824 ----a-w D:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
- 2008-05-26 13:20:39 6,656 ----a-w D:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2008-05-26 15:04:31 6,656 ----a-w D:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
- 2008-05-26 13:20:47 348,160 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
+ 2008-05-26 15:04:40 348,160 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
- 2008-05-26 13:20:48 36,864 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
+ 2008-05-26 15:04:41 36,864 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
- 2008-05-26 13:20:49 655,360 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
+ 2008-05-26 15:04:43 655,360 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
- 2008-05-26 13:20:49 77,824 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
+ 2008-05-26 15:04:44 77,824 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
- 2008-05-26 13:20:39 749,568 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2008-05-26 15:04:31 749,568 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
- 2008-05-26 13:20:38 110,592 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
+ 2008-05-26 15:04:30 110,592 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
- 2008-05-26 13:20:37 372,736 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
+ 2008-05-26 15:04:28 372,736 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
- 2008-05-26 13:20:43 28,672 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2008-05-26 15:04:36 28,672 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2008-05-26 13:20:36 671,744 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2008-05-26 15:04:27 671,744 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- 2008-05-26 13:20:23 5,632 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
+ 2008-05-26 15:04:13 5,632 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
- 2008-05-26 13:20:45 12,800 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2008-05-26 15:04:38 12,800 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2008-05-26 13:20:35 32,768 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2008-05-26 15:04:27 32,768 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2008-05-26 13:20:35 7,168 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2008-05-26 15:04:26 7,168 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2008-05-26 13:20:40 110,592 ----a-w D:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
+ 2008-05-26 15:04:32 110,592 ----a-w D:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
- 2008-05-26 13:20:40 81,920 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2008-05-26 15:04:33 81,920 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- 2008-05-26 13:20:27 425,984 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
+ 2008-05-26 15:04:17 425,984 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
- 2008-05-26 13:20:28 741,376 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
+ 2008-05-26 15:04:19 741,376 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
- 2008-05-26 13:20:29 933,888 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
+ 2008-05-26 15:04:20 933,888 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
- 2008-05-26 13:20:50 5,070,848 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
+ 2008-05-26 15:04:45 5,070,848 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
- 2008-05-26 13:20:48 188,416 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
+ 2008-05-26 15:04:43 188,416 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
- 2008-05-26 13:20:33 401,408 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2008-05-26 15:04:24 401,408 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2008-05-26 13:20:44 81,920 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2008-05-26 15:04:37 81,920 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- 2008-05-26 13:20:23 630,784 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2008-05-26 15:04:13 630,784 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
- 2008-05-26 13:20:46 372,736 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
+ 2008-05-26 15:04:39 372,736 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
- 2008-05-26 13:20:44 258,048 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2008-05-26 15:04:37 258,048 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2008-05-26 13:20:42 299,008 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2008-05-26 15:04:35 299,008 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2008-05-26 13:20:41 131,072 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2008-05-26 15:04:34 131,072 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2008-05-26 13:20:24 258,048 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
+ 2008-05-26 15:04:14 258,048 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
- 2008-05-26 13:20:24 114,688 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2008-05-26 15:04:14 114,688 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2008-05-26 13:20:31 884,736 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
+ 2008-05-26 15:04:22 884,736 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
- 2008-05-26 13:20:32 90,112 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2008-05-26 15:04:23 90,112 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- 2008-05-26 13:20:30 839,680 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2008-05-26 15:04:21 839,680 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2008-05-26 13:20:33 5,013,504 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2008-05-26 15:04:25 5,013,504 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
- 2008-05-26 13:20:25 2,068,480 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
+ 2008-05-26 15:04:15 2,068,480 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
- 2008-05-26 13:20:30 3,076,096 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
+ 2008-05-26 15:04:20 3,076,096 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
- 2008-05-26 13:20:57 83,664 ----a-w D:\WINDOWS\system32\perfc009.dat
+ 2008-05-26 15:04:53 83,664 ----a-w D:\WINDOWS\system32\perfc009.dat
- 2008-05-26 13:20:57 100,444 ----a-w D:\WINDOWS\system32\perfc00B.dat
+ 2008-05-26 15:04:53 100,444 ----a-w D:\WINDOWS\system32\perfc00B.dat
- 2008-05-26 13:20:57 454,734 ----a-w D:\WINDOWS\system32\perfh009.dat
+ 2008-05-26 15:04:53 454,734 ----a-w D:\WINDOWS\system32\perfh009.dat
- 2008-05-26 13:20:57 431,130 ----a-w D:\WINDOWS\system32\perfh00B.dat
+ 2008-05-26 15:04:53 431,130 ----a-w D:\WINDOWS\system32\perfh00B.dat
- 2008-05-26 13:20:37 8,192 ----a-w D:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
+ 2008-05-26 15:04:29 8,192 ----a-w D:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
- 2008-05-26 13:20:47 258,048 ----a-w D:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
+ 2008-05-26 15:04:39 258,048 ----a-w D:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
- 2008-05-26 13:20:47 113,664 ----a-w D:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
+ 2008-05-26 15:04:39 113,664 ----a-w D:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
.
-- Snapshot reset to current date --
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-09-14 19:12 15360]
"Steam"="k:\valve\steam\steam.exe" [2008-03-28 16:45 1271032]
"ProBNC"="D:\Documents and Settings\Jani\Työpöytä\arkku\Arkku IP Updater\sysupdate.exe" [ ]
"msnmsgr"="D:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
"FTPUploader"="F:\ftpuploader\FTPUploader.exe" [ ]
"Free Download Manager"="F:\Free Download Manager\fdm.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HTpatch"="D:\WINDOWS\htpatch.exe" [2002-10-30 12:40 28672]
"SiSUSBRG"="D:\WINDOWS\SiSUSBrg.exe" [2002-07-12 19:15 106496]
"Cmaudio"="cmicnfg.cpl" []
"CnxDslTaskBar"="D:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe" [2003-05-12 14:24 454656]
"NeroFilterCheck"="D:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50 155648]
"F-Secure Manager"="D:\Program Files\Sonera Tietoturva\Common\FSM32.exe" [2005-05-09 10:05 118833]
"F-Secure TNB"="D:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" [2005-06-02 16:05 700416]
"News Service"="D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe" [2005-05-31 15:45 356352]
"RedLine Taskbar"="D:\Program Files\RedLine\Taskbar.exe" [2003-02-09 19:56 22528]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-12-10 12:45 49152 D:\WINDOWS\KHALMNPR.Exe]
"ATIPTA"="D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
"F-Secure Startup Wizard"="D:\Program Files\Sonera Tietoturva\FSGUI\FSSW.exe" [2005-11-18 15:57 372736]
"NvCplDaemon"="D:\WINDOWS\system32\NvCpl.dll" [2007-09-17 02:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 02:07 1626112 D:\WINDOWS\system32\nwiz.exe]
"HP Software Update"="D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"CamMonitor"="K:\Hewlett\Digital Imaging\\Unload\hpqcmon.exe" [2002-10-07 00:23 90112]
"Share-to-Web Namespace Daemon"="K:\Hewlett\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 10:42 69632]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"NvMediaCenter"="D:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 02:07 81920]
"QuickTime Task"="D:\Program Files\QuickTime\QTTask.exe" [2007-12-11 11:56 286720]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [ ]
"PCSuiteTrayApplication"="K:\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 13:20 227328]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-09-14 19:12 15360]
"Nokia.PCSync"="K:\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 15:58 1744896]
D:\Documents and Settings\Jani\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
mIRC.lnk - K:\mIRC\mirc.exe [2006-10-31 17:09:18 1949696]
D:\Documents and Settings\All Users\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
Adobe Gamma Loader.lnk - D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-06-05 17:20:04 110592]
Adobe Reader Speed Launch.lnk - D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
DllCmd32.lnk - C:\jetsuite\DLLCMD32.EXE [2007-09-04 14:20:35 12035]
gameutil.exe.lnk - D:\Program Files\redline\gameutil.exe [2003-07-10 17:04:14 26624]
HotKey Driver.lnk - D:\Program Files\HotKey\HotKey.exe [2005-06-05 16:34:11 36864]
HP LaserJet 3100 Status.lnk - C:\jetsuite\JETSTAT.EXE [2007-09-04 14:20:35 108291]
Logitech SetPoint.lnk - D:\Program Files\Logitech\SetPoint\SetPoint.exe [2005-07-28 23:15:42 434176]
Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 12:01:04 83360]
Sonera Tietoturva.lnk - D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe [2005-07-07 20:53:57 32807]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
D:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll 2005-01-31 15:13 49152 D:\PROGRA~1\COMMON~1\Stardock\MCPStub.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
--a------ 2004-08-22 17:05 81920 K:\Daemon Tools\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
D:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\itype]
--a------ 2005-12-04 16:38 437008 D:\Program Files\Microsoft IntelliType Pro\itype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2007-03-23 13:20 227328 K:\Nokia\Nokia PC Suite 6\LaunchApplication.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
--a------ 2006-09-25 18:50 20053544 D:\Program Files\Skype\Phone\Skype.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
"SandraTheSrv"=3 (0x3)
"SandraDataSrv"=3 (0x3)
"MySql"=2 (0x2)
"MDM"=2 (0x2)
"jsdaemon"=2 (0x2)
"iPodService"=3 (0x3)
"FirebirdServerDefaultInstance"=3 (0x3)
"FirebirdGuardianDefaultInstance"=2 (0x2)
"CallerIP"=3 (0x3)
"AFSEGTGF Windows Service"=2 (0x2)
"Adobe LM Service"=3 (0x3)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"K:\\Skype\\Phone\\Skype.exe"=
"K:\\Hamachi\\hamachi.exe"=
"K:\\jtn\\utorrent.exe"=
"D:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"D:\\Program Files\\MSN Messenger\\livecall.exe"=
"K:\\WoW\\World of Warcraft\\BackgroundDownloader.exe"=
"K:\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"D:\\Program Files\\Skype\\Phone\\Skype.exe"=
"D:\\Program Files\\Sonera Tietoturva\\backweb\\4436233\\Program\\fspex.exe"=
"K:\\mIRC\\mirc.exe"=
"K:\\Valve\\Steam\\SteamApps\\0_blingbling_0\\counter-strike\\hl.exe"=
"F:\\HLSW\\hlsw.exe"=
"D:\\Program Files\\Internet Explorer\\iexplore.exe"=
"K:\\The All-Seeing Eye\\eye.exe"=
"K:\\Valve\\steamapps\\kapu90\\counter-strike\\hl.exe"=
"K:\\Valve\\Steam\\SteamApps\\weetbixx\\counter-strike\\hl.exe"=
"F:\\DC++\\DCPlusPlus.exe"=
"K:\\Valve\\steamapps\\weetbixx\\counter-strike\\hl.exe"=
"K:\\sissari\\SiSoftware Sandra Lite XIIc\\Win32\\RpcDataSrv.exe"=
"K:\\sissari\\SiSoftware Sandra Lite XIIc\\RpcSandraSrv.exe"=
"K:\\Valve\\Steam\\SteamApps\\weetbixx\\counter-strike source\\hl2.exe"=
"K:\\Valve\\Steam\\SteamApps\\samasungu\\counter-strike source\\hl2.exe"=
"K:\\Valve\\Steam\\steam.exe"=
"D:\\WINDOWS\\system32\\dpvsetup.exe"=
"D:\\WINDOWS\\system32\\rtcshare.exe"=
"D:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"K:\\jtn\\P-660HW-D1_340AGL3C0_0100_Bridge.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"3724:TCP"= 3724:TCP:Blizzard Downloader
"612:TCP"= 612:TCP:Blizzard Downloader
"6881:TCP"= 6881:TCP:Blizzard Downloader
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R0 FSFW;F-Secure Firewall Driver;D:\WINDOWS\system32\drivers\fsdfw.sys [2005-08-22 16:05]
R1 bbcap;bbcap;D:\WINDOWS\system32\DRIVERS\bbcap.sys [2005-08-13 14:33]
R1 js1284;js1284;D:\WINDOWS\system32\drivers\js1284.sys [1998-06-01 13:54]
R1 jsmux;jsmux;D:\WINDOWS\system32\drivers\jsmux.sys [1998-06-01 13:54]
R1 jsscan;jsscan;D:\WINDOWS\system32\drivers\jsscan.sys [1998-06-01 13:54]
R2 BackWeb Plug-in - 4436233;Sonera Tietoturva;D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE [2006-02-23 12:11]
R2 F-Secure Filter;F-Secure File System Filter;D:\Program Files\Sonera Tietoturva\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 18:14]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;D:\Program Files\Sonera Tietoturva\Anti-Virus\Win2K\FSgk.sys [2008-03-17 14:28]
R2 F-Secure Recognizer;F-Secure File System Recognizer;D:\Program Files\Sonera Tietoturva\Anti-Virus\Win2K\FSrec.sys [2004-12-17 12:34]
R2 jsfax;jsfax;D:\WINDOWS\system32\drivers\jsfax.sys [1998-06-01 13:54]
R2 jspclcap;jspclcap;D:\WINDOWS\system32\drivers\jspclcap.sys [1998-06-01 13:54]
R3 CnxTgR;Conexant AccessRunner PCI ADSL Interface Device Driver;D:\WINDOWS\system32\DRIVERS\CnxTgR.sys [2003-05-12 13:54]
S3 CnxTgN;Conexant AccessRunner PCI ADSL LAN Adapter Driver;D:\WINDOWS\system32\DRIVERS\CnxTgN.sys [2003-05-12 14:02]
S3 CnxTgP;Conexant AccessRunner PCI ADSL LAN Adapter Filter Driver;D:\WINDOWS\system32\DRIVERS\CnxTgP.sys [2003-05-12 13:56]
S3 PCASp50;PCASp50 NDIS Protocol Driver;D:\WINDOWS\system32\Drivers\PCASp50.sys []
S3 Probe;Probe;D:\WINDOWS\system32\DRIVERS\probe.sys [2004-01-12 11:18]
S3 teamviewervpn;TeamViewer VPN Adapter;D:\WINDOWS\system32\DRIVERS\teamviewervpn.sys [2008-01-25 12:12]
S4 AFSEGTGF Windows Service;AFSEGTGF Windows Service;D:\WINDOWS\system32\dsuyd.exe []
S4 CallerIP;Visualware CallerIP;F:\CallerIP\cip-nt.exe []
S4 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;D:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe []
S4 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;D:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe []
S4 jsdbg;jsdbg;D:\WINDOWS\system32\drivers\jsdbg.sys [1998-06-01 13:54]
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-04-23 19:32:01 D:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- D:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-26 18:22:09
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MySql]
"ImagePath"="K:/MySQL/bin/mysqld-nt.exe"
[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MySql]
"ImagePath"="K:/MySQL/bin/mysqld-nt.exe"
[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\OMSCAN]
"ImagePath"="\Sys"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
-> D:\WINDOWS\system32\winlogon.exe
.
Completion time: 2008-05-26 18:25:36
ComboFix-quarantined-files.txt 2008-05-26 15:24:27
ComboFix2.txt 2008-05-26 14:37:01
ComboFix3.txt 2008-05-26 13:48:22
Pre-Run: 3,463,684,096 tavua vapaana
Post-Run: 3,502,915,584 tavua vapaana
345 --- E O F --- 2008-05-26 15:09:09
|
|
Hujo
Suspended permanently
|
26. toukokuuta 2008 @ 18:32 |
Linkki tähän viestiin
|
|
scannaa uusi hjt:n loki
Voiko tietsikka koskaan toimia?
|
|
AkAntA
Junior Member
|
26. toukokuuta 2008 @ 18:35 |
Linkki tähän viestiin
|
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:35:08, on 26.5.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\WINDOWS\ATKKBService.exe
D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
D:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
D:\WINDOWS\system32\nvsvc32.exe
D:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
D:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
D:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsrw.exe
D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
D:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
D:\WINDOWS\system32\WgaTray.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
D:\WINDOWS\htpatch.exe
D:\Program Files\TW-IA300C ADSL\CnxDslTb.exe
D:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe
D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
D:\PROGRA~1\SONERA~1\ANTI-S~1\fsaw.exe
K:\Hewlett\Digital Imaging\Unload\hpqcmon.exe
K:\Hewlett\HP Share-to-Web\hpgs2wnd.exe
D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
D:\Program Files\QuickTime\QTTask.exe
K:\Hewlett\HP Share-to-Web\hpgs2wnf.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Sonera Tietoturva\FSGUI\fsguidll.exe
D:\Program Files\redline\gameutil.exe
D:\Program Files\HotKey\HotKey.exe
D:\Program Files\Logitech\SetPoint\SetPoint.exe
D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
D:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
D:\WINDOWS\system32\wuauclt.exe
D:\WINDOWS\system32\notepad.exe
D:\WINDOWS\explorer.exe
D:\Program Files\Mozilla Firefox\firefox.exe
K:\mIRC\mirc.exe
D:\Program Files\MSN Messenger\msnmsgr.exe
K:\jtn\fasdfadsfdas\scanner.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [HTpatch] D:\WINDOWS\htpatch.exe
O4 - HKLM\..\Run: [SiSUSBRG] D:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [CnxDslTaskBar] "D:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [F-Secure Manager] "D:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "D:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [News Service] "D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
O4 - HKLM\..\Run: [RedLine Taskbar] D:\Program Files\RedLine\Taskbar.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "D:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [CamMonitor] K:\Hewlett\Digital Imaging\\Unload\hpqcmon.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] K:\Hewlett\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] K:\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "k:\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ProBNC] "D:\Documents and Settings\Jani\Työpöytä\arkku\Arkku IP Updater\sysupdate.exe"
O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [FTPUploader] F:\ftpuploader\FTPUploader.exe /s
O4 - HKCU\..\Run: [Free Download Manager] F:\Free Download Manager\fdm.exe -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: mIRC.lnk = K:\mIRC\mirc.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DllCmd32.lnk = C:\jetsuite\DLLCMD32.EXE
O4 - Global Startup: gameutil.exe.lnk = ?
O4 - Global Startup: HotKey Driver.lnk = D:\Program Files\HotKey\HotKey.exe
O4 - Global Startup: HP LaserJet 3100 Status.lnk = C:\jetsuite\JETSTAT.EXE
O4 - Global Startup: Logitech SetPoint.lnk = D:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Sonera Tietoturva.lnk = D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
O8 - Extra context menu item: &Estä tämä kohoikkuna - D:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - D:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - D:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab
O16 - DPF: {861FDA2A-2B57-4BDA-8B8B-305C9D5D8604} (_Multimedia Player) - http://stream.pussyharem.com/stream/mmp2.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
O23 - Service: Apple Mobile Device - Apple, Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - D:\WINDOWS\ATKKBService.exe
O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
O23 - Service: fsbwsys - F-Secure Corp. - D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Process Monitor (LVPrcSrv) - Unknown owner - d:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe (file missing)
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - D:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - K:\sissari\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - K:\sissari\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe
O23 - Service: ServiceLayer - Nokia. - D:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - D:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O24 - Desktop Component 3: sieni.us - Lyhyitä ja hauskoja flasheja, epileptikkojen paratiisi! - http://sieni.us/?id=6
--
End of file - 11520 bytes
|
|
Hujo
Suspended permanently
|
26. toukokuuta 2008 @ 18:39 |
Linkki tähän viestiin
|
|
loki ok
Voiko tietsikka koskaan toimia?
|
|
AkAntA
Junior Member
|
26. toukokuuta 2008 @ 21:58 |
Linkki tähän viestiin
|
|
Mitäs nyt? Virus vaivaa edelleen konetta.
|
|
Hujo
Suspended permanently
|
26. toukokuuta 2008 @ 22:06 |
Linkki tähän viestiin
|
|
ajas uudelleen Malwarebytes' Anti-Malware
Voiko tietsikka koskaan toimia?
|
|
AkAntA
Junior Member
|
28. toukokuuta 2008 @ 16:25 |
Linkki tähän viestiin
|
|
Tässä ois tulos
Malwarebytes' Anti-Malware 1.12
Tietokantaversio: 722
Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|F:\|G:\|H:\|K:\|)
Tarkistetut kohteet: 244475
Kulunut aika: 2 hour(s), 8 minute(s), 38 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 1
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
D:\WINDOWS\system32\WINLOGON.EXE.$DIS (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
|
|
Mainos
|
|
|
|
AkAntA
Junior Member
|
28. toukokuuta 2008 @ 20:34 |
Linkki tähän viestiin
|
|
Virus näyttäisi vihdoin lähteneen. Kiitos avusta.
|
|
