|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
W32/LowZones.ASU ilmeisesti messenger virus
|
|
|
aggre
Junior Member
|
1. kesäkuuta 2008 @ 13:19 |
Linkki tähän viestiin
|
Juu siis ongelmana on, että Norman virus control ilmoittelee W32/LowZones.ASU viruksesta (ja muutamasta muustakin) aina vaan uudelleen. Kone hidastelee käynnistätteässä. Toivottavasti joku voisi hieman analysoida logia. Kiitos etukäteen!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:47:54, on 1.6.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\csrss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\Program Files\Norman\Npm\Bin\Elogsvc.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Norman\Npm\Bin\Zanda.exe
F:\Program Files\Norman\npm\bin\nvoy.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\LEXBCES.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\system32\CTsvcCDA.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\wdfmgr.exe
F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
F:\Program Files\Canon\CAL\CALMAIN.exe
F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
F:\Program Files\Norman\Npm\bin\NJEEVES.EXE
F:\Program Files\Norman\Nvc\bin\nvcoas.exe
F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
F:\WINDOWS\System32\alg.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\wscntfy.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
F:\Program Files\QuickTime\qttask.exe
F:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
F:\WINDOWS\system32\RunDLL32.exe
F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe
F:\Program Files\Norman\Npm\bin\ZLH.EXE
F:\Util2\BitDefender\bdagent.exe
F:\WINDOWS\system32\rundll32.exe
F:\WINDOWS\system32\rundll32.exe
F:\WINDOWS\system32\Rundll32.exe
F:\WINDOWS\system32\lexpps.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Norman\Nvc\BIN\NIP.EXE
F:\Program Files\Norman\Nvc\bin\cclaw.exe
F:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
F:\Util2\BitDefender\vsserv.exe
F:\Util2\SeaMonkey\seamonkey.exe
F:\Program Files\HijackThis\HijackThis.exe
F:\WINDOWS\system32\wbem\wmiprvse.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Burn4Free Toolbar - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - F:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Gainward] F:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Norman ZANDA] "F:\Program Files\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH
O4 - HKLM\..\Run: [BDAgent] "F:\Util2\BitDefender\bdagent.exe"
O4 - HKLM\..\Run: [cc967efb] rundll32.exe "F:\WINDOWS\system32\wkblrkfj.dll",b
O4 - HKLM\..\Run: [000000af] rundll32.exe "F:\WINDOWS\system32\mtpkoxjf.dll",b
O4 - HKLM\..\Run: [BM079ac215] Rundll32.exe "F:\WINDOWS\system32\coqiaqtn.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "F:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - F:\Program Files\Yahoo!\Common\Yinsthelper.dll
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - F:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - F:\Program Files\Norman\Npm\Bin\Elogsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - F:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Norman NJeeves - Unknown owner - F:\Program Files\Norman\Npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Norman ASA - F:\Program Files\Norman\Npm\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - F:\Program Files\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - F:\Program Files\Norman\npm\bin\nvoy.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - F:\Util2\BitDefender\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
--
End of file - 7622 bytes
|
Senior Member
4 tuotearviota
|
1. kesäkuuta 2008 @ 16:24 |
Linkki tähän viestiin
|
Kyllä tuolla jotain örkkimörkkejä näyttäisi olevan.
Eli lataa koneellesi Malwarebytes Anti-Malware
http://www.malwarebytes.org/mbam.php
Päivitä ohjelma ja suorita täysi skannaus postaa mbam logi ja uusi hijackthis logi.
Huom. kun mbam on skannannut ja löytänyt jotain paina poista valitut kohteet (tai joku semmonen nappi ei tule nyt millään mieleen minkä niminen oli) ja lähetä se logi mikä aukeaa poistojen jälkeen.
|
|
aggre
Junior Member
|
3. kesäkuuta 2008 @ 06:49 |
Linkki tähän viestiin
|
Malwarebytes' Anti-Malware 1.14
Tietokantaversio: 814
6:36:02 3.6.2008
mbam-log-6-3-2008 (06-36-01).txt
Tarkistustyyppi: Täysi tarkistus (F:\|)
Tarkistetut kohteet: 237254
Kulunut aika: 2 hour(s), 29 minute(s), 58 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 2
Saastuneita rekisteriavaimia: 16
Saastuneita rekisteriarvoja: 4
Saastuneita rekisterikohteita: 1
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 17
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
F:\WINDOWS\system32\flpkivhy.dll (Trojan.Vundo) -> Unloaded module successfully.
F:\WINDOWS\system32\geBuSMgG.dll (Trojan.Vundo) -> Unloaded module successfully.
Saastuneita rekisteriavaimia:
HKEY_CLASSES_ROOT\CLSID\{689dd469-bde7-4343-9334-f87c2a818e38} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{689dd469-bde7-4343-9334-f87c2a818e38} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{06e12c36-760f-4d92-8509-5e5dbf12c423} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06e12c36-760f-4d92-8509-5e5dbf12c423} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{f0e738ca-4e59-446f-b34a-6bc26fb2c735} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f0e738ca-4e59-446f-b34a-6bc26fb2c735} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2eeddfba-0615-48de-86ad-7d8b561feac4} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2eeddfba-0615-48de-86ad-7d8b561feac4} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
Saastuneita rekisteriarvoja:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{06e12c36-760f-4d92-8509-5e5dbf12c423} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{f0e738ca-4e59-446f-b34a-6bc26fb2c735} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cc967efb (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM079ac215 (Trojan.Agent) -> Quarantined and deleted successfully.
Saastuneita rekisterikohteita:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: f:\windows\system32\gebusmgg -> Delete on reboot.
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
F:\WINDOWS\system32\flpkivhy.dll (Trojan.Vundo) -> Delete on reboot.
F:\Documents and Settings\Iina\Local Settings\Temporary Internet Files\Content.IE5\GTYZSXUN\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
F:\Documents and Settings\Noora1\Local Settings\Temporary Internet Files\Content.IE5\4OXTTLT7\kb767887[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
F:\Documents and Settings\Noora1\Local Settings\Temporary Internet Files\Content.IE5\MSXZOIFW\css4[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
F:\Documents and Settings\Noora1\Local Settings\Temporary Internet Files\Content.IE5\QRDGMO44\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
F:\System Volume Information\_restore{4682C78B-01EC-4A3C-9FBE-75E175E99283}\RP720\A0159579.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
F:\System Volume Information\_restore{4682C78B-01EC-4A3C-9FBE-75E175E99283}\RP721\A0159614.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
F:\System Volume Information\_restore{4682C78B-01EC-4A3C-9FBE-75E175E99283}\RP721\A0159695.com (Backdoor.Bot) -> Quarantined and deleted successfully.
F:\System Volume Information\_restore{4682C78B-01EC-4A3C-9FBE-75E175E99283}\RP721\A0160782.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
F:\System Volume Information\_restore{4682C78B-01EC-4A3C-9FBE-75E175E99283}\RP722\A0166999.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
F:\Util\Mozilla---\regxpcom.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
F:\WINDOWS\system32\efcccCTl.dll_old (Trojan.Vundo) -> Quarantined and deleted successfully.
F:\WINDOWS\system32\hblipvxe.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
F:\WINDOWS\system32\mtpkoxjf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
F:\WINDOWS\system32\uvsptnin.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
F:\WINDOWS\system32\igiccuop.dll (Trojan.Agent) -> Delete on reboot.
F:\WINDOWS\system32\geBuSMgG.dll (Trojan.Vundo) -> Delete on reboot.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:47:05, on 3.6.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\csrss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\Program Files\Norman\Npm\Bin\Elogsvc.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Norman\Npm\Bin\Zanda.exe
F:\Program Files\Norman\npm\bin\nvoy.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\LEXBCES.EXE
F:\WINDOWS\system32\LEXPPS.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\system32\CTsvcCDA.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
F:\WINDOWS\system32\wdfmgr.exe
F:\Program Files\QuickTime\qttask.exe
F:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
F:\WINDOWS\system32\RunDLL32.exe
F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe
F:\Program Files\Norman\Npm\bin\ZLH.EXE
F:\Util2\BitDefender\bdagent.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Canon\CAL\CALMAIN.exe
F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
F:\Program Files\Adobe\Reader\reader_sl.exe
F:\Program Files\Norman\Nvc\BIN\NIP.EXE
F:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
F:\Util2\BitDefender\vsserv.exe
F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
F:\Program Files\Norman\Npm\bin\NJEEVES.EXE
F:\Program Files\Norman\Nvc\bin\nvcoas.exe
F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
F:\WINDOWS\system32\wscntfy.exe
F:\Program Files\Norman\Nvc\bin\cclaw.exe
F:\WINDOWS\System32\alg.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
F:\Util2\SeaMonkey\seamonkey.exe
F:\Program Files\HijackThis\HijackThis.exe
F:\WINDOWS\system32\wbem\wmiprvse.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - F:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Burn4Free Toolbar Helper - {60BF5EE3-0105-4858-AD98-17C19F86B042} - F:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {A9791714-8C66-4EE6-9A2B-8925B23450DE} - F:\WINDOWS\system32\efcccCTl.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Burn4Free Toolbar - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - F:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Lexmark X1100 Series] "F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Gainward] F:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Norman ZANDA] "F:\Program Files\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH
O4 - HKLM\..\Run: [BDAgent] "F:\Util2\BitDefender\bdagent.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "F:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - F:\Program Files\Yahoo!\Common\Yinsthelper.dll
O20 - Winlogon Notify: rqRIaXRI - rqRIaXRI.dll (file missing)
O20 - Winlogon Notify: wvUOefFv - wvUOefFv.dll (file missing)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - F:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - F:\Program Files\Norman\Npm\Bin\Elogsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - F:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Norman NJeeves - Unknown owner - F:\Program Files\Norman\Npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Norman ASA - F:\Program Files\Norman\Npm\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - F:\Program Files\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - F:\Program Files\Norman\npm\bin\nvoy.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - F:\Util2\BitDefender\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
--
End of file - 8125 bytes
|
Senior Member
4 tuotearviota
|
3. kesäkuuta 2008 @ 10:01 |
Linkki tähän viestiin
|
Fixaa seuraavat rivit hjt:llä
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O20 - Winlogon Notify: rqRIaXRI - rqRIaXRI.dll (file missing)
O20 - Winlogon Notify: wvUOefFv - wvUOefFv.dll (file missing)
Poista järjestelmän palautus käytöstä ja boottaa kone bootin jälkeen skannaa viellä malwrebytesillä ja postaa sen logi ja uusi hjt logi
http://support.microsoft.com/kb/310405/fi
(Muista päivittää malwarebytesi ennen skannausta)
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 3. kesäkuuta 2008 @ 10:02
|
|
aggre
Junior Member
|
4. kesäkuuta 2008 @ 06:24 |
Linkki tähän viestiin
|
Malwarebytes' Anti-Malware 1.14
Tietokantaversio: 818
6:17:23 4.6.2008
mbam-log-6-4-2008 (06-17-23).txt
Tarkistustyyppi: Täysi tarkistus (F:\|)
Tarkistetut kohteet: 228055
Kulunut aika: 2 hour(s), 29 minute(s), 52 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 2
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
F:\WINDOWS\system32\flpkivhy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
F:\WINDOWS\system32\geBuSMgG.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:20:16, on 4.6.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\csrss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\Program Files\Norman\Npm\Bin\Elogsvc.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Norman\Npm\Bin\Zanda.exe
F:\Program Files\Norman\npm\bin\nvoy.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\LEXBCES.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\system32\LEXPPS.EXE
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\CTsvcCDA.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\wdfmgr.exe
F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
F:\Program Files\Canon\CAL\CALMAIN.exe
F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
F:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
F:\WINDOWS\system32\RunDLL32.exe
F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe
F:\Program Files\Norman\Npm\bin\ZLH.EXE
F:\Util2\BitDefender\bdagent.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
F:\Program Files\Norman\Nvc\BIN\NIP.EXE
F:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
F:\Program Files\Norman\Npm\bin\NJEEVES.EXE
F:\Program Files\Norman\Nvc\bin\nvcoas.exe
F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
F:\WINDOWS\system32\wscntfy.exe
F:\Program Files\Norman\Nvc\bin\cclaw.exe
F:\WINDOWS\System32\alg.exe
F:\WINDOWS\System32\svchost.exe
F:\Util2\SeaMonkey\seamonkey.exe
F:\Program Files\HijackThis\HijackThis.exe
F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
F:\WINDOWS\system32\wbem\wmiprvse.exe
F:\Util2\BitDefender\vsserv.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - F:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Burn4Free Toolbar Helper - {60BF5EE3-0105-4858-AD98-17C19F86B042} - F:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {A9791714-8C66-4EE6-9A2B-8925B23450DE} - F:\WINDOWS\system32\efcccCTl.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Burn4Free Toolbar - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - F:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
O4 - HKLM\..\Run: [Lexmark X1100 Series] "F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [Gainward] F:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Norman ZANDA] "F:\Program Files\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH
O4 - HKLM\..\Run: [BDAgent] "F:\Util2\BitDefender\bdagent.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "F:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - F:\Program Files\Yahoo!\Common\Yinsthelper.dll
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - F:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - F:\Program Files\Norman\Npm\Bin\Elogsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - F:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Norman NJeeves - Unknown owner - F:\Program Files\Norman\Npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Norman ASA - F:\Program Files\Norman\Npm\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - F:\Program Files\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - F:\Program Files\Norman\npm\bin\nvoy.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - F:\Util2\BitDefender\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
--
End of file - 7658 bytes
Norman huutelee muuten kolmesta tiedostosta jatkuvasti skannauksen aikana ja sen jälkeen:
W32/Virtumonde
W32/Inject
W32/Vundo
|
Senior Member
4 tuotearviota
|
4. kesäkuuta 2008 @ 10:34 |
Linkki tähän viestiin
|
1. Lataa Combofix.exe työpöydällesi jommastakummasta linkistä:
Combofix.exe
Combofix.exe
Avaa Combofix.exe ja seuraa näyttöön tulevia ohjeita
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne.
Tyhjennä roskakori ja käynnistä koneesi uudelleen.
Postita tänne seuraavat lokit:
* Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
* (C:\ComboFix.txt) raportti
*
|
|
aggre
Junior Member
|
4. kesäkuuta 2008 @ 11:07 |
Linkki tähän viestiin
|
Otinkin combofixin login tuossa hetki sitten.
ComboFix 08-05-29.1 - Ile 2008-06-04 6:47:00.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.175 [GMT 3:00]
Running from: F:\Temp\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
F:\Autorun.inf
F:\WINDOWS\BM079ac215.xml
F:\WINDOWS\pskt.ini
F:\WINDOWS\system32\cojfkouj.ini
F:\WINDOWS\system32\fjxokptm.ini
F:\WINDOWS\system32\GgMSuBeg.ini
F:\WINDOWS\system32\GgMSuBeg.ini2
F:\WINDOWS\system32\igiccuop.dll
F:\WINDOWS\system32\jfkrlbkw.ini
F:\WINDOWS\system32\lTCcccfe.ini
F:\WINDOWS\system32\lTCcccfe.ini2
F:\WINDOWS\system32\MabryObj.dll
F:\WINDOWS\system32\mcrh.tmp
F:\WINDOWS\system32\prqjwmhg.ini
F:\WINDOWS\system32\trpskbva.ini
F:\WINDOWS\system32\xfxsduon.ini
.
((((((((((((((((((((((((( Files Created from 2008-05-04 to 2008-06-04 )))))))))))))))))))))))))))))))
.
2008-06-02 13:10 . 2008-06-02 13:10 <DIR> d-------- F:\Documents and Settings\Iina\Application Data\Malwarebytes
2008-06-02 09:00 . 2008-06-02 09:00 <DIR> d-------- F:\Documents and Settings\Ilari\Application Data\Malwarebytes
2008-06-02 08:59 . 2008-06-03 06:34 <DIR> d-------- F:\Program Files\Malwarebytes' Anti-Malware
2008-06-02 08:59 . 2008-06-02 08:59 <DIR> d-------- F:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-02 08:59 . 2008-05-30 01:06 34,296 --a------ F:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-02 08:59 . 2008-05-30 01:06 15,864 --a------ F:\WINDOWS\system32\drivers\mbam.sys
2008-06-02 08:55 . 2008-06-02 08:55 1,756,760 --a------ F:\Temp\mbam-setup.exe
2008-06-01 12:38 . 2008-06-01 12:39 1,948,397 --a------ F:\Temp\ComboFix.exe
2008-06-01 12:30 . 2008-06-01 12:30 <DIR> d-------- F:\Temp\hijackthis_v2.0.2
2008-06-01 12:12 . 2008-06-01 12:12 499,568 --a------ F:\Temp\hijackthis_v2.0.2.zip
2008-05-31 22:00 . 2008-05-31 22:00 <DIR> d-------- F:\WINDOWS\system32\scripting
2008-05-31 21:55 . 2008-05-31 21:55 <DIR> d-------- F:\WINDOWS\ServicePackFiles
2008-05-31 21:55 . 2008-04-14 05:42 294,912 -----c--- F:\WINDOWS\system32\dllcache\dlimport.exe
2008-05-31 21:49 . 2006-12-29 00:31 19,569 --a------ F:\WINDOWS\003053_.tmp
2008-05-31 21:21 . 2008-05-31 21:28 331,805,736 --a------ F:\Temp\WindowsXP-KB936929-SP3-x86-ENU.exe
2008-05-31 11:02 . 2008-05-31 11:02 268 --ah----- F:\sqmdata07.sqm
2008-05-31 11:02 . 2008-05-31 11:02 244 --ah----- F:\sqmnoopt07.sqm
2008-05-30 22:10 . 2008-05-30 22:10 268 --ah----- F:\sqmdata06.sqm
2008-05-30 22:10 . 2008-05-30 22:10 244 --ah----- F:\sqmnoopt06.sqm
2008-05-30 21:54 . 2008-05-30 21:54 <DIR> d-------- F:\Documents and Settings\Ilari\Application Data\Bitdefender
2008-05-30 21:50 . 2008-05-30 21:50 244 --ah----- F:\sqmnoopt05.sqm
2008-05-30 21:50 . 2008-05-30 21:50 232 --ah----- F:\sqmdata05.sqm
2008-05-30 21:46 . 2008-05-30 21:46 <DIR> d-------- F:\Documents and Settings\Administrator.AIVANOMAKONEXP\tmp\Application Data\Bitdefender
2008-05-30 21:11 . 2008-06-04 06:58 81,984 --a------ F:\WINDOWS\system32\bdod.bin
2008-05-30 21:11 . 2008-05-30 21:11 244 --ah----- F:\sqmnoopt04.sqm
2008-05-30 21:11 . 2008-05-30 21:11 232 --ah----- F:\sqmdata04.sqm
2008-05-30 21:05 . 2008-05-30 21:06 <DIR> d-------- F:\Documents and Settings\All Users\Application Data\BitDefender
2008-05-30 21:03 . 2008-05-30 21:06 <DIR> d-------- F:\Program Files\Common Files\Softwin
2008-05-30 20:58 . 2008-05-30 20:58 244 --ah----- F:\sqmnoopt03.sqm
2008-05-30 20:58 . 2008-05-30 20:58 232 --ah----- F:\sqmdata03.sqm
2008-05-30 15:41 . 2008-05-30 11:29 22,103,392 --a------ F:\Temp\bitdefender_free_v10.exe
2008-05-30 07:02 . 2008-05-30 07:02 93 --a------ F:\WINDOWS\wininit.ini
2008-05-29 21:36 . 2008-05-29 21:34 691,545 --a------ F:\WINDOWS\unins000.exe
2008-05-29 21:36 . 2008-05-29 21:36 2,557 --a------ F:\WINDOWS\unins000.dat
2008-05-24 19:08 . 2008-05-26 20:11 <DIR> d-------- F:\Documents and Settings\Noora1\Application Data\uTorrent
2008-05-24 16:35 . 2008-05-25 08:14 <DIR> d-------- F:\Program Files\uTorrent
2008-05-24 16:35 . 2008-05-27 18:35 <DIR> d-------- F:\Documents and Settings\Iina\Application Data\uTorrent
2008-05-06 06:29 . 2008-06-03 19:17 54,156 --ah----- F:\WINDOWS\QTFont.qfn
2008-05-06 06:29 . 2008-05-06 06:29 1,409 --a------ F:\WINDOWS\QTFont.for
2008-05-04 08:32 . 2008-05-04 08:32 <DIR> d-------- F:\Documents and Settings\Ilari\workspace
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-04 03:59 --------- d-----w F:\Program Files\Norman
2008-06-03 17:50 --------- d-----w F:\Documents and Settings\Noora1\Application Data\Nokia
2008-05-30 18:50 --------- d-----w F:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-28 10:43 --------- d-----w F:\Program Files\Torrent
2008-05-28 10:41 --------- d-----w F:\Documents and Settings\Ilari\Application Data\uTorrent
2008-05-25 11:08 9,216 --sha-w F:\Program Files\Thumbs.db
2008-05-19 13:34 --------- d---a-w F:\Documents and Settings\All Users\Application Data\TEMP
2008-05-19 05:23 --------- d-----w F:\Documents and Settings\Noora1\Application Data\dvdcss
2008-04-30 18:39 --------- d-----w F:\Documents and Settings\Noora1\Application Data\Yahoo!
2008-04-14 02:55 1,804 ----a-w F:\WINDOWS\system32\dcache.bin
2008-04-14 02:46 329,728 ----a-w F:\WINDOWS\system32\netsetup.exe
2008-04-14 02:43 92,424 ----a-w F:\WINDOWS\system32\rdpdd.dll
2008-04-14 02:43 87,176 ----a-w F:\WINDOWS\system32\rdpwsx.dll
2008-04-14 02:43 40,840 ----a-w F:\WINDOWS\system32\drivers\termdd.sys
2008-04-14 02:43 21,896 ----a-w F:\WINDOWS\system32\drivers\tdtcp.sys
2008-04-14 02:43 139,656 ----a-w F:\WINDOWS\system32\drivers\rdpwd.sys
2008-04-14 02:43 12,168 ----a-w F:\WINDOWS\system32\tsddd.dll
2008-04-14 02:43 12,040 ----a-w F:\WINDOWS\system32\drivers\tdpipe.sys
2008-04-14 02:41 98,304 ----a-w F:\WINDOWS\system32\actxprxy.dll
2008-04-14 02:40 53,279 ----a-w F:\WINDOWS\system32\odbcji32.dll
2008-04-14 02:40 4,126 ----a-w F:\WINDOWS\system32\msdxmlc.dll
2008-04-14 02:40 3,584 ----a-w F:\WINDOWS\system32\msafd.dll
2008-04-13 22:00 1,845,632 ----a-w F:\WINDOWS\system32\win32k.sys
2008-04-13 21:58 175,744 ----a-w F:\WINDOWS\system32\drivers\rdbss.sys
2008-04-13 21:57 2,188,928 ----a-w F:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 21:51 162,816 ----a-w F:\WINDOWS\system32\drivers\netbt.sys
2008-04-13 21:50 91,520 ----a-w F:\WINDOWS\system32\drivers\ndiswan.sys
2008-04-13 21:50 361,344 ----a-w F:\WINDOWS\system32\drivers\tcpip.sys
2008-04-13 21:50 182,656 ----a-w F:\WINDOWS\system32\drivers\ndis.sys
2008-04-13 21:49 75,264 ----a-w F:\WINDOWS\system32\drivers\ipsec.sys
2008-04-13 21:49 51,328 ----a-w F:\WINDOWS\system32\drivers\rasl2tp.sys
2008-04-13 21:49 48,384 ----a-w F:\WINDOWS\system32\drivers\raspptp.sys
2008-04-13 21:49 146,048 ----a-w F:\WINDOWS\system32\drivers\portcls.sys
2008-04-13 21:49 138,112 ----a-w F:\WINDOWS\system32\drivers\afd.sys
2008-04-13 21:48 52,480 ----a-w F:\WINDOWS\system32\drivers\i8042prt.sys
2008-04-13 21:47 83,072 ----a-w F:\WINDOWS\system32\drivers\wdmaud.sys
2008-04-13 21:47 456,576 ----a-w F:\WINDOWS\system32\drivers\mrxsmb.sys
2008-04-13 21:47 105,344 ----a-w F:\WINDOWS\system32\drivers\mup.sys
2008-04-13 21:46 49,536 ----a-w F:\WINDOWS\system32\drivers\classpnp.sys
2008-04-13 21:46 141,056 ----a-w F:\WINDOWS\system32\drivers\ks.sys
2008-04-13 21:45 64,512 ----a-w F:\WINDOWS\system32\drivers\serial.sys
2008-04-13 21:45 60,800 ----a-w F:\WINDOWS\system32\drivers\sysaudio.sys
2008-04-13 21:45 574,976 ----a-w F:\WINDOWS\system32\drivers\ntfs.sys
2008-04-13 21:45 334,848 ----a-w F:\WINDOWS\system32\drivers\srv.sys
2008-04-13 21:44 63,744 ----a-w F:\WINDOWS\system32\drivers\cdfs.sys
2008-04-13 21:44 143,744 ----a-w F:\WINDOWS\system32\drivers\fastfat.sys
2008-04-13 21:30 30,080 ----a-w F:\WINDOWS\system32\drivers\modem.sys
2008-04-13 21:30 225,664 ----a-w F:\WINDOWS\system32\drivers\tcpip6.sys
2008-04-13 21:30 19,072 ----a-w F:\WINDOWS\system32\drivers\tdi.sys
2008-04-13 21:27 41,472 ----a-w F:\WINDOWS\system32\drivers\raspppoe.sys
2008-04-13 21:27 40,576 ----a-w F:\WINDOWS\system32\drivers\ndproxy.sys
2008-04-13 21:27 34,560 ----a-w F:\WINDOWS\system32\drivers\wanarp.sys
2008-04-13 21:27 20,864 ----a-w F:\WINDOWS\system32\drivers\ipinip.sys
2008-04-13 21:27 152,832 ----a-w F:\WINDOWS\system32\drivers\ipnat.sys
2008-04-13 21:27 14,336 ----a-w F:\WINDOWS\system32\drivers\asyncmac.sys
2008-04-13 21:27 10,112 ----a-w F:\WINDOWS\system32\drivers\ndistapi.sys
2008-04-13 21:26 88,320 ----a-w F:\WINDOWS\system32\drivers\nwlnkipx.sys
2008-04-13 21:26 69,120 ----a-w F:\WINDOWS\system32\drivers\psched.sys
2008-04-13 21:26 35,072 ----a-w F:\WINDOWS\system32\drivers\msgpc.sys
2008-04-13 21:26 34,688 ----a-w F:\WINDOWS\system32\drivers\netbios.sys
2008-04-13 21:26 30,592 ----a-w F:\WINDOWS\system32\drivers\rndismp.sys
2008-04-13 21:26 30,592 ------w F:\WINDOWS\system32\drivers\rndismpx.sys
2008-04-13 21:26 14,592 ----a-w F:\WINDOWS\system32\drivers\ndisuio.sys
2008-04-13 21:26 12,800 ----a-w F:\WINDOWS\system32\drivers\usb8023.sys
2008-04-13 21:26 12,800 ------w F:\WINDOWS\system32\drivers\usb8023x.sys
2008-04-13 21:26 12,288 ----a-w F:\WINDOWS\system32\drivers\tunmp.sys
2008-04-13 21:25 202,624 ----a-w F:\WINDOWS\system32\drivers\rmcast.sys
2008-04-13 21:24 11,264 ----a-w F:\WINDOWS\system32\drivers\irenum.sys
2008-04-13 21:23 71,552 ----a-w F:\WINDOWS\system32\drivers\bridge.sys
2008-04-13 21:23 40,320 ----a-w F:\WINDOWS\system32\drivers\nmnt.sys
2008-04-13 21:23 36,608 ----a-w F:\WINDOWS\system32\drivers\ip6fw.sys
2008-04-13 21:23 264,832 ----a-w F:\WINDOWS\system32\drivers\http.sys
2008-04-13 21:21 61,824 ----a-w F:\WINDOWS\system32\drivers\nic1394.sys
2008-04-13 21:21 60,800 ----a-w F:\WINDOWS\system32\drivers\arp1394.sys
2008-04-13 21:21 59,904 ----a-w F:\WINDOWS\system32\drivers\atmarpc.sys
2008-04-13 21:21 55,808 ----a-w F:\WINDOWS\system32\drivers\atmlane.sys
2008-04-13 21:21 101,120 ------w F:\WINDOWS\system32\drivers\bthpan.sys
2008-04-13 21:17 25,856 ----a-w F:\WINDOWS\system32\drivers\usbprint.sys
2008-04-13 21:16 59,136 ------w F:\WINDOWS\system32\drivers\rfcomm.sys
2008-04-13 21:16 37,888 ------w F:\WINDOWS\system32\drivers\bthmodem.sys
2008-04-13 21:16 36,480 ------w F:\WINDOWS\system32\drivers\bthprint.sys
2008-04-13 21:16 273,024 ------w F:\WINDOWS\system32\drivers\bthport.sys
2008-04-13 21:16 25,600 ------w F:\WINDOWS\system32\drivers\hidbth.sys
2008-04-13 21:16 25,344 ----a-w F:\WINDOWS\system32\drivers\sonydcam.sys
2008-04-13 21:16 18,944 ------w F:\WINDOWS\system32\drivers\bthusb.sys
2008-04-13 21:16 17,024 ------w F:\WINDOWS\system32\drivers\bthenum.sys
2008-04-13 21:16 121,984 ------w F:\WINDOWS\system32\drivers\usbvideo.sys
2008-04-13 21:14 81,664 ----a-w F:\WINDOWS\system32\drivers\videoprt.sys
2008-04-13 21:14 799,744 ----a-w F:\WINDOWS\system32\drivers\dmboot.sys
2008-04-13 21:14 20,992 ----a-w F:\WINDOWS\system32\drivers\vga.sys
2008-04-13 21:14 153,344 ----a-w F:\WINDOWS\system32\drivers\dmio.sys
2008-04-13 21:13 9,728 ------w F:\WINDOWS\system32\comsdupd.exe
2008-04-13 21:13 14,208 ------w F:\WINDOWS\system32\drivers\wacompen.sys
2008-04-13 21:13 12,800 ----a-w F:\WINDOWS\system32\spiisupd.exe
2008-04-13 21:13 12,672 ------w F:\WINDOWS\system32\drivers\mutohpen.sys
2008-04-13 21:11 52,352 ----a-w F:\WINDOWS\system32\drivers\volsnap.sys
2008-04-13 21:11 42,112 ----a-w F:\WINDOWS\system32\drivers\imapi.sys
2008-04-13 21:09 92,544 ----a-w F:\WINDOWS\system32\drivers\mqac.sys
2008-04-13 21:09 7,552 ----a-w F:\WINDOWS\system32\drivers\mskssrv.sys
2008-04-13 21:09 5,376 ----a-w F:\WINDOWS\system32\drivers\mspclock.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A9791714-8C66-4EE6-9A2B-8925B23450DE}]
F:\WINDOWS\system32\efcccCTl.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="F:\WINDOWS\system32\ctfmon.exe" [2008-04-14 05:42 15360]
"Yahoo! Pager"="F:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-08-30 18:43 4670704]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lexmark X1100 Series"="F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-03-28 16:20 57344]
"Gainward"="F:\WINDOWS\TBPanel.exe" [2002-11-26 10:52 2015232]
"SunJavaUpdateSched"="F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"NvCplDaemon"="F:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22 7700480]
"NvMediaCenter"="NvMCTray.dll" [2006-10-22 13:22 86016 F:\WINDOWS\system32\nvmctray.dll]
"PCSuiteTrayApplication"="F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 14:20 227328]
"Norman ZANDA"="F:\Program Files\Norman\Npm\bin\ZLH.exe" [2007-12-17 15:38 273520]
"BDAgent"="F:\Util2\BitDefender\bdagent.exe" [2007-03-26 15:49 69632]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 05:42 15360]
"Nokia.PCSync"="F:\Util2\Pc-Suite\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 16:58 1744896]
F:\Documents and Settings\Administrator.AIVANOMAKONEXP\Start Menu\Programs\Startup\
Microsoft Find Fast.lnk - F:\Program Files\Microsoft Office\Office\FINDFAST.EXE [11/21/1996 1:00:00 AM 111376]
Office Startup.lnk - F:\Program Files\Microsoft Office\Office\OSA.EXE [11/21/1996 1:00:00 AM 51984]
F:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - F:\Program Files\Adobe\Reader\reader_sl.exe [9/23/2005 11:05:26 PM 29696]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=sockspy.dll
[HKLM\~\startupfolder\F:^Documents and Settings^All Users^Start Menu^Programs^Startup^Run Nintendo Wi-Fi USB Connector Registration Tool.lnk]
path=F:\Documents and Settings\All Users\Start Menu\Programs\Startup\Run Nintendo Wi-Fi USB Connector Registration Tool.lnk
backup=F:\WINDOWS\pss\Run Nintendo Wi-Fi USB Connector Registration Tool.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YouRipper]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"F:\\Pelit3\\TM Nations\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
"F:\\WINDOWS\\system32\\javaw.exe"=
"F:\\WINDOWS\\system32\\LEXPPS.EXE"=
"F:\\WINDOWS\\system32\\dpvsetup.exe"=
"F:\\Util\\Corel\\Register\\NAVBrowser.exe"=
"F:\\Program Files\\WiFiConnector\\NintendoWFCReg.exe"=
"F:\\WINDOWS\\system32\\sessmgr.exe"=
"F:\\Pelit3\\Sid Meier's Civilization IV Complete\\Civilization4.exe"=
"F:\\Pelit3\\Sid Meier's Civilization IV Complete\\Beyond the Sword\\Civ4BeyondSword.exe"=
"F:\\Pelit3\\Sid Meier's Civilization IV Complete\\Warlords\\Civ4Warlords.exe"=
"F:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"F:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"F:\\Program Files\\Messenger\\msmsgs.exe"=
"F:\\Program Files\\NetMeeting\\conf.exe"=
"F:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"F:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"F:\\Program Files\\Torrent\\uTorrent.exe"=
"F:\\Util\\AtomTime\\AboutTime.exe"=
"F:\\Program Files\\Google\\Google Earth\\googleearth.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"80:TCP"= 80:TCP:*:Disabled:googleearth.exe
R2 Ndiskio;Ndiskio;F:\Program Files\Norman\Nse\bin\NDISKIO.SYS [2007-01-02 10:55]
R2 NVOY;Norman's Very Own supplY of resources;"F:\Program Files\Norman\npm\bin\nvoy.exe" [2008-01-22 16:04]
R3 NvcMFlt;NvcMFlt;F:\WINDOWS\system32\DRIVERS\nvcw32mf.sys [2008-02-11 15:56]
R3 nvcoas;Norman Virus Control on-access component;"F:\Program Files\Norman\Nvc\bin\nvcoas.exe" [2007-12-10 15:36]
R3 NVCScheduler;Norman Virus Control Scheduler;"F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE" [2007-09-18 12:41]
S3 ewdmaudn;ewdmaudn;F:\DOCUME~1\Noora1\LOCALS~1\Temp\ewdmaudn.sys []
.
Contents of the 'Scheduled Tasks' folder
"2008-05-30 18:49:20 F:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job"
- F:\Util2\Spybot - Search & Destroy\Spybot - Search & Destroy\SpybotSD.exe
"2006-04-12 16:15:23 F:\WINDOWS\Tasks\Users.job"
- F:\WINDOWS\system32\ntbackup.execbackup
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-04 07:00:57
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
F:\Program Files\Norman\npm\Bin\elogsvc.exe
F:\Program Files\Norman\npm\Bin\Zanda.exe
F:\WINDOWS\system32\LEXBCES.EXE
F:\WINDOWS\system32\LEXPPS.EXE
F:\WINDOWS\system32\CTSVCCDA.EXE
F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\system32\wdfmgr.exe
F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
F:\Program Files\Canon\CAL\CALMAIN.exe
F:\Util2\BitDefender\vsserv.exe
F:\Program Files\Norman\npm\Bin\Njeeves.exe
F:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
F:\WINDOWS\system32\rundll32.exe
F:\Program Files\Norman\Nvc\Bin\Nip.exe
F:\Program Files\Norman\Nvc\Bin\CClaw.exe
F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
F:\PROGRA~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
F:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-06-04 7:09:58 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-04 04:09:38
Pre-Run: 6,033,469,440 bytes free
Post-Run: 8,223,510,528 bytes free
283 --- E O F --- 2008-05-17 06:16:23
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:03:20, on 4.6.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\csrss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\Program Files\Norman\Npm\Bin\Elogsvc.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Norman\Npm\Bin\Zanda.exe
F:\Program Files\Norman\npm\bin\nvoy.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\LEXBCES.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\system32\LEXPPS.EXE
F:\WINDOWS\system32\CTsvcCDA.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\wdfmgr.exe
F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
F:\Program Files\Canon\CAL\CALMAIN.exe
F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
F:\Program Files\Norman\Npm\bin\NJEEVES.EXE
F:\WINDOWS\System32\alg.exe
F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
F:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
F:\WINDOWS\system32\RunDLL32.exe
F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe
F:\Program Files\Norman\Npm\bin\ZLH.EXE
F:\Util2\BitDefender\bdagent.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
F:\WINDOWS\System32\svchost.exe
F:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
F:\Program Files\Norman\Nvc\BIN\NIP.EXE
F:\Program Files\Norman\Nvc\bin\nvcoas.exe
F:\Program Files\Norman\Nvc\bin\cclaw.exe
F:\Program Files\Spyware Doctor\SDTrayApp.exe
F:\WINDOWS\explorer.exe
F:\Util2\SeaMonkey\seamonkey.exe
F:\Program Files\Spyware Doctor\svcntaux.exe
F:\Program Files\Spyware Doctor\swdsvc.exe
F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
F:\Util2\BitDefender\vsserv.exe
F:\Program Files\HijackThis\HijackThis.exe
F:\WINDOWS\system32\wbem\wmiprvse.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - F:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Burn4Free Toolbar Helper - {60BF5EE3-0105-4858-AD98-17C19F86B042} - F:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {A9791714-8C66-4EE6-9A2B-8925B23450DE} - F:\WINDOWS\system32\efcccCTl.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Burn4Free Toolbar - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - F:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
O4 - HKLM\..\Run: [Lexmark X1100 Series] "F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [Gainward] F:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Norman ZANDA] "F:\Program Files\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH
O4 - HKLM\..\Run: [BDAgent] "F:\Util2\BitDefender\bdagent.exe"
O4 - HKLM\..\Run: [SDTray] "F:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "F:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - F:\Program Files\Yahoo!\Common\Yinsthelper.dll
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - F:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - F:\Program Files\Norman\Npm\Bin\Elogsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - F:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Norman NJeeves - Unknown owner - F:\Program Files\Norman\Npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Norman ASA - F:\Program Files\Norman\Npm\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - F:\Program Files\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - F:\Program Files\Norman\npm\bin\nvoy.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - F:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - F:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: ServiceLayer - Nokia. - F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - F:\Util2\BitDefender\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
--
End of file - 8069 bytes
|
Senior Member
4 tuotearviota
|
4. kesäkuuta 2008 @ 11:12 |
Linkki tähän viestiin
|
Fixaa seuraavat rivit Hijacthis:llä
O2 - BHO: (no name) - {A9791714-8C66-4EE6-9A2B-8925B23450DE} - F:\WINDOWS\system32\efcccCTl.dll (file missing)
Lataa Malwarebytes' Anti-Malware työpöydällesi.
* Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
* Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes' Anti-Malware ja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Finish.
* Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
* Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
* Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
* Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
* Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös
täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
* Lähetä lokin sisältö seuraavassa viestissäsi + uusi hjt-loki.
|
|
aggre
Junior Member
|
5. kesäkuuta 2008 @ 07:25 |
Linkki tähän viestiin
|
Malwarebytes' Anti-Malware 1.14
Tietokantaversio: 824
7:21:15 5.6.2008
mbam-log-6-5-2008 (07-21-15).txt
Tarkistustyyppi: Täysi tarkistus (F:\|)
Tarkistetut kohteet: 205222
Kulunut aika: 1 hour(s), 59 minute(s), 12 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:23:48, on 5.6.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\csrss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\Program Files\Norman\Npm\Bin\Elogsvc.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Norman\Npm\Bin\Zanda.exe
F:\Program Files\Norman\npm\bin\nvoy.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\LEXBCES.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\system32\CTsvcCDA.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\wdfmgr.exe
F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
F:\Program Files\Canon\CAL\CALMAIN.exe
F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
F:\Program Files\Norman\Npm\bin\NJEEVES.EXE
F:\WINDOWS\System32\alg.exe
F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Norman\Nvc\bin\nvcoas.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
F:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
F:\WINDOWS\system32\RunDLL32.exe
F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe
F:\Program Files\Norman\Npm\bin\ZLH.EXE
F:\Util2\BitDefender\bdagent.exe
F:\WINDOWS\system32\lexpps.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Norman\Nvc\BIN\NIP.EXE
F:\Program Files\Norman\Nvc\bin\cclaw.exe
F:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
F:\Util2\BitDefender\vsserv.exe
F:\Util2\SeaMonkey\seamonkey.exe
F:\WINDOWS\system32\wbem\wmiprvse.exe
F:\Program Files\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - F:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Burn4Free Toolbar Helper - {60BF5EE3-0105-4858-AD98-17C19F86B042} - F:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Burn4Free Toolbar - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - F:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
O4 - HKLM\..\Run: [Lexmark X1100 Series] "F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [Gainward] F:\WINDOWS\TBPanel.exe /A
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Norman ZANDA] "F:\Program Files\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH
O4 - HKLM\..\Run: [BDAgent] "F:\Util2\BitDefender\bdagent.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "F:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - F:\Program Files\Yahoo!\Common\Yinsthelper.dll
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - F:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - F:\Program Files\Norman\Npm\Bin\Elogsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - F:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Norman NJeeves - Unknown owner - F:\Program Files\Norman\Npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Norman ASA - F:\Program Files\Norman\Npm\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - F:\Program Files\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - F:\Program Files\Norman\npm\bin\nvoy.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - F:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - F:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: ServiceLayer - Nokia. - F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - F:\Util2\BitDefender\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
--
End of file - 7743 bytes
|
Senior Member
4 tuotearviota
|
5. kesäkuuta 2008 @ 09:35 |
Linkki tähän viestiin
|
|
Miltäs kone nyt tuntuu?
|
|
Mainos
|
|
|
|
aggre
Junior Member
|
5. kesäkuuta 2008 @ 09:42 |
Linkki tähän viestiin
|
Hidastelu on kadonnut, eikä norman ole vähään aikaan varoittanut mistään pöpöistä. Elikkäs taisi tämä olla tässä. Tarkistan koneen vielä kerran. Kiitos paljon avusta!
Hep, spyware doctor löysi kaksi haittaohjelmaa: Trojan-PWS transpyn ja Trojan.Generic. Sain ensimmäisen noista poistettua ja luulen, että saan toisenkin pois.
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 5. kesäkuuta 2008 @ 10:15
|
|
