|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
Messenger virus "muka" hävinnyt, kone jumii
|
|
|
Koppis1
Junior Member
|
3. kesäkuuta 2008 @ 13:52 |
Linkki tähän viestiin
|
Eli messenger virus oli poistettu, mutta silti on toiminnassa.
Kone jumii myös paljon.
Tässä htj loki:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 13:50, on 3.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\DigitalPersona\Bin\DPWinLct.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\DigitalPersona\Bin\DpHost.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.Exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Windows\mservice.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\PeerGuardian2\pg2.exe
c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\Program Files\Common Files\Sonic Shared\CineTray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Octoshape Streaming Services\Koppis\OctoshapeClient.exe
C:\Program Files\Skype\Plugin Manager\SkypePM.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\DigitalPersona\Bin\DPWinLct.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HiJackThis_v2\hoojiitee.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: {871f3d22-8b2a-0819-b384-d0e59c475c01} - {10c574c9-5e0d-483b-9180-a2b822d3f178} - C:\WINDOWS\system32\vurqnwri.dll
O2 - BHO: (no name) - {487C9905-26A8-42C8-8033-C58AD3D2AEC3} - C:\WINDOWS\system32\vtUolMgh.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {E6EC7EEE-BBC9-4EFC-B345-7D7C45EAB8AB} - C:\WINDOWS\system32\geBtTKDv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio -ominaisuussivun pikakuvake] HDAShCut.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [DPAgnt] C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
O4 - HKLM\..\Run: [MSN] C:\Windows\mservice.exe
O4 - HKLM\..\Run: [BMdff93d00] Rundll32.exe "C:\WINDOWS\system32\gvojukld.dll",s
O4 - HKLM\..\Run: [dcca0e9c] rundll32.exe "C:\WINDOWS\system32\ncmobyek.dll",b
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Program Files\Octoshape Streaming Services\Koppis\OctoshapeClient.exe" -inv:bootrun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-21-1343024091-606747145-839522115-1006\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Vilpponen')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = C:\Program Files\Common Files\Sonic Shared\CineTray.exe
O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdat...b?1162297554309
O17 - HKLM\System\CCS\Services\Tcpip\..\{EF416D88-D8DA-40DC-A196-4F3A1F7E69A4}: NameServer = 192.168.1.254
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: DPWLN - C:\WINDOWS\system32\DPWLEvHd.dll
O20 - Winlogon Notify: vtUolMgh - C:\WINDOWS\SYSTEM32\vtUolMgh.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHost.exe
O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - Unknown owner - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: NetMeeting etätyöpöydän jakaminen (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Etätyöpöydän ohjeen istunnonhallinta (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Älykortti (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Resurssilokit ja -hälytykset (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Telnet (TlntSvr) - Unknown owner - C:\WINDOWS\system32\tlntsvr.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
--
End of file - 13504 bytes
|
|
Hujo
Suspended permanently
|
3. kesäkuuta 2008 @ 14:07 |
Linkki tähän viestiin
|
Juumihan tuo aivan varmasti
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
=================
Poista tää Trend Micro HijackThis v2.0.0 (BETA) hjt ja lataa uusi tuosta alta
Lataa TÄSTÄ HJTInstall.exe
* Tallenna HJTInstall.exe työpöydällesi.
* Tuplaklikkaa HJTInstall.exe-kuvaketta työpöydälläsi.
* Oletuksena se asentaa itsensä hakemistoon C:\Program Files\Trend Micro\HijackThis.
* Klikkaa Install.
* Asennusohjelma luo HijackThis-kuvakkeen työpöydälle.
* Kun asennus on valmis, se käynnistää HijackThisin.
* Klikkaa Do a system scan and save a logfile-painiketta. Ohjelma aloittaa skannauksen ja lokin pitäisi avautua Muistioon.
* Klikkaa ensin "Muokkaa > Valitse kaikki" sitten "Muokkaa > Kopioi" kopioidaksesi koko lokin sisällön.
* Liitä lokin sisältö seuraavaan vastaukseesi.
* ÄLÄ käytä Analyse This-nappulaa, sen löydöt ovat vaarallisia väärinymmärrettyinä.
* ÄLÄ fixaa HijackThis-ohjelmalla vielä mitään. Suurin osa sen löydöistä ovat joko harmittomia tai jopa tarpeellisia.
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 3. kesäkuuta 2008 @ 14:10
|
|
Koppis1
Junior Member
|
3. kesäkuuta 2008 @ 14:09 |
Linkki tähän viestiin
|
|
Ok :D
Teen ComboFixin kohta, kunhan malwarescan on valmis.
EDIT:Tai ääh, teen sen nyt, kun on vähän kiire
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 3. kesäkuuta 2008 @ 14:12
|
|
Hujo
Suspended permanently
|
3. kesäkuuta 2008 @ 14:13 |
Linkki tähän viestiin
|
|
Nimee se vielä kun tuossa oot nimennyt
C:\Program Files\HiJackThis_v2\hoojiitee.exe
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 3. kesäkuuta 2008 @ 14:14
|
|
Koppis1
Junior Member
|
3. kesäkuuta 2008 @ 19:35 |
Linkki tähän viestiin
|
Tässä on combofix loki. Sitten perään vielä Hjt loki.
Onko jo puhdasta?
ComboFix 08-06-01.6 - Koppis 2008-06-03 19:09:08.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.882 [GMT 3:00]
Running from: C:\Documents and Settings\Koppis\Työpöytä\ComboFix.exe
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\BMdff93d00.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\service.exe
C:\WINDOWS\system32\abghewkr.dll
C:\WINDOWS\system32\aeajhnuj.dll
C:\WINDOWS\system32\bqubwbdd.dll
C:\WINDOWS\system32\fnrfoals.dll
C:\WINDOWS\system32\fvawsnht.dll
C:\WINDOWS\system32\geBtTKDv.dll
C:\WINDOWS\system32\gvojukld.dll
C:\WINDOWS\system32\hvilbmhy.dll
C:\WINDOWS\system32\keybomcn.ini
C:\WINDOWS\system32\khfGAtUO.dll
C:\WINDOWS\system32\ncmobyek.dll
C:\WINDOWS\system32\ofddqmrj.exe
C:\WINDOWS\system32\opnnollm.dll
C:\WINDOWS\system32\rqRIcyXR.dll
C:\WINDOWS\system32\rqRiIxuU.dll
C:\WINDOWS\system32\tuvWonkH.dll
C:\WINDOWS\system32\vDKTtBeg.ini
C:\WINDOWS\system32\vDKTtBeg.ini2
C:\WINDOWS\system32\vtUolMgh.dll
C:\WINDOWS\system32\vurqnwri.dll
C:\WINDOWS\system32\xhfxfqiv.exe
.
---- Previous Run -------
.
C:\setup.exe
C:\WINDOWS\pskt.ini
.
((((( Tiedostot, jotka on luotu seuraavalla aikav?lill?: 2008-05-03 to 2008-06-03 )))))))))))))))))
.
2008-06-03 19:06 . 2008-06-03 19:06 86,548 --a------ C:\setz.exe
2008-06-03 19:05 . 2008-06-03 19:05 4,217 --a------ C:\WINDOWS\is154890.exe
2008-06-03 14:27 . 2008-06-03 14:27 60,114 --a------ C:\bot1.exe
2008-06-03 13:21 . 2008-06-03 13:21 244 --ah----- C:\sqmnoopt16.sqm
2008-06-03 13:21 . 2008-06-03 13:21 232 --ah----- C:\sqmdata16.sqm
2008-06-03 13:14 . 2008-06-03 13:14 244 --ah----- C:\sqmnoopt15.sqm
2008-06-03 13:14 . 2008-06-03 13:14 232 --ah----- C:\sqmdata15.sqm
2008-06-03 13:13 . 2008-06-03 13:13 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\Malwarebytes
2008-06-02 22:29 . 2008-06-02 22:29 97,116 --a------ C:\WINDOWS\DC5177176.zip
2008-06-02 21:41 . 2008-06-02 21:41 96,950 -r-hs---- C:\WINDOWS\mservice.exe
2008-06-01 23:33 . 2008-06-01 23:33 <KANSIO> d-------- C:\Program Files\Live_TV
2008-06-01 23:30 . 2008-06-01 23:56 <KANSIO> d-------- C:\Program Files\3GP Converter 2007
2008-06-01 23:30 . 2008-06-01 23:30 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-01 23:30 . 2008-06-01 23:30 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-01 23:13 . 2008-06-01 23:13 3,758,036 --a------ C:\spore.3gp
2008-06-01 23:09 . 2008-06-01 23:09 <KANSIO> d-------- C:\Program Files\WinAVI MP4 Converter
2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Program Files\SmartFTP Client 3.0 Setup Files
2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Program Files\SmartFTP Client
2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\SmartFTP
2008-05-31 15:37 . 2008-05-31 15:37 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2008-05-31 15:36 . 2004-09-14 16:11 21,504 --a------ C:\WINDOWS\system32\drivers\hidserv.dll
2008-05-31 10:46 . 2008-05-31 10:47 1,646,766 --a------ C:\We_hold_these_truths.flv.MP3.OGG
2008-05-31 10:45 . 2008-05-31 10:46 558,088 --a------ C:\The Flight of the Bumble Bee.flv.MP3.OGG
2008-05-31 10:44 . 2008-05-31 10:45 2,007,871 --a------ C:\Speed metal messiah.flv.MP3.OGG
2008-05-31 10:43 . 2008-05-31 10:44 2,315,607 --a------ C:\necro.ogg.MP3.OGG
2008-05-31 10:42 . 2008-05-31 10:43 2,297,579 --a------ C:\Jerryc - Canon Rock (Guitar Play).mp3.OGG
2008-05-31 10:40 . 2008-05-31 10:42 3,361,200 --a------ C:\Dragonforce - Revolution Deathsquad.mp3.OGG
2008-05-31 10:38 . 2008-05-31 10:40 2,260,120 --a------ C:\06 - Wedding Nails mp3.mp3.OGG
2008-05-31 10:37 . 2008-05-31 10:38 2,090,948 --a------ C:\01 Black Dog.mp3.OGG
2008-05-31 10:35 . 2008-05-31 10:37 2,797,956 --a------ C:\Wedding_Nails.mp3.OGG
2008-05-31 10:29 . 2008-05-31 10:29 1,257,221 --a------ C:\The Flight of the Bumble Bee.flv.MP3
2008-05-31 10:28 . 2008-05-31 10:28 5,231,595 --a------ C:\Corpse_tumor.flv.MP3
2008-05-31 10:28 . 2008-05-31 10:29 4,536,111 --a------ C:\Speed metal messiah.flv.MP3
2008-05-31 10:27 . 2008-05-31 10:27 7,047,627 --a------ C:\We_hold_these_truths.flv.MP3
2008-05-30 17:50 . 2008-05-30 17:50 <KANSIO> d-------- C:\Program Files\Webteh
2008-05-30 17:49 . 2008-05-30 17:49 9,380,296 --a------ C:\Program Files\bsplayer228.964_clip.exe
2008-05-30 14:38 . 2008-05-30 14:38 <KANSIO> d-------- C:\WINDOWS\system32\Clickteam
2008-05-30 14:38 . 2008-05-30 14:38 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\Clickteam
2008-05-29 21:05 . 2008-05-29 21:05 <KANSIO> d-------- C:\Documents and Settings\Mirja Vilpponen\Application Data\DigitalPersona
2008-05-29 18:26 . 2008-05-29 18:26 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\DigitalPersona
2008-05-29 18:26 . 2008-05-29 18:26 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\ATI
2008-05-29 10:32 . 2008-06-03 13:54 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-29 10:32 . 2008-05-29 10:32 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\Malwarebytes
2008-05-29 10:32 . 2008-05-29 10:32 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-29 10:32 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-29 10:32 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-28 22:22 . 2008-05-28 22:22 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-05-28 21:41 . 2008-05-28 21:41 2,855 --a------ C:\ComboFix.PIF
2008-05-28 21:31 . 2008-05-28 21:31 0 --a------ C:\ComboFix.exe
2008-05-28 20:29 . 2008-06-03 13:50 <KANSIO> d-------- C:\Program Files\HiJackThis_v2
2008-05-28 20:16 . 2008-05-28 20:28 <KANSIO> d-------- C:\WINDOWS\BDOSCAN8
2008-05-28 18:05 . 2008-05-28 18:05 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\DigitalPersona
2008-05-28 17:58 . 2008-05-28 17:58 <KANSIO> d-------- C:\WINDOWS\DPDrv
2008-05-28 17:58 . 2008-05-28 17:58 <KANSIO> d-------- C:\Program Files\DigitalPersona
2008-05-28 17:26 . 2008-05-28 17:26 <KANSIO> d-------- C:\Program Files\DP10-002
2008-05-28 17:26 . 2008-05-28 17:26 2,334,453 --a------ C:\Program Files\DP10-002.zip
2008-05-28 16:43 . 2008-05-28 16:43 8,579,136 --a------ C:\Program Files\DPPM_201_ENG.exe
2008-05-28 16:04 . 2007-08-31 12:15 18,856 --a------ C:\WINDOWS\system32\drivers\nuidfltr.sys
2008-05-28 16:03 . 2008-05-28 16:39 <KANSIO> d-------- C:\Program Files\Microsoft IntelliType Pro
2008-05-28 15:48 . 2004-09-14 16:11 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-05-28 15:48 . 2004-09-14 16:11 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-05-27 21:48 . 2008-05-27 21:48 3,510,857 --a------ C:\SMB2AV.MP3
2008-05-27 21:48 . 2008-05-27 21:48 2,069,315 --a------ C:\FB.MP3
2008-05-27 21:47 . 2008-05-27 21:48 3,554,742 --a------ C:\SMBAV.MP3
2008-05-27 08:32 . 2008-05-27 08:32 <KANSIO> d-------- C:\Documents and Settings\Mirja Vilpponen\Application Data\ATI
2008-05-25 21:05 . 2008-05-29 16:55 <KANSIO> d-------- C:\Program Files\Cheat Engine
2008-05-25 21:05 . 2007-12-26 17:30 1,970,176 --a------ C:\WINDOWS\system32\d3dx9.dll
2008-05-25 21:05 . 2007-12-26 17:30 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll
2008-05-22 22:13 . 2008-05-22 22:13 <KANSIO> d-------- C:\Program Files\Octoshape Streaming Services
2008-05-22 15:11 . 2008-05-22 17:12 <KANSIO> d-------- C:\Program Files\mIRC
2008-05-22 15:11 . 2008-05-22 17:16 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\mIRC
2008-05-21 14:57 . 2008-06-03 14:14 31 --a------ C:\WINDOWS\system32\bbcap.err
2008-05-21 14:56 . 2008-05-21 14:56 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\ATI
2008-05-21 14:56 . 2008-05-21 14:56 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\ATI
2008-05-18 18:49 . 2008-05-18 18:49 <KANSIO> d-------- C:\Program Files\Mioplanet
2008-05-18 18:49 . 2008-05-18 18:49 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\mioObjects
2008-05-18 18:49 . 2008-05-18 18:49 407,047 --a------ C:\WINDOWS\system32\mioengine.exe
2008-05-18 12:30 . 2008-05-18 12:30 <KANSIO> d-------- C:\Program Files\eRightSoft
2008-05-18 12:30 . 2006-09-12 14:46 227,328 -r-hs---- C:\WINDOWS\system32\ac3DX.ax
2008-05-18 12:30 . 2006-05-03 13:06 163,328 -r-hs---- C:\WINDOWS\system32\flvDX.dll
2008-05-18 12:30 . 2008-02-04 22:26 151,040 ---hs---- C:\WINDOWS\system32\VistaUltm.dll
2008-05-18 12:30 . 2006-01-13 02:23 123,904 -r-hs---- C:\WINDOWS\system32\AVCDX.ax
2008-05-18 12:30 . 2003-11-21 02:00 54,784 -r-hs---- C:\WINDOWS\system32\RLAPEDec.ax
2008-05-18 12:30 . 2004-04-27 02:00 37,888 -r-hs---- C:\WINDOWS\system32\RLMPCDec.ax
2008-05-18 12:30 . 2007-02-21 14:47 31,232 -r-hs---- C:\WINDOWS\system32\msfDX.dll
2008-05-18 12:30 . 2007-12-17 16:43 27,648 ---hs---- C:\WINDOWS\system32\Smab0.dll
2008-05-18 12:30 . 2008-02-05 20:04 9,884 ---h----- C:\WINDOWS\super.chm
2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Program Files\NCH Software
2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\NCH Swift Sound
2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\NCH Software
2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\NCH Software
2008-05-17 22:48 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll
2008-05-13 07:34 . 2008-05-13 07:34 <KANSIO> d-------- C:\Program Files\Screen Recorder Gold
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-03 16:23 --------- d-----w C:\Program Files\PeerGuardian2
2008-06-03 16:22 --------- d-----w C:\Documents and Settings\Koppis\Application Data\Skype
2008-06-02 19:35 --------- d-----w C:\Program Files\RevConnect
2008-05-29 19:20 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-05-28 17:01 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-28 14:57 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-22 11:36 --------- d-----w C:\Program Files\ATI
2008-05-21 11:51 --------- d-----w C:\Program Files\ATI Technologies
2008-05-21 11:50 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-18 09:07 --------- d-----w C:\Program Files\NCH Swift Sound
2008-05-18 09:00 --------- d-----w C:\Program Files\CamStudio
2008-05-17 19:48 413,696 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-05-17 19:48 110,592 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-05-06 18:30 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-04-30 17:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ubisoft
2008-04-26 09:33 --------- d-----w C:\Program Files\Java
2008-04-21 14:35 --------- d-----w C:\Program Files\HardCopy Pro
2008-04-21 14:35 --------- d-----w C:\Documents and Settings\Koppis\Application Data\DeskSoft
2008-04-16 13:40 --------- d-----w C:\Program Files\Winamp
2008-04-16 13:29 --------- d-----w C:\Program Files\Game_Maker7
2008-04-16 12:54 8,990,072 ----a-w C:\Program Files\winamp5531_full_emusic-7plus_en-us.exe
2008-04-15 18:59 --------- d-----w C:\Program Files\Lavalys
2008-04-15 16:12 --------- d-----w C:\Documents and Settings\Vilpponen\Application Data\The Hobbit
2008-04-12 16:25 --------- d-----w C:\Program Files\Guitar Pro 5
2008-04-09 13:49 --------- d-----w C:\Documents and Settings\Vilpponen\Application Data\Skype
2008-04-06 15:42 --------- d-----w C:\Documents and Settings\Mirja Vilpponen\Application Data\Skype
2008-03-29 05:19 9,801,728 ----a-w C:\WINDOWS\system32\atioglx2.dll
2008-03-29 04:40 167,936 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2008-03-29 04:05 372,736 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2008-03-29 04:04 299,008 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2008-03-29 03:56 172,032 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2008-03-29 03:56 126,976 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2008-03-29 03:55 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2008-03-29 03:55 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2008-03-29 03:55 126,976 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2008-03-29 03:54 536,576 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2008-03-29 03:52 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2008-03-29 03:43 3,176,480 ----a-w C:\WINDOWS\system32\ati3duag.dll
2008-03-29 03:39 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2008-03-29 03:36 1,765,120 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2008-03-29 03:24 46,080 ----a-w C:\WINDOWS\system32\amdpcom32.dll
2008-03-29 03:23 5,439,488 ----a-w C:\WINDOWS\system32\atioglxx.dll
2008-03-29 03:21 393,216 ----a-w C:\WINDOWS\system32\atikvmag.dll
2008-03-29 03:19 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2008-03-29 03:12 520,192 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2008-03-28 18:05 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-23 22:48 219 ----a-w C:\Documents and Settings\Vilpponen\hsqlprefs.dat
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-14 13:16 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-03-10 18:16 22,328 ----a-w C:\Documents and Settings\Koppis\Application Data\PnkBstrK.sys
2008-03-10 18:15 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-03-10 18:15 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-03-10 18:15 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-03-04 21:06 24 ----a-w C:\juttelitoimii.bat
2008-03-04 20:59 56 ----a-w C:\jutteli.bat
2008-03-04 20:57 185 ----a-w C:\Copybmp.bat
2008-03-04 11:31 84,526,232 ----a-w C:\Program Files\moviestudio80c-trial_enu.exe
2008-03-02 18:51 2,699,171 ----a-w C:\Program Files\ccleaner_v2.05.555.zip
2008-01-05 20:09 630,768 ----a-w C:\Program Files\eval-nwc.exe
2007-12-15 11:37 8,454,584 ----a-w C:\Program Files\winamp55_full_emusic-7plus_en-us.exe
2007-11-30 12:40 34,556,560 ----a-w C:\Program Files\QCCSENU.EXE
2007-11-05 12:11 5,858 ----a-w C:\Program Files\install.log
2007-11-05 12:10 487,377 ----a-w C:\Program Files\GameSpot_Download_Manager.exe
2007-08-02 08:39 6,221,304 ----a-w C:\Program Files\winamp535_full_emusic-7plus.exe
2007-07-10 08:50 1 ----a-w C:\Documents and Settings\Koppis\SI.bin
2007-06-03 16:33 2,601,692 ----a-w C:\Program Files\mp3wavconverter.exe
2007-06-01 12:28 1,980,533 ----a-w C:\Program Files\registrymedic.exe
2007-04-27 14:23 1,205,365 ----a-w C:\Program Files\wrar37b7.exe
2007-02-13 14:00 19,666,504 ----a-w C:\Program Files\QuickTimeInstaller.exe
2007-02-07 19:11 643,144 ----a-w C:\Program Files\XviD-1.1.2-01112006.exe
2007-01-27 20:20 1,063,810 ----a-w C:\Program Files\subedit.zip
2006-11-30 12:46 1,410,680 ----a-w C:\Program Files\install_flash_player.exe
2006-11-28 15:57 6,052,528 ----a-w C:\Program Files\FirefoxGoogleToolbarSetup.exe
2006-11-26 16:21 29,172 -c--a-w C:\Program Files\Da-Vinci-Tour.kmz
2006-11-26 15:52 14,879,120 ----a-w C:\Program Files\GoogleEarthWin.exe
2006-11-25 18:05 2,855,080 ----a-w C:\Program Files\aawsepersonal.exe
2006-11-23 13:07 362,496 ----a-w C:\Program Files\switchsetup.exe
2006-11-10 14:15 11,284,970 ----a-w C:\Program Files\cdbxp_setup_3.0.116.zip
2006-11-08 17:19 16,198,952 ----a-w C:\Program Files\Install_Messenger.exe
2006-11-04 15:57 6,624,984 ----a-w C:\Program Files\winamp531_full_emusic-7plus.exe
2006-11-04 15:52 3,262,369 ----a-w C:\Program Files\ALZip.exe
2006-11-04 14:08 6,579,696 ----a-w C:\Program Files\Opera_9.02_International_Setup.exe
2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll
2008-02-04 19:26 151,040 --sh--w C:\WINDOWS\system32\VistaUltm.dll
.
(((((((((((((((((((((((((((((( Rekisterin k?ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji? arvoja ja laillisia oletusarvoja ei n?ytet?
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [ ]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-12-11 21:41 25343016]
"igndlm.exe"="C:\Program Files\Download Manager\DLM.exe" [2007-03-06 00:57 1103480]
"PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 15:44 196608]
"Octoshape Streaming Services"="C:\Program Files\Octoshape Streaming Services\Koppis\OctoshapeClient.exe" [2006-02-13 19:33 214648]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2006-08-14 15:41 114688]
"High Definition Audio -ominaisuussivun pikakuvake"="HDAShCut.exe" [2005-01-07 18:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2005-10-26 04:51 122929]
"F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-28 06:10 122940]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 18:32 221184]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-11 18:36 16267776 C:\WINDOWS\RTHDCPL.exe]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 16:24 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 16:14 217088]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 23:09 157592]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]
"itype"="c:\Program Files\Microsoft IntelliType Pro\itype.exe" [2007-08-31 12:13 988584]
"DPAgnt"="C:\Program Files\DigitalPersona\Bin\DPAgnt.exe" [2006-10-09 16:27 807440]
"Windows svchost"="service.exe" []
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 15:00 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ckpNotify]
ckpNotify.dll 2005-03-01 20:49 24672 C:\WINDOWS\system32\ckpNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DPWLN ]
C:\WINDOWS\system32\DPWLEvHd.dll 2006-10-09 16:27 99856 C:\WINDOWS\system32\DPWLEvHd.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"vidc.yv12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Service.exe"=
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe"=
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\scc.exe"=
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.exe"=
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Diagnostics.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\Pelit\\Settlers3\\s3.exe"=
"C:\\Pelit\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Pelit\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9278:TCP"= 9278:TCP:BitComet 9278 TCP
"9278:UDP"= 9278:UDP:BitComet 9278 UDP
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-10-31 13:01]
R1 bbcap;bbcap;C:\WINDOWS\system32\DRIVERS\bbcap.sys [2007-06-24 23:03]
R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2006-10-31 16:53]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2005-08-19 16:37]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-10-06 17:30]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2005-08-19 16:37]
R2 Scap;SecureClient Application Policy Module;C:\WINDOWS\system32\DRIVERS\Scap.sys [2005-03-01 20:49]
R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2007-06-01 15:28]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2006-03-02 15:00]
R3 dpK0Bx01;Fingerprint Reader Filter Driver;C:\WINDOWS\system32\DRIVERS\dpK0Bx01.sys [2006-09-16 17:25]
R3 FW1;SecuRemote Miniport;C:\WINDOWS\system32\DRIVERS\fw.sys [2005-03-01 20:49]
R3 usbdpfp;Fingerprint Reader Class Driver;C:\WINDOWS\system32\DRIVERS\usbdpfp.sys [2006-09-16 17:23]
S0 stwlfbus;stwlfbus;C:\WINDOWS\system32\DRIVERS\stwlfbus.sys [2003-04-27 13:39]
S3 ggflt;SEMC USB Flash Driver Filter;C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-02-16 21:03]
S3 gsplittm;gsplittm;C:\DOCUME~1\Koppis\LOCALS~1\Temp\gsplittm.sys []
S3 OMVA;VPN-1 SecureClient Adapter;C:\WINDOWS\system32\DRIVERS\OMVA.sys [2005-03-01 20:49]
S3 st3wolf;st3wolf;C:\WINDOWS\system32\DRIVERS\st3wolf.sys [2003-04-27 12:43]
S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys [2006-11-07 10:42]
S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys [2006-11-07 10:42]
S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys [2006-11-07 10:42]
S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w200mgmt.sys [2006-11-07 10:42]
S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w200obex.sys [2006-11-07 10:42]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86167224-b6ba-11dc-8548-0016350dc46d}]
\Shell\AutoRun\command - I:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe
.
'Ajoitetut teht?v?t'-kansion sis?lt?
"2008-05-30 14:17:09 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2007-02-13 14:00:42 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-03 10:06:49 C:\WINDOWS\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\F-Secure\ANTI-V~1\fsav.exeZ /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-Secure\ANTI-V~1\report.txt
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-03 19:20:28
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\DigitalPersona\Bin\DPWinLct.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\DigitalPersona\Bin\DpHost.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\common\FSMA32.EXE
C:\Program Files\F-Secure\common\FSMB32.EXE
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
C:\Program Files\F-Secure\common\FCH32.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Watchdog.exe
C:\Program Files\F-Secure\common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Anti-Virus\FSRW.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
C:\Program Files\F-Secure\Anti-Virus\FSAV32.exe
C:\Program Files\F-Secure\common\FNRB32.exe
C:\Program Files\F-Secure\FWES\program\fsdfwd.exe
C:\Program Files\F-Secure\common\FIH32.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.exe
C:\PROGRA~1\F-Secure\ANTI-S~1\FSAW.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
C:\Program Files\Common Files\Sonic Shared\CineTray.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Completion time: 2008-06-03 19:29:12 - machine was rebooted [Koppis]
ComboFix-quarantined-files.txt 2008-06-03 16:29:07
ComboFix2.txt 2008-05-29 11:02:29
Pre-Run: 25,366,937,600 tavua vapaana
Post-Run: 25,372,700,672 tavua vapaana
380 --- E O F --- 2008-05-16 21:03:47
HIJACKTHIS LOKI
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 19:32, on 3.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\DigitalPersona\Bin\DPWinLct.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\DigitalPersona\Bin\DpHost.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.Exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
C:\Program Files\Skype\Phone\Skype.exe
c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
C:\Program Files\Common Files\Sonic Shared\CineTray.exe
C:\Program Files\Skype\Plugin Manager\SkypePM.exe
C:\Program Files\Octoshape Streaming Services\Koppis\OctoshapeClient.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HiJackThis_v2\hoojiitee.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio -ominaisuussivun pikakuvake] HDAShCut.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [DPAgnt] C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
O4 - HKLM\..\Run: [Windows svchost] service.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Program Files\Octoshape Streaming Services\Koppis\OctoshapeClient.exe" -inv:bootrun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = C:\Program Files\Common Files\Sonic Shared\CineTray.exe
O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdat...b?1162297554309
O17 - HKLM\System\CCS\Services\Tcpip\..\{EF416D88-D8DA-40DC-A196-4F3A1F7E69A4}: NameServer = 192.168.1.254
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: DPWLN - C:\WINDOWS\system32\DPWLEvHd.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHost.exe
O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - Unknown owner - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: NetMeeting etätyöpöydän jakaminen (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Etätyöpöydän ohjeen istunnonhallinta (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Älykortti (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Resurssilokit ja -hälytykset (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Telnet (TlntSvr) - Unknown owner - C:\WINDOWS\system32\tlntsvr.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
--
End of file - 12568 bytes
|
|
Hujo
Suspended permanently
|
3. kesäkuuta 2008 @ 19:50 |
Linkki tähän viestiin
|
Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
Lainaus:
File::
C:\WINDOWS\mservice.exe
C:\WINDOWS\system32\gvojukld.dll
C:\WINDOWS\service.exe
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
=============
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.
==============
Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.
Käynnistä koneesi vikasietotilaan:
sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä
Jossakin koneissa hakataan F8:sin sijasta F5:tä
" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
Voiko tietsikka koskaan toimia?
|
|
Koppis1
Junior Member
|
3. kesäkuuta 2008 @ 22:44 |
Linkki tähän viestiin
|
Nyt tulee kaikki 4 lokia.
SDFix: Version 1.187
Run by Koppis on ti 03.06.2008 at 22:03
Microsoft Windows XP [versio 5.1.2600]
Running From: C:\DOCUME~1\Koppis\TYPYT~1\SDFix
Checking Services :
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting
Checking Files :
No Trojan Files Found
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-03 22:19:31
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:412c1832
"s2"=dword:4f2c8721
"h0"=dword:00000002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000001
"ujdew"=hex:c5,69,d5,da,60,7c,3c,15,97,a7,e4,95,e2,54,14,21,33,0f,b7,d2,ee,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:80,4e,ed,43,59,91,1d,eb,0a,38,b0,17,bf,28,1d,ff,52,42,17,79,8f,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,0b,87,e1,a9,20,75,31,bb,87,92,96,6b,4d,22,0d,4c,1d,..
"khjeh"=hex:36,9c,35,90,fa,be,7e,d9,54,ae,99,e5,4b,a1,7e,90,56,68,0c,8c,12,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:8e,16,fd,45,5f,74,4c,97,36,2a,5d,fb,19,f5,b4,ef,c3,66,a7,d4,ae,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:37,53,ec,04,e3,ec,18,b4,b2,1a,e2,d9,6f,2c,df,ad,ef,25,ad,05,9b,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:f9,4e,3c,46,25,5e,34,cf,f8,e8,e9,45,7b,83,6d,cb,7e,85,0d,f2,f0,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:c6,db,17,aa,88,11,d6,61,b2,94,b5,ab,4a,ee,bc,12,d3,11,6b,51,cf,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000001
"ujdew"=hex:c5,69,d5,da,60,7c,3c,15,97,a7,e4,95,e2,54,14,21,33,0f,b7,d2,ee,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:80,4e,ed,43,59,91,1d,eb,0a,38,b0,17,bf,28,1d,ff,52,42,17,79,8f,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,0b,87,e1,a9,20,75,31,bb,87,92,96,6b,4d,22,0d,4c,1d,..
"khjeh"=hex:36,9c,35,90,fa,be,7e,d9,54,ae,99,e5,4b,a1,7e,90,56,68,0c,8c,12,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:8e,16,fd,45,5f,74,4c,97,36,2a,5d,fb,19,f5,b4,ef,c3,66,a7,d4,ae,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:37,53,ec,04,e3,ec,18,b4,b2,1a,e2,d9,6f,2c,df,ad,ef,25,ad,05,9b,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:f9,4e,3c,46,25,5e,34,cf,f8,e8,e9,45,7b,83,6d,cb,7e,85,0d,f2,f0,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:c6,db,17,aa,88,11,d6,61,b2,94,b5,ab,4a,ee,bc,12,d3,11,6b,51,cf,..
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"="C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe:*:Enabled:F-Secure Automatic Update"
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Service.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Service.exe:*:Enabled:VPN-1 SecuRemote/SecureClient service"
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe:*:Enabled:VPN-1 SecuRemote/SecureClient application"
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\scc.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\scc.exe:*:Enabled:VPN-1 SecuRemote/SecureClient command line"
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.exe:*:Enabled:VPN-1 SecuRemote/SecureClient SDS agent"
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Diagnostics.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Diagnostics.exe:*:Enabled:VPN-1 SecuRemote/SecureClient diagnostics"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"C:\\WINDOWS\\system32\\dplaysvr.exe"="C:\\WINDOWS\\system32\\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\\Pelit\\Settlers3\\s3.exe"="C:\\Pelit\\Settlers3\\s3.exe:*:Enabled:Siedler3"
"C:\\Pelit\\Crysis\\Bin32\\Crysis.exe"="C:\\Pelit\\Crysis\\Bin32\\Crysis.exe:*:Enabled:Crysis_32"
"C:\\Pelit\\Crysis\\Bin32\\CrysisDedicatedServer.exe"="C:\\Pelit\\Crysis\\Bin32\\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"="C:\\Program Files\\SmartFTP Client\\SmartFTP.exe:*:Enabled:SmartFTP Client 3.0"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"="C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe:*:Enabled:F-Secure Automatic Update"
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Service.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Service.exe:*:Enabled:VPN-1 SecuRemote/SecureClient service"
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe:*:Enabled:VPN-1 SecuRemote/SecureClient application"
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\scc.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\scc.exe:*:Enabled:VPN-1 SecuRemote/SecureClient command line"
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.exe:*:Enabled:VPN-1 SecuRemote/SecureClient SDS agent"
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Diagnostics.exe"="C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Diagnostics.exe:*:Enabled:VPN-1 SecuRemote/SecureClient diagnostics"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
Remaining Files :
Files with Hidden Attributes :
Sun 4 Jan 2004 51,200 A..H. --- "C:\mirja\Maritxt\~WRL0003.TMP"
Mon 5 Jan 2004 72,704 A..H. --- "C:\mirja\Maritxt\~WRL0004.TMP"
Mon 5 Jan 2004 51,200 A..H. --- "C:\mirja\Maritxt\~WRL3606.tmp"
Tue 20 Feb 2007 5,355,320 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Wed 3 May 2006 163,328 ..SHR --- "C:\WINDOWS\system32\flvDX.dll"
Wed 21 Feb 2007 31,232 ..SHR --- "C:\WINDOWS\system32\msfDX.dll"
Mon 17 Dec 2007 27,648 ..SH. --- "C:\WINDOWS\system32\Smab0.dll"
Mon 4 Feb 2008 151,040 ..SH. --- "C:\WINDOWS\system32\VistaUltm.dll"
Fri 10 Aug 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 26 Jun 2005 616,448 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygwin1.dll"
Wed 22 Jun 2005 45,568 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygz.dll"
Thu 7 Feb 2008 72,704 ..SHR --- "C:\Program Files\eRightSoft\SUPER\Setup.exe"
Fri 27 Oct 2006 16,384 A.SHR --- "C:\Program Files\eRightSoft\SUPER\_Setup.dll"
Fri 27 Feb 2004 233,472 A..H. --- "C:\Program Files\Image-Line\FL Studio 7\REX Shared Library.dll"
Tue 4 Jun 2002 84,992 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\14_43260.dll"
Tue 4 Jun 2002 44,032 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\28_83260.dll"
Tue 10 Dec 2002 73,766 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\atrc3260.dll"
Tue 10 Dec 2002 65,575 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\cook3260.dll"
Sun 9 Jun 2002 36,864 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ddnt3260.dll"
Tue 4 Jun 2002 20,480 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dnet3260.dll"
Tue 10 Dec 2002 102,437 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv13260.dll"
Tue 10 Dec 2002 176,165 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv23260.dll"
Tue 10 Dec 2002 208,935 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv33260.dll"
Tue 10 Dec 2002 217,127 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv43260.dll"
Sun 9 Jun 2002 40,448 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dspr3260.dll"
Sun 4 Nov 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ivvideo.dll"
Tue 10 Apr 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\qtmlClient.dll"
Fri 20 Feb 2004 232,960 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\raac.dll"
Sun 9 Jun 2002 525,824 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnco3260.dll"
Tue 10 Dec 2002 245,805 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnlt3260.dll"
Tue 10 Dec 2002 45,093 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv103260.dll"
Tue 10 Dec 2002 98,341 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv203260.dll"
Tue 10 Dec 2002 94,247 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv303260.dll"
Tue 10 Dec 2002 90,151 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv403260.dll"
Tue 10 Dec 2002 102,439 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\sipr3260.dll"
Sun 9 Jun 2002 49,152 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\tokr3260.dll"
Wed 7 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0045d90d3c637c74f834c75fe192b558\BIT21.tmp"
Wed 28 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\027df41720931012b94b91a7776c3165\BIT28.tmp"
Thu 24 Jan 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\523d056929e13eacf8392044f602e53e\BIT17.tmp"
Tue 4 Mar 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\bc066f3f60df1b38218903dd0d40ce98\BIT19.tmp"
Wed 28 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f49cda1898bcf48b982dace6ad0aeca3\BIT29.tmp"
Mon 2 Jun 2008 2,633 ...HR --- "C:\Documents and Settings\Koppis\Application Data\SecuROM\UserData\securom_v7_01.bak"
Finished!
==========================
Malwarebytes' Anti-Malware 1.14
Tietokantaversio: 818
21:45:26 3.6.2008
mbam-log-6-3-2008 (21-45-26).txt
Tarkistustyyppi: Täysi tarkistus (C:\|)
Tarkistetut kohteet: 303376
Kulunut aika: 1 hour(s), 22 minute(s), 22 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 3
Saastuneita rekisteriarvoja: 1
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 57
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
Saastuneita rekisteriarvoja:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows svchost (Backdoor.Bot) -> Quarantined and deleted successfully.
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
C:\bot1.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Eero\sparrow\image23.JPG-www.msnimages.com (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\setup.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\mservice.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\abghewkr.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\bqubwbdd.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\fvawsnht.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\geBtTKDv.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\hvilbmhy.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\khfGAtUO.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\ncmobyek.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\ofddqmrj.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\opnnollm.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\rqRIcyXR.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\rqRiIxuU.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\tuvWonkH.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\vtUolMgh.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\vurqnwri.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\xhfxfqiv.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP11\A0002540.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP11\A0002541.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP11\A0002566.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP11\A0002567.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP11\A0002570.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP13\A0002601.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP13\A0002602.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP13\A0002622.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP13\A0002623.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP13\A0002627.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP13\A0002630.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP13\A0002642.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP14\A0002651.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP14\A0002664.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP14\A0003677.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP14\A0003679.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP15\A0003773.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP15\A0003776.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP15\A0003780.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0003803.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0004759.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005796.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005798.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005800.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005801.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005803.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005804.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005805.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005806.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005807.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005808.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005809.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005810.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005811.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005812.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005813.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP16\A0005840.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{84BAE593-4252-4F5F-9FBA-F19648C5B781}\RP17\A0005879.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
================================
ComboFix 08-06-01.6 - Koppis 2008-06-03 20:08:34.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.818 [GMT 3:00]
Running from: C:\Documents and Settings\Koppis\Työpöytä\ComboFix.exe
Command switches used :: C:\Documents and Settings\Koppis\Työpöytä\CFScript.txt.txt
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\WINDOWS\mservice.exe
C:\WINDOWS\service.exe
C:\WINDOWS\system32\gvojukld.dll
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\mservice.exe
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-03 to 2008-06-03 )))))))))))))))))
.
2008-06-03 19:06 . 2008-06-03 19:06 86,548 --a------ C:\setz.exe
2008-06-03 19:05 . 2008-06-03 19:05 4,217 --a------ C:\WINDOWS\is154890.exe
2008-06-03 14:27 . 2008-06-03 14:27 60,114 --a------ C:\bot1.exe
2008-06-03 13:21 . 2008-06-03 13:21 244 --ah----- C:\sqmnoopt16.sqm
2008-06-03 13:21 . 2008-06-03 13:21 232 --ah----- C:\sqmdata16.sqm
2008-06-03 13:14 . 2008-06-03 13:14 244 --ah----- C:\sqmnoopt15.sqm
2008-06-03 13:14 . 2008-06-03 13:14 232 --ah----- C:\sqmdata15.sqm
2008-06-03 13:13 . 2008-06-03 13:13 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\Malwarebytes
2008-06-02 22:29 . 2008-06-02 22:29 97,116 --a------ C:\WINDOWS\DC5177176.zip
2008-06-01 23:33 . 2008-06-01 23:33 <KANSIO> d-------- C:\Program Files\Live_TV
2008-06-01 23:30 . 2008-06-01 23:56 <KANSIO> d-------- C:\Program Files\3GP Converter 2007
2008-06-01 23:30 . 2008-06-01 23:30 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-01 23:30 . 2008-06-01 23:30 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-01 23:13 . 2008-06-01 23:13 3,758,036 --a------ C:\spore.3gp
2008-06-01 23:09 . 2008-06-01 23:09 <KANSIO> d-------- C:\Program Files\WinAVI MP4 Converter
2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Program Files\SmartFTP Client 3.0 Setup Files
2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Program Files\SmartFTP Client
2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\SmartFTP
2008-05-31 15:37 . 2008-05-31 15:37 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2008-05-31 15:36 . 2004-09-14 16:11 21,504 --a------ C:\WINDOWS\system32\drivers\hidserv.dll
2008-05-31 10:46 . 2008-05-31 10:47 1,646,766 --a------ C:\We_hold_these_truths.flv.MP3.OGG
2008-05-31 10:45 . 2008-05-31 10:46 558,088 --a------ C:\The Flight of the Bumble Bee.flv.MP3.OGG
2008-05-31 10:44 . 2008-05-31 10:45 2,007,871 --a------ C:\Speed metal messiah.flv.MP3.OGG
2008-05-31 10:43 . 2008-05-31 10:44 2,315,607 --a------ C:\necro.ogg.MP3.OGG
2008-05-31 10:42 . 2008-05-31 10:43 2,297,579 --a------ C:\Jerryc - Canon Rock (Guitar Play).mp3.OGG
2008-05-31 10:40 . 2008-05-31 10:42 3,361,200 --a------ C:\Dragonforce - Revolution Deathsquad.mp3.OGG
2008-05-31 10:38 . 2008-05-31 10:40 2,260,120 --a------ C:\06 - Wedding Nails mp3.mp3.OGG
2008-05-31 10:37 . 2008-05-31 10:38 2,090,948 --a------ C:\01 Black Dog.mp3.OGG
2008-05-31 10:35 . 2008-05-31 10:37 2,797,956 --a------ C:\Wedding_Nails.mp3.OGG
2008-05-31 10:29 . 2008-05-31 10:29 1,257,221 --a------ C:\The Flight of the Bumble Bee.flv.MP3
2008-05-31 10:28 . 2008-05-31 10:28 5,231,595 --a------ C:\Corpse_tumor.flv.MP3
2008-05-31 10:28 . 2008-05-31 10:29 4,536,111 --a------ C:\Speed metal messiah.flv.MP3
2008-05-31 10:27 . 2008-05-31 10:27 7,047,627 --a------ C:\We_hold_these_truths.flv.MP3
2008-05-30 17:50 . 2008-05-30 17:50 <KANSIO> d-------- C:\Program Files\Webteh
2008-05-30 17:49 . 2008-05-30 17:49 9,380,296 --a------ C:\Program Files\bsplayer228.964_clip.exe
2008-05-30 14:38 . 2008-05-30 14:38 <KANSIO> d-------- C:\WINDOWS\system32\Clickteam
2008-05-30 14:38 . 2008-05-30 14:38 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\Clickteam
2008-05-29 21:05 . 2008-05-29 21:05 <KANSIO> d-------- C:\Documents and Settings\Mirja Vilpponen\Application Data\DigitalPersona
2008-05-29 18:26 . 2008-05-29 18:26 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\DigitalPersona
2008-05-29 18:26 . 2008-05-29 18:26 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\ATI
2008-05-29 10:32 . 2008-06-03 13:54 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-29 10:32 . 2008-05-29 10:32 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\Malwarebytes
2008-05-29 10:32 . 2008-05-29 10:32 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-29 10:32 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-29 10:32 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-28 22:22 . 2008-05-28 22:22 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-05-28 21:41 . 2008-05-28 21:41 2,855 --a------ C:\ComboFix.PIF
2008-05-28 21:31 . 2008-05-28 21:31 0 --a------ C:\ComboFix.exe
2008-05-28 20:29 . 2008-06-03 19:32 <KANSIO> d-------- C:\Program Files\HiJackThis_v2
2008-05-28 20:16 . 2008-05-28 20:28 <KANSIO> d-------- C:\WINDOWS\BDOSCAN8
2008-05-28 18:05 . 2008-05-28 18:05 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\DigitalPersona
2008-05-28 17:58 . 2008-05-28 17:58 <KANSIO> d-------- C:\WINDOWS\DPDrv
2008-05-28 17:58 . 2008-05-28 17:58 <KANSIO> d-------- C:\Program Files\DigitalPersona
2008-05-28 17:26 . 2008-05-28 17:26 <KANSIO> d-------- C:\Program Files\DP10-002
2008-05-28 17:26 . 2008-05-28 17:26 2,334,453 --a------ C:\Program Files\DP10-002.zip
2008-05-28 16:43 . 2008-05-28 16:43 8,579,136 --a------ C:\Program Files\DPPM_201_ENG.exe
2008-05-28 16:04 . 2007-08-31 12:15 18,856 --a------ C:\WINDOWS\system32\drivers\nuidfltr.sys
2008-05-28 16:03 . 2008-05-28 16:39 <KANSIO> d-------- C:\Program Files\Microsoft IntelliType Pro
2008-05-28 15:48 . 2004-09-14 16:11 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-05-28 15:48 . 2004-09-14 16:11 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-05-27 21:48 . 2008-05-27 21:48 3,510,857 --a------ C:\SMB2AV.MP3
2008-05-27 21:48 . 2008-05-27 21:48 2,069,315 --a------ C:\FB.MP3
2008-05-27 21:47 . 2008-05-27 21:48 3,554,742 --a------ C:\SMBAV.MP3
2008-05-27 08:32 . 2008-05-27 08:32 <KANSIO> d-------- C:\Documents and Settings\Mirja Vilpponen\Application Data\ATI
2008-05-25 21:05 . 2008-05-29 16:55 <KANSIO> d-------- C:\Program Files\Cheat Engine
2008-05-25 21:05 . 2007-12-26 17:30 1,970,176 --a------ C:\WINDOWS\system32\d3dx9.dll
2008-05-25 21:05 . 2007-12-26 17:30 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll
2008-05-22 22:13 . 2008-05-22 22:13 <KANSIO> d-------- C:\Program Files\Octoshape Streaming Services
2008-05-22 15:11 . 2008-05-22 17:12 <KANSIO> d-------- C:\Program Files\mIRC
2008-05-22 15:11 . 2008-05-22 17:16 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\mIRC
2008-05-21 14:57 . 2008-06-03 14:14 31 --a------ C:\WINDOWS\system32\bbcap.err
2008-05-21 14:56 . 2008-05-21 14:56 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\ATI
2008-05-21 14:56 . 2008-05-21 14:56 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\ATI
2008-05-18 18:49 . 2008-05-18 18:49 <KANSIO> d-------- C:\Program Files\Mioplanet
2008-05-18 18:49 . 2008-05-18 18:49 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\mioObjects
2008-05-18 18:49 . 2008-05-18 18:49 407,047 --a------ C:\WINDOWS\system32\mioengine.exe
2008-05-18 12:30 . 2008-05-18 12:30 <KANSIO> d-------- C:\Program Files\eRightSoft
2008-05-18 12:30 . 2006-09-12 14:46 227,328 -r-hs---- C:\WINDOWS\system32\ac3DX.ax
2008-05-18 12:30 . 2006-05-03 13:06 163,328 -r-hs---- C:\WINDOWS\system32\flvDX.dll
2008-05-18 12:30 . 2008-02-04 22:26 151,040 ---hs---- C:\WINDOWS\system32\VistaUltm.dll
2008-05-18 12:30 . 2006-01-13 02:23 123,904 -r-hs---- C:\WINDOWS\system32\AVCDX.ax
2008-05-18 12:30 . 2003-11-21 02:00 54,784 -r-hs---- C:\WINDOWS\system32\RLAPEDec.ax
2008-05-18 12:30 . 2004-04-27 02:00 37,888 -r-hs---- C:\WINDOWS\system32\RLMPCDec.ax
2008-05-18 12:30 . 2007-02-21 14:47 31,232 -r-hs---- C:\WINDOWS\system32\msfDX.dll
2008-05-18 12:30 . 2007-12-17 16:43 27,648 ---hs---- C:\WINDOWS\system32\Smab0.dll
2008-05-18 12:30 . 2008-02-05 20:04 9,884 ---h----- C:\WINDOWS\super.chm
2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Program Files\NCH Software
2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\NCH Swift Sound
2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\NCH Software
2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\NCH Software
2008-05-17 22:48 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll
2008-05-13 07:34 . 2008-05-13 07:34 <KANSIO> d-------- C:\Program Files\Screen Recorder Gold
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-03 17:10 --------- d-----w C:\Program Files\PeerGuardian2
2008-06-03 16:55 --------- d-----w C:\Documents and Settings\Koppis\Application Data\Skype
2008-06-02 19:35 --------- d-----w C:\Program Files\RevConnect
2008-05-29 19:20 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-05-28 17:01 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-28 14:57 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-22 11:36 --------- d-----w C:\Program Files\ATI
2008-05-21 11:51 --------- d-----w C:\Program Files\ATI Technologies
2008-05-21 11:50 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-18 09:07 --------- d-----w C:\Program Files\NCH Swift Sound
2008-05-18 09:00 --------- d-----w C:\Program Files\CamStudio
2008-05-17 19:48 413,696 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-05-17 19:48 110,592 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-05-06 18:30 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-04-30 17:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ubisoft
2008-04-26 09:33 --------- d-----w C:\Program Files\Java
2008-04-21 14:35 --------- d-----w C:\Program Files\HardCopy Pro
2008-04-21 14:35 --------- d-----w C:\Documents and Settings\Koppis\Application Data\DeskSoft
2008-04-16 13:40 --------- d-----w C:\Program Files\Winamp
2008-04-16 13:29 --------- d-----w C:\Program Files\Game_Maker7
2008-04-16 12:54 8,990,072 ----a-w C:\Program Files\winamp5531_full_emusic-7plus_en-us.exe
2008-04-15 18:59 --------- d-----w C:\Program Files\Lavalys
2008-04-15 16:12 --------- d-----w C:\Documents and Settings\Vilpponen\Application Data\The Hobbit
2008-04-12 16:25 --------- d-----w C:\Program Files\Guitar Pro 5
2008-04-09 13:49 --------- d-----w C:\Documents and Settings\Vilpponen\Application Data\Skype
2008-04-06 15:42 --------- d-----w C:\Documents and Settings\Mirja Vilpponen\Application Data\Skype
2008-03-29 05:19 9,801,728 ----a-w C:\WINDOWS\system32\atioglx2.dll
2008-03-29 04:40 167,936 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2008-03-29 04:05 372,736 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2008-03-29 04:04 299,008 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2008-03-29 03:56 172,032 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2008-03-29 03:56 126,976 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2008-03-29 03:55 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2008-03-29 03:55 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2008-03-29 03:55 126,976 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2008-03-29 03:54 536,576 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2008-03-29 03:52 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2008-03-29 03:43 3,176,480 ----a-w C:\WINDOWS\system32\ati3duag.dll
2008-03-29 03:39 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2008-03-29 03:36 1,765,120 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2008-03-29 03:24 46,080 ----a-w C:\WINDOWS\system32\amdpcom32.dll
2008-03-29 03:23 5,439,488 ----a-w C:\WINDOWS\system32\atioglxx.dll
2008-03-29 03:21 393,216 ----a-w C:\WINDOWS\system32\atikvmag.dll
2008-03-29 03:19 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2008-03-29 03:12 520,192 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2008-03-28 18:05 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-23 22:48 219 ----a-w C:\Documents and Settings\Vilpponen\hsqlprefs.dat
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-14 13:16 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-03-10 18:16 22,328 ----a-w C:\Documents and Settings\Koppis\Application Data\PnkBstrK.sys
2008-03-10 18:15 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-03-10 18:15 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-03-10 18:15 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-03-04 21:06 24 ----a-w C:\juttelitoimii.bat
2008-03-04 20:59 56 ----a-w C:\jutteli.bat
2008-03-04 20:57 185 ----a-w C:\Copybmp.bat
2008-03-04 11:31 84,526,232 ----a-w C:\Program Files\moviestudio80c-trial_enu.exe
2008-03-02 18:51 2,699,171 ----a-w C:\Program Files\ccleaner_v2.05.555.zip
2008-01-05 20:09 630,768 ----a-w C:\Program Files\eval-nwc.exe
2007-12-15 11:37 8,454,584 ----a-w C:\Program Files\winamp55_full_emusic-7plus_en-us.exe
2007-11-30 12:40 34,556,560 ----a-w C:\Program Files\QCCSENU.EXE
2007-11-05 12:11 5,858 ----a-w C:\Program Files\install.log
2007-11-05 12:10 487,377 ----a-w C:\Program Files\GameSpot_Download_Manager.exe
2007-08-02 08:39 6,221,304 ----a-w C:\Program Files\winamp535_full_emusic-7plus.exe
2007-07-10 08:50 1 ----a-w C:\Documents and Settings\Koppis\SI.bin
2007-06-03 16:33 2,601,692 ----a-w C:\Program Files\mp3wavconverter.exe
2007-06-01 12:28 1,980,533 ----a-w C:\Program Files\registrymedic.exe
2007-04-27 14:23 1,205,365 ----a-w C:\Program Files\wrar37b7.exe
2007-02-13 14:00 19,666,504 ----a-w C:\Program Files\QuickTimeInstaller.exe
2007-02-07 19:11 643,144 ----a-w C:\Program Files\XviD-1.1.2-01112006.exe
2007-01-27 20:20 1,063,810 ----a-w C:\Program Files\subedit.zip
2006-11-30 12:46 1,410,680 ----a-w C:\Program Files\install_flash_player.exe
2006-11-28 15:57 6,052,528 ----a-w C:\Program Files\FirefoxGoogleToolbarSetup.exe
2006-11-26 16:21 29,172 -c--a-w C:\Program Files\Da-Vinci-Tour.kmz
2006-11-26 15:52 14,879,120 ----a-w C:\Program Files\GoogleEarthWin.exe
2006-11-25 18:05 2,855,080 ----a-w C:\Program Files\aawsepersonal.exe
2006-11-23 13:07 362,496 ----a-w C:\Program Files\switchsetup.exe
2006-11-10 14:15 11,284,970 ----a-w C:\Program Files\cdbxp_setup_3.0.116.zip
2006-11-08 17:19 16,198,952 ----a-w C:\Program Files\Install_Messenger.exe
2006-11-04 15:57 6,624,984 ----a-w C:\Program Files\winamp531_full_emusic-7plus.exe
2006-11-04 15:52 3,262,369 ----a-w C:\Program Files\ALZip.exe
2006-11-04 14:08 6,579,696 ----a-w C:\Program Files\Opera_9.02_International_Setup.exe
2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll
2008-02-04 19:26 151,040 --sh--w C:\WINDOWS\system32\VistaUltm.dll
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [ ]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-12-11 21:41 25343016]
"igndlm.exe"="C:\Program Files\Download Manager\DLM.exe" [2007-03-06 00:57 1103480]
"PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 15:44 196608]
"Octoshape Streaming Services"="C:\Program Files\Octoshape Streaming Services\Koppis\OctoshapeClient.exe" [2006-02-13 19:33 214648]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2006-08-14 15:41 114688]
"High Definition Audio -ominaisuussivun pikakuvake"="HDAShCut.exe" [2005-01-07 18:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2005-10-26 04:51 122929]
"F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-28 06:10 122940]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 18:32 221184]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-11 18:36 16267776 C:\WINDOWS\RTHDCPL.exe]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 16:24 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 16:14 217088]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 23:09 157592]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]
"itype"="c:\Program Files\Microsoft IntelliType Pro\itype.exe" [2007-08-31 12:13 988584]
"DPAgnt"="C:\Program Files\DigitalPersona\Bin\DPAgnt.exe" [2006-10-09 16:27 807440]
"Windows svchost"="service.exe" []
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 15:00 15360]
C:\Documents and Settings\All Users\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
F-Secure Automatic Update.lnk - C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe [2006-10-31 16:53:14 32807]
Sonic CinePlayer Quick Launch.lnk - C:\Program Files\Common Files\Sonic Shared\CineTray.exe [2005-10-15 03:01:00 114688]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ckpNotify]
ckpNotify.dll 2005-03-01 20:49 24672 C:\WINDOWS\system32\ckpNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DPWLN ]
C:\WINDOWS\system32\DPWLEvHd.dll 2006-10-09 16:27 99856 C:\WINDOWS\system32\DPWLEvHd.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"vidc.yv12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Service.exe"=
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe"=
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\scc.exe"=
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.exe"=
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Diagnostics.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\Pelit\\Settlers3\\s3.exe"=
"C:\\Pelit\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Pelit\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9278:TCP"= 9278:TCP:BitComet 9278 TCP
"9278:UDP"= 9278:UDP:BitComet 9278 UDP
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-10-31 13:01]
R1 bbcap;bbcap;C:\WINDOWS\system32\DRIVERS\bbcap.sys [2007-06-24 23:03]
R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2006-10-31 16:53]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2005-08-19 16:37]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-10-06 17:30]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2005-08-19 16:37]
R2 Scap;SecureClient Application Policy Module;C:\WINDOWS\system32\DRIVERS\Scap.sys [2005-03-01 20:49]
R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2007-06-01 15:28]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2006-03-02 15:00]
R3 dpK0Bx01;Fingerprint Reader Filter Driver;C:\WINDOWS\system32\DRIVERS\dpK0Bx01.sys [2006-09-16 17:25]
R3 FW1;SecuRemote Miniport;C:\WINDOWS\system32\DRIVERS\fw.sys [2005-03-01 20:49]
R3 usbdpfp;Fingerprint Reader Class Driver;C:\WINDOWS\system32\DRIVERS\usbdpfp.sys [2006-09-16 17:23]
S0 stwlfbus;stwlfbus;C:\WINDOWS\system32\DRIVERS\stwlfbus.sys [2003-04-27 13:39]
S3 ggflt;SEMC USB Flash Driver Filter;C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-02-16 21:03]
S3 gsplittm;gsplittm;C:\DOCUME~1\Koppis\LOCALS~1\Temp\gsplittm.sys []
S3 OMVA;VPN-1 SecureClient Adapter;C:\WINDOWS\system32\DRIVERS\OMVA.sys [2005-03-01 20:49]
S3 st3wolf;st3wolf;C:\WINDOWS\system32\DRIVERS\st3wolf.sys [2003-04-27 12:43]
S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys [2006-11-07 10:42]
S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys [2006-11-07 10:42]
S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys [2006-11-07 10:42]
S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w200mgmt.sys [2006-11-07 10:42]
S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w200obex.sys [2006-11-07 10:42]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86167224-b6ba-11dc-8548-0016350dc46d}]
\Shell\AutoRun\command - I:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-05-30 14:17:09 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2007-02-13 14:00:42 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-03 10:06:49 C:\WINDOWS\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\F-Secure\ANTI-V~1\fsav.exeZ /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-Secure\ANTI-V~1\report.txt
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-03 20:10:03
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-03 20:12:27
ComboFix-quarantined-files.txt 2008-06-03 17:11:52
ComboFix2.txt 2008-06-03 16:29:13
ComboFix3.txt 2008-05-29 11:02:29
Pre-Run: 25,309,265,920 tavua vapaana
Post-Run: 25,295,093,760 tavua vapaana
319 --- E O F --- 2008-05-16 21:03:47
==================================
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 22:33, on 3.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\DigitalPersona\Bin\DPWinLct.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\DigitalPersona\Bin\DpHost.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.Exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\Program Files\Common Files\Sonic Shared\CineTray.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Skype\Plugin Manager\SkypePM.exe
C:\Program Files\Octoshape Streaming Services\Koppis\OctoshapeClient.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HiJackThis_v2\hoojiitee.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [High Definition Audio -ominaisuussivun pikakuvake] HDAShCut.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [DPAgnt] C:\Program Files\DigitalPersona\Bin\DPAgnt.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Program Files\Octoshape Streaming Services\Koppis\OctoshapeClient.exe" -inv:bootrun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = C:\Program Files\Common Files\Sonic Shared\CineTray.exe
O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdat...b?1162297554309
O17 - HKLM\System\CCS\Services\Tcpip\..\{EF416D88-D8DA-40DC-A196-4F3A1F7E69A4}: NameServer = 192.168.1.254
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: DPWLN - C:\WINDOWS\system32\DPWLEvHd.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - C:\Program Files\DigitalPersona\Bin\DpHost.exe
O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - Unknown owner - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: NetMeeting etätyöpöydän jakaminen (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Etätyöpöydän ohjeen istunnonhallinta (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Älykortti (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Resurssilokit ja -hälytykset (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Telnet (TlntSvr) - Unknown owner - C:\WINDOWS\system32\tlntsvr.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe
O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
--
End of file - 12519 bytes
Noniin, pitkä viesti
|
|
Hujo
Suspended permanently
|
3. kesäkuuta 2008 @ 23:01 |
Linkki tähän viestiin
|
Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
Lainaus:
File::
C:\bot1.exe
C:\sqmnoopt16.sqm
C:\sqmdata16.sqm
C:\sqmnoopt15.sqm
C:\sqmdata15.sqm
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
Voiko tietsikka koskaan toimia?
|
|
Koppis1
Junior Member
|
8. kesäkuuta 2008 @ 15:57 |
Linkki tähän viestiin
|
Olin kolme päivää lomalla mökillä, tässä ComboFix loki:
ComboFix 08-06-01.6 - Koppis 2008-06-08 15:45:51.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.925 [GMT 3:00]
Running from: C:\Documents and Settings\Koppis\Työpöytä\ComboFix.exe
Command switches used :: C:\Documents and Settings\Koppis\Työpöytä\CFScript.txt.txt
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\bot1.exe
C:\sqmdata15.sqm
C:\sqmdata16.sqm
C:\sqmnoopt15.sqm
C:\sqmnoopt16.sqm
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\sqmdata15.sqm
C:\sqmdata16.sqm
C:\sqmnoopt15.sqm
C:\sqmnoopt16.sqm
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-08 to 2008-06-08 )))))))))))))))))
.
2008-06-03 23:06 . 2008-06-03 23:06 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\YoYoGames
2008-06-03 21:54 . 2008-06-03 21:54 <KANSIO> d-------- C:\WINDOWS\ERUNT
2008-06-03 21:51 . 2008-06-03 21:51 <KANSIO> d-------- C:\Documents and Settings\Koppis\Ty÷p÷ytõ
2008-06-03 19:06 . 2008-06-03 19:06 86,548 --a------ C:\setz.exe
2008-06-03 19:05 . 2008-06-03 19:05 4,217 --a------ C:\WINDOWS\is154890.exe
2008-06-03 13:13 . 2008-06-03 13:13 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\Malwarebytes
2008-06-02 22:29 . 2008-06-02 22:29 97,116 --a------ C:\WINDOWS\DC5177176.zip
2008-06-01 23:33 . 2008-06-01 23:33 <KANSIO> d-------- C:\Program Files\Live_TV
2008-06-01 23:30 . 2008-06-01 23:56 <KANSIO> d-------- C:\Program Files\3GP Converter 2007
2008-06-01 23:30 . 2008-06-01 23:30 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-01 23:30 . 2008-06-01 23:30 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-01 23:13 . 2008-06-01 23:13 3,758,036 --a------ C:\spore.3gp
2008-06-01 23:09 . 2008-06-01 23:09 <KANSIO> d-------- C:\Program Files\WinAVI MP4 Converter
2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Program Files\SmartFTP Client 3.0 Setup Files
2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Program Files\SmartFTP Client
2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\SmartFTP
2008-05-31 15:37 . 2008-05-31 15:37 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2008-05-31 15:36 . 2004-09-14 16:11 21,504 --a------ C:\WINDOWS\system32\drivers\hidserv.dll
2008-05-31 10:46 . 2008-05-31 10:47 1,646,766 --a------ C:\We_hold_these_truths.flv.MP3.OGG
2008-05-31 10:45 . 2008-05-31 10:46 558,088 --a------ C:\The Flight of the Bumble Bee.flv.MP3.OGG
2008-05-31 10:44 . 2008-05-31 10:45 2,007,871 --a------ C:\Speed metal messiah.flv.MP3.OGG
2008-05-31 10:43 . 2008-05-31 10:44 2,315,607 --a------ C:\necro.ogg.MP3.OGG
2008-05-31 10:42 . 2008-05-31 10:43 2,297,579 --a------ C:\Jerryc - Canon Rock (Guitar Play).mp3.OGG
2008-05-31 10:40 . 2008-05-31 10:42 3,361,200 --a------ C:\Dragonforce - Revolution Deathsquad.mp3.OGG
2008-05-31 10:38 . 2008-05-31 10:40 2,260,120 --a------ C:\06 - Wedding Nails mp3.mp3.OGG
2008-05-31 10:37 . 2008-05-31 10:38 2,090,948 --a------ C:\01 Black Dog.mp3.OGG
2008-05-31 10:35 . 2008-05-31 10:37 2,797,956 --a------ C:\Wedding_Nails.mp3.OGG
2008-05-31 10:29 . 2008-05-31 10:29 1,257,221 --a------ C:\The Flight of the Bumble Bee.flv.MP3
2008-05-31 10:28 . 2008-05-31 10:28 5,231,595 --a------ C:\Corpse_tumor.flv.MP3
2008-05-31 10:28 . 2008-05-31 10:29 4,536,111 --a------ C:\Speed metal messiah.flv.MP3
2008-05-31 10:27 . 2008-05-31 10:27 7,047,627 --a------ C:\We_hold_these_truths.flv.MP3
2008-05-30 17:50 . 2008-05-30 17:50 <KANSIO> d-------- C:\Program Files\Webteh
2008-05-30 17:49 . 2008-05-30 17:49 9,380,296 --a------ C:\Program Files\bsplayer228.964_clip.exe
2008-05-30 14:38 . 2008-05-30 14:38 <KANSIO> d-------- C:\WINDOWS\system32\Clickteam
2008-05-30 14:38 . 2008-05-30 14:38 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\Clickteam
2008-05-29 21:05 . 2008-05-29 21:05 <KANSIO> d-------- C:\Documents and Settings\Mirja Vilpponen\Application Data\DigitalPersona
2008-05-29 18:26 . 2008-05-29 18:26 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\DigitalPersona
2008-05-29 18:26 . 2008-05-29 18:26 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\ATI
2008-05-29 10:32 . 2008-06-03 13:54 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-29 10:32 . 2008-05-29 10:32 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\Malwarebytes
2008-05-29 10:32 . 2008-05-29 10:32 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-29 10:32 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-29 10:32 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-28 22:22 . 2008-05-28 22:22 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-05-28 21:41 . 2008-05-28 21:41 2,855 --a------ C:\ComboFix.PIF
2008-05-28 21:31 . 2008-05-28 21:31 0 --a------ C:\ComboFix.exe
2008-05-28 20:29 . 2008-06-03 22:33 <KANSIO> d-------- C:\Program Files\HiJackThis_v2
2008-05-28 20:16 . 2008-05-28 20:28 <KANSIO> d-------- C:\WINDOWS\BDOSCAN8
2008-05-28 18:05 . 2008-05-28 18:05 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\DigitalPersona
2008-05-28 17:58 . 2008-05-28 17:58 <KANSIO> d-------- C:\WINDOWS\DPDrv
2008-05-28 17:58 . 2008-05-28 17:58 <KANSIO> d-------- C:\Program Files\DigitalPersona
2008-05-28 17:26 . 2008-05-28 17:26 <KANSIO> d-------- C:\Program Files\DP10-002
2008-05-28 17:26 . 2008-05-28 17:26 2,334,453 --a------ C:\Program Files\DP10-002.zip
2008-05-28 16:43 . 2008-05-28 16:43 8,579,136 --a------ C:\Program Files\DPPM_201_ENG.exe
2008-05-28 16:04 . 2007-08-31 12:15 18,856 --a------ C:\WINDOWS\system32\drivers\nuidfltr.sys
2008-05-28 16:03 . 2008-05-28 16:39 <KANSIO> d-------- C:\Program Files\Microsoft IntelliType Pro
2008-05-28 15:48 . 2004-09-14 16:11 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-05-28 15:48 . 2004-09-14 16:11 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-05-27 21:48 . 2008-05-27 21:48 3,510,857 --a------ C:\SMB2AV.MP3
2008-05-27 21:48 . 2008-05-27 21:48 2,069,315 --a------ C:\FB.MP3
2008-05-27 21:47 . 2008-05-27 21:48 3,554,742 --a------ C:\SMBAV.MP3
2008-05-27 08:32 . 2008-05-27 08:32 <KANSIO> d-------- C:\Documents and Settings\Mirja Vilpponen\Application Data\ATI
2008-05-25 21:05 . 2008-05-29 16:55 <KANSIO> d-------- C:\Program Files\Cheat Engine
2008-05-25 21:05 . 2007-12-26 17:30 1,970,176 --a------ C:\WINDOWS\system32\d3dx9.dll
2008-05-25 21:05 . 2007-12-26 17:30 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll
2008-05-22 22:13 . 2008-05-22 22:13 <KANSIO> d-------- C:\Program Files\Octoshape Streaming Services
2008-05-22 15:11 . 2008-05-22 17:12 <KANSIO> d-------- C:\Program Files\mIRC
2008-05-22 15:11 . 2008-05-22 17:16 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\mIRC
2008-05-21 14:57 . 2008-06-08 13:44 31 --a------ C:\WINDOWS\system32\bbcap.err
2008-05-21 14:56 . 2008-05-21 14:56 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\ATI
2008-05-21 14:56 . 2008-05-21 14:56 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\ATI
2008-05-18 18:49 . 2008-05-18 18:49 <KANSIO> d-------- C:\Program Files\Mioplanet
2008-05-18 18:49 . 2008-05-18 18:49 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\mioObjects
2008-05-18 18:49 . 2008-05-18 18:49 407,047 --a------ C:\WINDOWS\system32\mioengine.exe
2008-05-18 12:30 . 2008-05-18 12:30 <KANSIO> d-------- C:\Program Files\eRightSoft
2008-05-18 12:30 . 2006-09-12 14:46 227,328 -r-hs---- C:\WINDOWS\system32\ac3DX.ax
2008-05-18 12:30 . 2006-05-03 13:06 163,328 -r-hs---- C:\WINDOWS\system32\flvDX.dll
2008-05-18 12:30 . 2008-02-04 22:26 151,040 ---hs---- C:\WINDOWS\system32\VistaUltm.dll
2008-05-18 12:30 . 2006-01-13 02:23 123,904 -r-hs---- C:\WINDOWS\system32\AVCDX.ax
2008-05-18 12:30 . 2003-11-21 02:00 54,784 -r-hs---- C:\WINDOWS\system32\RLAPEDec.ax
2008-05-18 12:30 . 2004-04-27 02:00 37,888 -r-hs---- C:\WINDOWS\system32\RLMPCDec.ax
2008-05-18 12:30 . 2007-02-21 14:47 31,232 -r-hs---- C:\WINDOWS\system32\msfDX.dll
2008-05-18 12:30 . 2007-12-17 16:43 27,648 ---hs---- C:\WINDOWS\system32\Smab0.dll
2008-05-18 12:30 . 2008-02-05 20:04 9,884 ---h----- C:\WINDOWS\super.chm
2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Program Files\NCH Software
2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\NCH Swift Sound
2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\NCH Software
2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\NCH Software
2008-05-17 22:48 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll
2008-05-13 07:34 . 2008-05-13 07:34 <KANSIO> d-------- C:\Program Files\Screen Recorder Gold
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 12:50 --------- d-----w C:\Program Files\PeerGuardian2
2008-06-08 12:50 --------- d-----w C:\Documents and Settings\Koppis\Application Data\Skype
2008-06-02 19:35 --------- d-----w C:\Program Files\RevConnect
2008-05-29 19:20 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-05-28 17:01 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-28 14:57 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-22 11:36 --------- d-----w C:\Program Files\ATI
2008-05-21 11:51 --------- d-----w C:\Program Files\ATI Technologies
2008-05-21 11:50 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-18 09:07 --------- d-----w C:\Program Files\NCH Swift Sound
2008-05-18 09:00 --------- d-----w C:\Program Files\CamStudio
2008-05-17 19:48 413,696 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-05-17 19:48 110,592 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-05-06 18:30 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-04-30 17:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ubisoft
2008-04-26 09:33 --------- d-----w C:\Program Files\Java
2008-04-21 14:35 --------- d-----w C:\Program Files\HardCopy Pro
2008-04-21 14:35 --------- d-----w C:\Documents and Settings\Koppis\Application Data\DeskSoft
2008-04-16 13:40 --------- d-----w C:\Program Files\Winamp
2008-04-16 13:29 --------- d-----w C:\Program Files\Game_Maker7
2008-04-16 12:54 8,990,072 ----a-w C:\Program Files\winamp5531_full_emusic-7plus_en-us.exe
2008-04-15 18:59 --------- d-----w C:\Program Files\Lavalys
2008-04-15 16:12 --------- d-----w C:\Documents and Settings\Vilpponen\Application Data\The Hobbit
2008-04-12 16:25 --------- d-----w C:\Program Files\Guitar Pro 5
2008-04-09 13:49 --------- d-----w C:\Documents and Settings\Vilpponen\Application Data\Skype
2008-03-29 05:19 9,801,728 ----a-w C:\WINDOWS\system32\atioglx2.dll
2008-03-29 04:40 167,936 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2008-03-29 04:05 372,736 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2008-03-29 04:04 299,008 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2008-03-29 03:56 172,032 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2008-03-29 03:56 126,976 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2008-03-29 03:55 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2008-03-29 03:55 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2008-03-29 03:55 126,976 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2008-03-29 03:54 536,576 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2008-03-29 03:52 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2008-03-29 03:43 3,176,480 ----a-w C:\WINDOWS\system32\ati3duag.dll
2008-03-29 03:39 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2008-03-29 03:36 1,765,120 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2008-03-29 03:24 46,080 ----a-w C:\WINDOWS\system32\amdpcom32.dll
2008-03-29 03:23 5,439,488 ----a-w C:\WINDOWS\system32\atioglxx.dll
2008-03-29 03:21 393,216 ----a-w C:\WINDOWS\system32\atikvmag.dll
2008-03-29 03:19 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2008-03-29 03:12 520,192 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2008-03-28 18:05 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-23 22:48 219 ----a-w C:\Documents and Settings\Vilpponen\hsqlprefs.dat
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-14 13:16 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-03-10 18:16 22,328 ----a-w C:\Documents and Settings\Koppis\Application Data\PnkBstrK.sys
2008-03-10 18:15 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-03-10 18:15 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-03-10 18:15 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-03-04 11:31 84,526,232 ----a-w C:\Program Files\moviestudio80c-trial_enu.exe
2008-03-02 18:51 2,699,171 ----a-w C:\Program Files\ccleaner_v2.05.555.zip
2008-01-05 20:09 630,768 ----a-w C:\Program Files\eval-nwc.exe
2007-12-15 11:37 8,454,584 ----a-w C:\Program Files\winamp55_full_emusic-7plus_en-us.exe
2007-11-30 12:40 34,556,560 ----a-w C:\Program Files\QCCSENU.EXE
2007-11-05 12:11 5,858 ----a-w C:\Program Files\install.log
2007-11-05 12:10 487,377 ----a-w C:\Program Files\GameSpot_Download_Manager.exe
2007-08-02 08:39 6,221,304 ----a-w C:\Program Files\winamp535_full_emusic-7plus.exe
2007-07-10 08:50 1 ----a-w C:\Documents and Settings\Koppis\SI.bin
2007-06-03 16:33 2,601,692 ----a-w C:\Program Files\mp3wavconverter.exe
2007-06-01 12:28 1,980,533 ----a-w C:\Program Files\registrymedic.exe
2007-04-27 14:23 1,205,365 ----a-w C:\Program Files\wrar37b7.exe
2007-02-13 14:00 19,666,504 ----a-w C:\Program Files\QuickTimeInstaller.exe
2007-02-07 19:11 643,144 ----a-w C:\Program Files\XviD-1.1.2-01112006.exe
2007-01-27 20:20 1,063,810 ----a-w C:\Program Files\subedit.zip
2006-11-30 12:46 1,410,680 ----a-w C:\Program Files\install_flash_player.exe
2006-11-28 15:57 6,052,528 ----a-w C:\Program Files\FirefoxGoogleToolbarSetup.exe
2006-11-26 16:21 29,172 -c--a-w C:\Program Files\Da-Vinci-Tour.kmz
2006-11-26 15:52 14,879,120 ----a-w C:\Program Files\GoogleEarthWin.exe
2006-11-25 18:05 2,855,080 ----a-w C:\Program Files\aawsepersonal.exe
2006-11-23 13:07 362,496 ----a-w C:\Program Files\switchsetup.exe
2006-11-10 14:15 11,284,970 ----a-w C:\Program Files\cdbxp_setup_3.0.116.zip
2006-11-08 17:19 16,198,952 ----a-w C:\Program Files\Install_Messenger.exe
2006-11-04 15:57 6,624,984 ----a-w C:\Program Files\winamp531_full_emusic-7plus.exe
2006-11-04 15:52 3,262,369 ----a-w C:\Program Files\ALZip.exe
2006-11-04 14:08 6,579,696 ----a-w C:\Program Files\Opera_9.02_International_Setup.exe
2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll
2008-02-04 19:26 151,040 --sh--w C:\WINDOWS\system32\VistaUltm.dll
.
((((((((((((((((((((((((((((( snapshot@2008-06-03_19.28.49.32 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-03 16:19:20 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-08 10:41:55 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-01 16:12:42 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-06-03 18:54:44 8,753,152 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-06-03 18:54:46 352,256 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-06-01 16:12:42 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-06-03 18:54:30 8,753,152 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2008-06-03 18:54:30 352,256 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
- 2007-11-21 00:52:38 2,884,992 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
+ 2008-03-25 03:21:18 2,889,088 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
- 2007-11-21 00:52:40 218,496 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2008-03-25 03:21:20 218,496 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
- 2008-01-29 19:04:22 70,264 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
+ 2008-06-08 10:48:10 70,264 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [ ]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-12-11 21:41 25343016]
"igndlm.exe"="C:\Program Files\Download Manager\DLM.exe" [2007-03-06 00:57 1103480]
"PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 15:44 196608]
"Octoshape Streaming Services"="C:\Program Files\Octoshape Streaming Services\Koppis\OctoshapeClient.exe" [2006-02-13 19:33 214648]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2006-08-14 15:41 114688]
"High Definition Audio -ominaisuussivun pikakuvake"="HDAShCut.exe" [2005-01-07 18:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2005-10-26 04:51 122929]
"F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-28 06:10 122940]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 18:32 221184]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-11 18:36 16267776 C:\WINDOWS\RTHDCPL.exe]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 16:24 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 16:14 217088]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 23:09 157592]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]
"itype"="c:\Program Files\Microsoft IntelliType Pro\itype.exe" [2007-08-31 12:13 988584]
"DPAgnt"="C:\Program Files\DigitalPersona\Bin\DPAgnt.exe" [2006-10-09 16:27 807440]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 15:00 15360]
C:\Documents and Settings\All Users\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
F-Secure Automatic Update.lnk - C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe [2006-10-31 16:53:14 32807]
Sonic CinePlayer Quick Launch.lnk - C:\Program Files\Common Files\Sonic Shared\CineTray.exe [2005-10-15 03:01:00 114688]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ckpNotify]
ckpNotify.dll 2005-03-01 20:49 24672 C:\WINDOWS\system32\ckpNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DPWLN ]
C:\WINDOWS\system32\DPWLEvHd.dll 2006-10-09 16:27 99856 C:\WINDOWS\system32\DPWLEvHd.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"vidc.yv12"= yv12vfw.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Service.exe"=
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe"=
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\scc.exe"=
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.exe"=
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Diagnostics.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\Pelit\\Settlers3\\s3.exe"=
"C:\\Pelit\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Pelit\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9278:TCP"= 9278:TCP:BitComet 9278 TCP
"9278:UDP"= 9278:UDP:BitComet 9278 UDP
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-10-31 13:01]
R1 bbcap;bbcap;C:\WINDOWS\system32\DRIVERS\bbcap.sys [2007-06-24 23:03]
R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2006-10-31 16:53]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2005-08-19 16:37]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-10-06 17:30]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2005-08-19 16:37]
R2 Scap;SecureClient Application Policy Module;C:\WINDOWS\system32\DRIVERS\Scap.sys [2005-03-01 20:49]
R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2007-06-01 15:28]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2006-03-02 15:00]
R3 dpK0Bx01;Fingerprint Reader Filter Driver;C:\WINDOWS\system32\DRIVERS\dpK0Bx01.sys [2006-09-16 17:25]
R3 FW1;SecuRemote Miniport;C:\WINDOWS\system32\DRIVERS\fw.sys [2005-03-01 20:49]
R3 usbdpfp;Fingerprint Reader Class Driver;C:\WINDOWS\system32\DRIVERS\usbdpfp.sys [2006-09-16 17:23]
S0 stwlfbus;stwlfbus;C:\WINDOWS\system32\DRIVERS\stwlfbus.sys [2003-04-27 13:39]
S3 ggflt;SEMC USB Flash Driver Filter;C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-02-16 21:03]
S3 gsplittm;gsplittm;C:\DOCUME~1\Koppis\LOCALS~1\Temp\gsplittm.sys []
S3 OMVA;VPN-1 SecureClient Adapter;C:\WINDOWS\system32\DRIVERS\OMVA.sys [2005-03-01 20:49]
S3 st3wolf;st3wolf;C:\WINDOWS\system32\DRIVERS\st3wolf.sys [2003-04-27 12:43]
S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys [2006-11-07 10:42]
S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys [2006-11-07 10:42]
S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys [2006-11-07 10:42]
S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w200mgmt.sys [2006-11-07 10:42]
S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w200obex.sys [2006-11-07 10:42]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86167224-b6ba-11dc-8548-0016350dc46d}]
\Shell\AutoRun\command - I:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe
*Newly Created Service* - PGFILTER
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-05-30 14:17:09 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2007-02-13 14:00:42 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-08 10:42:21 C:\WINDOWS\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\F-Secure\ANTI-V~1\fsav.exeZ /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-Secure\ANTI-V~1\report.txt
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 15:50:47
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-08 15:54:19
ComboFix-quarantined-files.txt 2008-06-08 12:54:15
ComboFix2.txt 2008-06-03 17:12:28
ComboFix3.txt 2008-06-03 16:29:13
ComboFix4.txt 2008-05-29 11:02:29
Pre-Run: 25,179,209,728 tavua vapaana
Post-Run: 25,170,620,416 tavua vapaana
332 --- E O F --- 2008-05-16 21:03:47
|
|
Koppis1
Junior Member
|
9. kesäkuuta 2008 @ 19:04 |
Linkki tähän viestiin
|
|
tippuu tämä aihe
|
|
Koppis1
Junior Member
|
12. kesäkuuta 2008 @ 19:11 |
Linkki tähän viestiin
|
|
voisiko joku nyt vastata?
|
|
Hujo
Suspended permanently
|
12. kesäkuuta 2008 @ 19:32 |
Linkki tähän viestiin
|
Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
Lainaus:
File::
C:\setz.exe
C:\WINDOWS\is154890.exe
C:\WINDOWS\DC5177176.zip
C:\WINDOWS\system32\flvDX.dll
C:\WINDOWS\system32\msfDX.dll
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
===============
Päivitä Malwarebytes' Anti-Malware ja aja
Voiko tietsikka koskaan toimia?
|
|
Koppis1
Junior Member
|
12. kesäkuuta 2008 @ 22:08 |
Linkki tähän viestiin
|
Ajan kohta malwaren.
ComboFix 08-06-01.6 - Koppis 2008-06-12 21:54:28.9 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.901 [GMT 3:00]
Running from: C:\Documents and Settings\Koppis\Työpöytä\ComboFix.exe
Command switches used :: C:\Documents and Settings\Koppis\Työpöytä\CFScript.txt
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\setz.exe
C:\WINDOWS\DC5177176.zip
C:\WINDOWS\is154890.exe
C:\WINDOWS\system32\flvDX.dll
C:\WINDOWS\system32\msfDX.dll
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\setz.exe
C:\WINDOWS\DC5177176.zip
C:\WINDOWS\is154890.exe
C:\WINDOWS\system32\flvDX.dll
C:\WINDOWS\system32\msfDX.dll
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-12 to 2008-06-12 )))))))))))))))))
.
2008-06-12 19:45 . 2008-06-12 19:45 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-12 19:45 . 2008-06-12 19:45 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-11 15:09 . 2008-03-05 15:56 3,786,760 --a------ C:\WINDOWS\system32\D3DX9_37.dll
2008-06-11 15:09 . 2008-03-05 15:56 1,420,824 --a------ C:\WINDOWS\system32\D3DCompiler_37.dll
2008-06-11 15:09 . 2007-10-12 15:14 1,374,232 --a------ C:\WINDOWS\system32\D3DCompiler_36.dll
2008-06-11 15:09 . 2008-03-05 16:03 479,752 --a------ C:\WINDOWS\system32\XAudio2_0.dll
2008-06-11 15:09 . 2008-02-05 23:07 462,864 --a------ C:\WINDOWS\system32\d3dx10_37.dll
2008-06-11 15:09 . 2007-10-02 09:56 444,776 --a------ C:\WINDOWS\system32\d3dx10_36.dll
2008-06-11 15:09 . 2007-10-22 03:39 267,272 --a------ C:\WINDOWS\system32\xactengine2_10.dll
2008-06-11 15:09 . 2007-07-20 00:57 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll
2008-06-11 15:09 . 2008-03-05 16:03 238,088 --a------ C:\WINDOWS\system32\xactengine3_0.dll
2008-06-11 15:09 . 2008-03-05 16:00 25,608 --a------ C:\WINDOWS\system32\X3DAudio1_3.dll
2008-06-11 14:10 . 2008-06-11 14:29 487,189,936 --a------ C:\Program Files\LEGOIndyDemoSetup1.exe
2008-06-11 12:50 . 2008-04-14 18:52 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 12:50 . 2008-04-14 18:52 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-09 19:27 . 2008-06-09 19:27 244 --ah----- C:\sqmnoopt15.sqm
2008-06-09 19:27 . 2008-06-09 19:27 232 --ah----- C:\sqmdata15.sqm
2008-06-09 19:25 . 2008-06-09 19:25 2,402,320 --a------ C:\Program Files\WLinstaller.exe
2008-06-03 23:06 . 2008-06-11 17:59 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\YoYoGames
2008-06-03 21:54 . 2008-06-03 21:54 <KANSIO> d-------- C:\WINDOWS\ERUNT
2008-06-03 21:51 . 2008-06-03 21:51 <KANSIO> d-------- C:\Documents and Settings\Koppis\Ty÷p÷ytõ
2008-06-03 13:13 . 2008-06-03 13:13 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\Malwarebytes
2008-06-01 23:33 . 2008-06-01 23:33 <KANSIO> d-------- C:\Program Files\Live_TV
2008-06-01 23:30 . 2008-06-01 23:56 <KANSIO> d-------- C:\Program Files\3GP Converter 2007
2008-06-01 23:13 . 2008-06-01 23:13 3,758,036 --a------ C:\spore.3gp
2008-06-01 23:09 . 2008-06-12 18:54 <KANSIO> d-------- C:\Program Files\WinAVI MP4 Converter
2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Program Files\SmartFTP Client 3.0 Setup Files
2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Program Files\SmartFTP Client
2008-06-01 21:37 . 2008-06-01 21:37 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\SmartFTP
2008-05-31 15:37 . 2008-05-31 15:37 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2008-05-31 15:36 . 2004-09-14 16:11 21,504 --a------ C:\WINDOWS\system32\drivers\hidserv.dll
2008-05-31 10:46 . 2008-05-31 10:47 1,646,766 --a------ C:\We_hold_these_truths.flv.MP3.OGG
2008-05-31 10:45 . 2008-05-31 10:46 558,088 --a------ C:\The Flight of the Bumble Bee.flv.MP3.OGG
2008-05-31 10:44 . 2008-05-31 10:45 2,007,871 --a------ C:\Speed metal messiah.flv.MP3.OGG
2008-05-31 10:43 . 2008-05-31 10:44 2,315,607 --a------ C:\necro.ogg.MP3.OGG
2008-05-31 10:42 . 2008-05-31 10:43 2,297,579 --a------ C:\Jerryc - Canon Rock (Guitar Play).mp3.OGG
2008-05-31 10:40 . 2008-05-31 10:42 3,361,200 --a------ C:\Dragonforce - Revolution Deathsquad.mp3.OGG
2008-05-31 10:38 . 2008-05-31 10:40 2,260,120 --a------ C:\06 - Wedding Nails mp3.mp3.OGG
2008-05-31 10:37 . 2008-05-31 10:38 2,090,948 --a------ C:\01 Black Dog.mp3.OGG
2008-05-31 10:35 . 2008-05-31 10:37 2,797,956 --a------ C:\Wedding_Nails.mp3.OGG
2008-05-31 10:29 . 2008-05-31 10:29 1,257,221 --a------ C:\The Flight of the Bumble Bee.flv.MP3
2008-05-31 10:28 . 2008-05-31 10:28 5,231,595 --a------ C:\Corpse_tumor.flv.MP3
2008-05-31 10:28 . 2008-05-31 10:29 4,536,111 --a------ C:\Speed metal messiah.flv.MP3
2008-05-31 10:27 . 2008-05-31 10:27 7,047,627 --a------ C:\We_hold_these_truths.flv.MP3
2008-05-30 17:50 . 2008-05-30 17:50 <KANSIO> d-------- C:\Program Files\Webteh
2008-05-30 17:49 . 2008-05-30 17:49 9,380,296 --a------ C:\Program Files\bsplayer228.964_clip.exe
2008-05-30 14:38 . 2008-05-30 14:38 <KANSIO> d-------- C:\WINDOWS\system32\Clickteam
2008-05-30 14:38 . 2008-05-30 14:38 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\Clickteam
2008-05-29 21:05 . 2008-05-29 21:05 <KANSIO> d-------- C:\Documents and Settings\Mirja Vilpponen\Application Data\DigitalPersona
2008-05-29 18:26 . 2008-05-29 18:26 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\DigitalPersona
2008-05-29 18:26 . 2008-05-29 18:26 <KANSIO> d-------- C:\Documents and Settings\Vilpponen\Application Data\ATI
2008-05-29 10:32 . 2008-06-03 13:54 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-29 10:32 . 2008-05-29 10:32 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\Malwarebytes
2008-05-29 10:32 . 2008-05-29 10:32 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-29 10:32 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-29 10:32 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-28 22:22 . 2008-05-28 22:22 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-05-28 21:41 . 2008-05-28 21:41 2,855 --a------ C:\ComboFix.PIF
2008-05-28 21:31 . 2008-05-28 21:31 0 --a------ C:\ComboFix.exe
2008-05-28 20:29 . 2008-06-03 22:33 <KANSIO> d-------- C:\Program Files\HiJackThis_v2
2008-05-28 20:16 . 2008-05-28 20:28 <KANSIO> d-------- C:\WINDOWS\BDOSCAN8
2008-05-28 18:05 . 2008-05-28 18:05 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\DigitalPersona
2008-05-28 17:58 . 2008-05-28 17:58 <KANSIO> d-------- C:\WINDOWS\DPDrv
2008-05-28 17:58 . 2008-05-28 17:58 <KANSIO> d-------- C:\Program Files\DigitalPersona
2008-05-28 17:26 . 2008-05-28 17:26 <KANSIO> d-------- C:\Program Files\DP10-002
2008-05-28 17:26 . 2008-05-28 17:26 2,334,453 --a------ C:\Program Files\DP10-002.zip
2008-05-28 16:43 . 2008-05-28 16:43 8,579,136 --a------ C:\Program Files\DPPM_201_ENG.exe
2008-05-28 16:04 . 2007-08-31 12:15 18,856 --a------ C:\WINDOWS\system32\drivers\nuidfltr.sys
2008-05-28 16:03 . 2008-05-28 16:39 <KANSIO> d-------- C:\Program Files\Microsoft IntelliType Pro
2008-05-28 15:48 . 2004-09-14 16:11 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-05-28 15:48 . 2004-09-14 16:11 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-05-27 21:48 . 2008-05-27 21:48 3,510,857 --a------ C:\SMB2AV.MP3
2008-05-27 21:48 . 2008-05-27 21:48 2,069,315 --a------ C:\FB.MP3
2008-05-27 21:47 . 2008-05-27 21:48 3,554,742 --a------ C:\SMBAV.MP3
2008-05-27 08:32 . 2008-05-27 08:32 <KANSIO> d-------- C:\Documents and Settings\Mirja Vilpponen\Application Data\ATI
2008-05-25 21:05 . 2008-05-29 16:55 <KANSIO> d-------- C:\Program Files\Cheat Engine
2008-05-25 21:05 . 2007-12-26 17:30 1,970,176 --a------ C:\WINDOWS\system32\d3dx9.dll
2008-05-25 21:05 . 2007-12-26 17:30 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll
2008-05-22 22:13 . 2008-05-22 22:13 <KANSIO> d-------- C:\Program Files\Octoshape Streaming Services
2008-05-22 15:11 . 2008-05-22 17:12 <KANSIO> d-------- C:\Program Files\mIRC
2008-05-22 15:11 . 2008-05-22 17:16 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\mIRC
2008-05-21 14:57 . 2008-06-10 23:15 31 --a------ C:\WINDOWS\system32\bbcap.err
2008-05-21 14:56 . 2008-05-21 14:56 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\ATI
2008-05-21 14:56 . 2008-05-21 14:56 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\ATI
2008-05-18 18:49 . 2008-05-18 18:49 <KANSIO> d-------- C:\Program Files\Mioplanet
2008-05-18 18:49 . 2008-05-18 18:49 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\mioObjects
2008-05-18 18:49 . 2008-05-18 18:49 407,047 --a------ C:\WINDOWS\system32\mioengine.exe
2008-05-18 12:30 . 2008-05-18 12:30 <KANSIO> d-------- C:\Program Files\eRightSoft
2008-05-18 12:30 . 2006-09-12 14:46 227,328 -r-hs---- C:\WINDOWS\system32\ac3DX.ax
2008-05-18 12:30 . 2008-02-04 22:26 151,040 ---hs---- C:\WINDOWS\system32\VistaUltm.dll
2008-05-18 12:30 . 2006-01-13 02:23 123,904 -r-hs---- C:\WINDOWS\system32\AVCDX.ax
2008-05-18 12:30 . 2003-11-21 02:00 54,784 -r-hs---- C:\WINDOWS\system32\RLAPEDec.ax
2008-05-18 12:30 . 2004-04-27 02:00 37,888 -r-hs---- C:\WINDOWS\system32\RLMPCDec.ax
2008-05-18 12:30 . 2007-12-17 16:43 27,648 ---hs---- C:\WINDOWS\system32\Smab0.dll
2008-05-18 12:30 . 2008-02-05 20:04 9,884 ---h----- C:\WINDOWS\super.chm
2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Program Files\NCH Software
2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\NCH Swift Sound
2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\Koppis\Application Data\NCH Software
2008-05-18 12:07 . 2008-05-18 12:07 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\NCH Software
2008-05-17 22:48 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll
2008-05-13 07:34 . 2008-05-13 07:34 <KANSIO> d-------- C:\Program Files\Screen Recorder Gold
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-12 18:59 --------- d-----w C:\Program Files\PeerGuardian2
2008-06-12 16:50 --------- d-----w C:\Documents and Settings\Koppis\Application Data\Skype
2008-06-12 16:33 --------- d-----w C:\Program Files\RevConnect
2008-06-11 12:10 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-09 16:26 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-06-09 16:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-29 19:20 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-05-28 17:01 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-28 14:57 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-22 11:36 --------- d-----w C:\Program Files\ATI
2008-05-21 11:51 --------- d-----w C:\Program Files\ATI Technologies
2008-05-18 09:07 --------- d-----w C:\Program Files\NCH Swift Sound
2008-05-18 09:00 --------- d-----w C:\Program Files\CamStudio
2008-05-17 19:48 413,696 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-05-17 19:48 110,592 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:15 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-06 18:30 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-04-30 17:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ubisoft
2008-04-26 09:33 --------- d-----w C:\Program Files\Java
2008-04-21 14:35 --------- d-----w C:\Program Files\HardCopy Pro
2008-04-21 14:35 --------- d-----w C:\Documents and Settings\Koppis\Application Data\DeskSoft
2008-04-21 07:02 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2008-04-16 13:40 --------- d-----w C:\Program Files\Winamp
2008-04-16 13:29 --------- d-----w C:\Program Files\Game_Maker7
2008-04-16 12:54 8,990,072 ----a-w C:\Program Files\winamp5531_full_emusic-7plus_en-us.exe
2008-04-15 18:59 --------- d-----w C:\Program Files\Lavalys
2008-04-15 16:12 --------- d-----w C:\Documents and Settings\Vilpponen\Application Data\The Hobbit
2008-04-12 16:25 --------- d-----w C:\Program Files\Guitar Pro 5
2008-03-29 05:19 9,801,728 ----a-w C:\WINDOWS\system32\atioglx2.dll
2008-03-29 04:40 167,936 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2008-03-29 04:05 372,736 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2008-03-29 04:04 299,008 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2008-03-29 03:56 172,032 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2008-03-29 03:56 126,976 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2008-03-29 03:55 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2008-03-29 03:55 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2008-03-29 03:55 126,976 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2008-03-29 03:54 536,576 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2008-03-29 03:52 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2008-03-29 03:43 3,176,480 ----a-w C:\WINDOWS\system32\ati3duag.dll
2008-03-29 03:39 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2008-03-29 03:36 1,765,120 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2008-03-29 03:24 46,080 ----a-w C:\WINDOWS\system32\amdpcom32.dll
2008-03-29 03:23 5,439,488 ----a-w C:\WINDOWS\system32\atioglxx.dll
2008-03-29 03:21 393,216 ----a-w C:\WINDOWS\system32\atikvmag.dll
2008-03-29 03:19 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2008-03-29 03:12 520,192 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2008-03-28 18:05 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-23 22:48 219 ----a-w C:\Documents and Settings\Vilpponen\hsqlprefs.dat
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-14 13:16 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-03-10 18:16 22,328 ----a-w C:\Documents and Settings\Koppis\Application Data\PnkBstrK.sys
2008-03-04 11:31 84,526,232 ----a-w C:\Program Files\moviestudio80c-trial_enu.exe
2008-03-02 18:51 2,699,171 ----a-w C:\Program Files\ccleaner_v2.05.555.zip
2008-01-05 20:09 630,768 ----a-w C:\Program Files\eval-nwc.exe
2007-12-15 11:37 8,454,584 ----a-w C:\Program Files\winamp55_full_emusic-7plus_en-us.exe
2007-11-30 12:40 34,556,560 ----a-w C:\Program Files\QCCSENU.EXE
2007-11-05 12:11 5,858 ----a-w C:\Program Files\install.log
2007-11-05 12:10 487,377 ----a-w C:\Program Files\GameSpot_Download_Manager.exe
2007-08-02 08:39 6,221,304 ----a-w C:\Program Files\winamp535_full_emusic-7plus.exe
2007-07-10 08:50 1 ----a-w C:\Documents and Settings\Koppis\SI.bin
2007-06-03 16:33 2,601,692 ----a-w C:\Program Files\mp3wavconverter.exe
2007-06-01 12:28 1,980,533 ----a-w C:\Program Files\registrymedic.exe
2007-04-27 14:23 1,205,365 ----a-w C:\Program Files\wrar37b7.exe
2007-02-13 14:00 19,666,504 ----a-w C:\Program Files\QuickTimeInstaller.exe
2007-02-07 19:11 643,144 ----a-w C:\Program Files\XviD-1.1.2-01112006.exe
2007-01-27 20:20 1,063,810 ----a-w C:\Program Files\subedit.zip
2006-11-30 12:46 1,410,680 ----a-w C:\Program Files\install_flash_player.exe
2006-11-28 15:57 6,052,528 ----a-w C:\Program Files\FirefoxGoogleToolbarSetup.exe
2006-11-26 16:21 29,172 -c--a-w C:\Program Files\Da-Vinci-Tour.kmz
2006-11-26 15:52 14,879,120 ----a-w C:\Program Files\GoogleEarthWin.exe
2006-11-25 18:05 2,855,080 ----a-w C:\Program Files\aawsepersonal.exe
2006-11-23 13:07 362,496 ----a-w C:\Program Files\switchsetup.exe
2006-11-10 14:15 11,284,970 ----a-w C:\Program Files\cdbxp_setup_3.0.116.zip
2006-11-08 17:19 16,198,952 ----a-w C:\Program Files\Install_Messenger.exe
2006-11-04 15:57 6,624,984 ----a-w C:\Program Files\winamp531_full_emusic-7plus.exe
2006-11-04 15:52 3,262,369 ----a-w C:\Program Files\ALZip.exe
2006-11-04 14:08 6,579,696 ----a-w C:\Program Files\Opera_9.02_International_Setup.exe
2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll
2008-02-04 19:26 151,040 --sh--w C:\WINDOWS\system32\VistaUltm.dll
.
((((((((((((((((((((((((((((( snapshot@2008-06-03_19.28.49.32 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-03-09 11:19:05 53,248 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
+ 2008-06-11 12:08:53 53,248 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
- 2008-03-09 11:19:05 12,800 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
+ 2008-06-11 12:08:53 12,800 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
- 2008-03-09 11:19:05 473,600 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
+ 2008-06-11 12:08:54 473,600 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
- 2008-03-09 11:19:02 2,676,224 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-11 12:08:48 2,676,224 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2008-03-09 11:19:02 2,846,720 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-11 12:08:49 2,846,720 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2008-03-09 11:19:03 563,712 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-11 12:08:49 563,712 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2008-03-09 11:19:03 567,296 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-11 12:08:50 567,296 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2008-03-09 11:19:03 576,000 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-11 12:08:50 576,000 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2008-03-09 11:19:03 577,024 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-11 12:08:51 577,024 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2008-03-09 11:19:03 577,536 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-11 12:08:51 577,536 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2008-03-09 11:19:04 577,536 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-11 12:08:52 577,536 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2008-03-09 11:19:04 578,560 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-11 12:08:52 578,560 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2008-03-09 11:19:05 578,560 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-11 12:08:54 578,560 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2008-03-09 11:19:05 145,920 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
+ 2008-06-11 12:08:54 145,920 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
- 2008-03-09 11:19:05 159,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
+ 2008-06-11 12:08:54 159,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
- 2008-03-09 11:19:05 364,544 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
+ 2008-06-11 12:08:55 364,544 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
- 2008-03-09 11:19:06 178,176 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
+ 2008-06-11 12:08:55 178,176 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
- 2008-03-09 11:19:05 223,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
+ 2008-06-11 12:08:53 223,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
- 2008-06-03 16:19:20 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-12 18:44:43 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-14 15:52:59 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys
+ 2008-06-01 16:12:42 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-06-03 18:54:44 8,753,152 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-06-03 18:54:46 352,256 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-06-01 16:12:42 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-06-03 18:54:30 8,753,152 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2008-06-03 18:54:30 352,256 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
+ 2008-06-11 12:08:19 5,694 ----a-r C:\WINDOWS\Installer\{066ED8C4-8C66-4824-ACF4-8F622E88E074}\ARPPRODUCTICON.exe
- 2008-03-03 11:02:49 29,926 ----a-r C:\WINDOWS\Installer\{A9174A72-1B46-445B-B3CF-90ED2C63D83B}\MsblIco.Exe
+ 2008-06-09 16:26:58 29,926 ----a-r C:\WINDOWS\Installer\{A9174A72-1B46-445B-B3CF-90ED2C63D83B}\MsblIco.Exe
- 2008-02-16 09:02:36 1,023,488 ----a-w C:\WINDOWS\system32\browseui.dll
+ 2008-04-21 07:02:46 1,023,488 ----a-w C:\WINDOWS\system32\browseui.dll
- 2008-02-16 09:02:36 151,552 ----a-w C:\WINDOWS\system32\cdfview.dll
+ 2008-04-21 07:02:46 151,552 ----a-w C:\WINDOWS\system32\cdfview.dll
- 2008-02-16 09:02:37 1,055,232 ----a-w C:\WINDOWS\system32\danim.dll
+ 2008-04-21 07:02:47 1,055,232 ----a-w C:\WINDOWS\system32\danim.dll
- 2008-02-16 09:02:36 1,023,488 -c--a-w C:\WINDOWS\system32\dllcache\browseui.dll
+ 2008-04-21 07:02:46 1,023,488 -c--a-w C:\WINDOWS\system32\dllcache\browseui.dll
- 2008-02-16 09:02:36 151,552 -c--a-w C:\WINDOWS\system32\dllcache\cdfview.dll
+ 2008-04-21 07:02:46 151,552 -c--a-w C:\WINDOWS\system32\dllcache\cdfview.dll
- 2008-02-16 09:02:37 1,055,232 -c--a-w C:\WINDOWS\system32\dllcache\danim.dll
+ 2008-04-21 07:02:47 1,055,232 -c--a-w C:\WINDOWS\system32\dllcache\danim.dll
- 2008-02-16 09:02:37 357,888 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2008-04-21 07:02:47 357,888 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2008-02-16 09:02:37 205,312 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2008-04-21 07:02:47 205,312 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2008-02-16 09:02:37 55,808 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2008-04-21 07:02:47 55,808 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll
- 2008-02-15 09:23:37 18,432 -c--a-w C:\WINDOWS\system32\dllcache\iedw.exe
+ 2008-04-17 10:52:54 18,432 -c--a-w C:\WINDOWS\system32\dllcache\iedw.exe
- 2008-02-16 09:02:38 250,880 -c--a-w C:\WINDOWS\system32\dllcache\iepeers.dll
+ 2008-04-21 07:02:47 250,880 -c--a-w C:\WINDOWS\system32\dllcache\iepeers.dll
- 2008-02-16 09:02:38 96,256 -c--a-w C:\WINDOWS\system32\dllcache\inseng.dll
+ 2008-04-21 07:02:47 96,256 -c--a-w C:\WINDOWS\system32\dllcache\inseng.dll
- 2008-02-16 09:02:38 16,384 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-04-21 07:02:47 16,384 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2008-02-16 22:32:40 3,080,704 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2008-04-21 07:02:49 3,080,704 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll
- 2008-02-16 09:02:39 449,024 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2008-04-21 07:02:49 449,024 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2008-02-16 09:02:39 146,432 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2008-04-21 07:02:49 146,432 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll
- 2008-02-16 09:02:39 532,480 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-04-21 07:02:50 532,480 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll
- 2008-02-16 09:02:39 39,424 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2008-04-21 07:02:50 39,424 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2007-10-29 22:43:51 1,288,192 -c--a-w C:\WINDOWS\system32\dllcache\quartz.dll
+ 2008-05-07 05:15:43 1,288,192 -c--a-w C:\WINDOWS\system32\dllcache\quartz.dll
- 2006-07-13 08:48:58 202,240 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys
+ 2008-05-08 12:28:49 202,752 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys
- 2008-02-16 09:02:41 1,494,016 -c--a-w C:\WINDOWS\system32\dllcache\shdocvw.dll
+ 2008-04-21 07:02:51 1,494,016 -c--a-w C:\WINDOWS\system32\dllcache\shdocvw.dll
- 2008-02-16 09:02:41 474,112 -c--a-w C:\WINDOWS\system32\dllcache\shlwapi.dll
+ 2008-04-21 07:02:51 474,112 -c--a-w C:\WINDOWS\system32\dllcache\shlwapi.dll
- 2008-02-16 09:02:41 616,448 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2008-04-21 07:02:52 616,448 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2008-02-16 09:02:42 659,456 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2008-04-21 07:02:52 659,456 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll
- 2008-02-16 09:02:37 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll
+ 2008-04-21 07:02:47 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll
- 2008-02-16 09:02:37 205,312 ----a-w C:\WINDOWS\system32\dxtrans.dll
+ 2008-04-21 07:02:47 205,312 ----a-w C:\WINDOWS\system32\dxtrans.dll
- 2008-02-16 09:02:37 55,808 ----a-w C:\WINDOWS\system32\extmgr.dll
+ 2008-04-21 07:02:47 55,808 ----a-w C:\WINDOWS\system32\extmgr.dll
- 2008-02-16 09:02:38 250,880 ----a-w C:\WINDOWS\system32\iepeers.dll
+ 2008-04-21 07:02:47 250,880 ----a-w C:\WINDOWS\system32\iepeers.dll
- 2008-02-16 09:02:38 96,256 ----a-w C:\WINDOWS\system32\inseng.dll
+ 2008-04-21 07:02:47 96,256 ----a-w C:\WINDOWS\system32\inseng.dll
- 2008-02-16 09:02:38 16,384 ----a-w C:\WINDOWS\system32\jsproxy.dll
+ 2008-04-21 07:02:47 16,384 ----a-w C:\WINDOWS\system32\jsproxy.dll
- 2007-11-21 00:52:38 2,884,992 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
+ 2008-03-25 03:21:18 2,889,088 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
- 2007-11-21 00:52:40 218,496 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2008-03-25 03:21:20 218,496 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
- 2008-01-29 19:04:22 70,264 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
+ 2008-06-08 10:48:10 70,264 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
- 2008-05-09 21:35:04 16,863,864 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-05-29 23:35:11 17,486,968 ----a-w C:\WINDOWS\system32\MRT.exe
- 2008-02-16 22:32:40 3,080,704 ----a-w C:\WINDOWS\system32\mshtml.dll
+ 2008-04-21 07:02:49 3,080,704 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2008-02-16 09:02:39 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll
+ 2008-04-21 07:02:49 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll
- 2008-02-16 09:02:39 146,432 ----a-w C:\WINDOWS\system32\msrating.dll
+ 2008-04-21 07:02:49 146,432 ----a-w C:\WINDOWS\system32\msrating.dll
- 2008-02-16 09:02:39 532,480 ----a-w C:\WINDOWS\system32\mstime.dll
+ 2008-04-21 07:02:50 532,480 ----a-w C:\WINDOWS\system32\mstime.dll
- 2008-02-16 09:02:39 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll
+ 2008-04-21 07:02:50 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll
- 2008-02-16 09:02:41 1,494,016 ----a-w C:\WINDOWS\system32\shdocvw.dll
+ 2008-04-21 07:02:51 1,494,016 ----a-w C:\WINDOWS\system32\shdocvw.dll
- 2008-02-16 09:02:41 474,112 ----a-w C:\WINDOWS\system32\shlwapi.dll
+ 2008-04-21 07:02:51 474,112 ----a-w C:\WINDOWS\system32\shlwapi.dll
+ 2007-10-18 08:31:46 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll
- 2006-10-08 19:51:14 14,640 ------w C:\WINDOWS\system32\spmsg.dll
+ 2007-11-30 11:19:02 17,272 ------w C:\WINDOWS\system32\spmsg.dll
- 2008-02-16 09:02:41 616,448 ----a-w C:\WINDOWS\system32\urlmon.dll
+ 2008-04-21 07:02:52 616,448 ----a-w C:\WINDOWS\system32\urlmon.dll
- 2007-05-31 16:29:42 18,280 ----a-w C:\WINDOWS\system32\x3daudio1_2.dll
+ 2007-10-22 00:37:16 17,928 ----a-w C:\WINDOWS\system32\X3DAudio1_2.dll
- 2007-05-31 16:30:22 266,088 ----a-w C:\WINDOWS\system32\xactengine2_8.dll
+ 2007-06-20 17:46:04 266,088 ----a-w C:\WINDOWS\system32\xactengine2_8.dll
- 2008-02-15 23:03:12 357,888 ----a-w C:\WINDOWS\system32\xpsp3res.dll
+ 2008-04-17 11:03:44 357,888 ----a-w C:\WINDOWS\system32\xpsp3res.dll
+ 2006-06-05 11:14:28 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcm80.dll
+ 2006-06-05 11:14:28 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcp80.dll
+ 2006-06-05 11:14:28 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcr80.dll
.
-- Snapshot reset to current date --
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-12-11 21:41 25343016]
"igndlm.exe"="C:\Program Files\Download Manager\DLM.exe" [2007-03-06 00:57 1103480]
"PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 15:44 196608]
"Octoshape Streaming Services"="C:\Program Files\Octoshape Streaming Services\Koppis\OctoshapeClient.exe" [2006-02-13 19:33 214648]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2006-08-14 15:41 114688]
"High Definition Audio -ominaisuussivun pikakuvake"="HDAShCut.exe" [2005-01-07 18:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2005-10-26 04:51 122929]
"F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-28 06:10 122940]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 18:32 221184]
"RTHDCPL"="RTHDCPL.EXE" [2006-10-11 18:36 16267776 C:\WINDOWS\RTHDCPL.exe]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 16:24 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 16:14 217088]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 23:09 157592]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]
"itype"="c:\Program Files\Microsoft IntelliType Pro\itype.exe" [2007-08-31 12:13 988584]
"DPAgnt"="C:\Program Files\DigitalPersona\Bin\DPAgnt.exe" [2006-10-09 16:27 807440]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 15:00 15360]
C:\Documents and Settings\All Users\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
F-Secure Automatic Update.lnk - C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe [2006-10-31 16:53:14 32807]
Sonic CinePlayer Quick Launch.lnk - C:\Program Files\Common Files\Sonic Shared\CineTray.exe [2005-10-15 03:01:00 114688]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ckpNotify]
ckpNotify.dll 2005-03-01 20:49 24672 C:\WINDOWS\system32\ckpNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DPWLN ]
C:\WINDOWS\system32\DPWLEvHd.dll 2006-10-09 16:27 99856 C:\WINDOWS\system32\DPWLEvHd.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"vidc.yv12"= yv12vfw.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Service.exe"=
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_GUI.exe"=
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\scc.exe"=
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_SDS.exe"=
"C:\\Program Files\\CheckPoint\\SecuRemote\\bin\\SR_Diagnostics.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\Pelit\\Settlers3\\s3.exe"=
"C:\\Pelit\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Pelit\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9278:TCP"= 9278:TCP:BitComet 9278 TCP
"9278:UDP"= 9278:UDP:BitComet 9278 UDP
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-10-31 13:01]
R1 bbcap;bbcap;C:\WINDOWS\system32\DRIVERS\bbcap.sys [2007-06-24 23:03]
R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2006-10-31 16:53]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2005-08-19 16:37]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-10-06 17:30]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2005-08-19 16:37]
R2 Scap;SecureClient Application Policy Module;C:\WINDOWS\system32\DRIVERS\Scap.sys [2005-03-01 20:49]
R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2007-06-01 15:28]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2006-03-02 15:00]
R3 dpK0Bx01;Fingerprint Reader Filter Driver;C:\WINDOWS\system32\DRIVERS\dpK0Bx01.sys [2006-09-16 17:25]
R3 FW1;SecuRemote Miniport;C:\WINDOWS\system32\DRIVERS\fw.sys [2005-03-01 20:49]
R3 usbdpfp;Fingerprint Reader Class Driver;C:\WINDOWS\system32\DRIVERS\usbdpfp.sys [2006-09-16 17:23]
S0 stwlfbus;stwlfbus;C:\WINDOWS\system32\DRIVERS\stwlfbus.sys [2003-04-27 13:39]
S3 ggflt;SEMC USB Flash Driver Filter;C:\WINDOWS\system32\DRIVERS\ggflt.sys [2008-02-16 21:03]
S3 gsplittm;gsplittm;C:\DOCUME~1\Koppis\LOCALS~1\Temp\gsplittm.sys []
S3 OMVA;VPN-1 SecureClient Adapter;C:\WINDOWS\system32\DRIVERS\OMVA.sys [2005-03-01 20:49]
S3 st3wolf;st3wolf;C:\WINDOWS\system32\DRIVERS\st3wolf.sys [2003-04-27 12:43]
S3 w200bus;Sony Ericsson W200 driver (WDM);C:\WINDOWS\system32\DRIVERS\w200bus.sys [2006-11-07 10:42]
S3 w200mdfl;Sony Ericsson W200 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w200mdfl.sys [2006-11-07 10:42]
S3 w200mdm;Sony Ericsson W200 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w200mdm.sys [2006-11-07 10:42]
S3 w200mgmt;Sony Ericsson W200 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w200mgmt.sys [2006-11-07 10:42]
S3 w200obex;Sony Ericsson W200 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w200obex.sys [2006-11-07 10:42]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{86167224-b6ba-11dc-8548-0016350dc46d}]
\Shell\AutoRun\command - I:\PortableApps\PortableAppsMenu\PortableAppsMenu.exe
*Newly Created Service* - PGFILTER
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-05-30 14:17:09 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2007-02-13 14:00:42 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-12 14:46:58 C:\WINDOWS\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\F-Secure\ANTI-V~1\fsav.exeZ /HARD /ARCHIVE /DISINF /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-Secure\ANTI-V~1\report.txt
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-12 21:59:13
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-12 22:02:52
ComboFix-quarantined-files.txt 2008-06-12 19:02:48
ComboFix2.txt 2008-06-08 12:54:20
ComboFix3.txt 2008-06-03 17:12:28
ComboFix4.txt 2008-06-03 16:29:13
ComboFix5.txt 2008-05-29 11:02:29
Pre-Run: 7,503,593,472 tavua vapaana
Post-Run: 8,023,191,552 tavua vapaana
480 --- E O F --- 2008-06-11 15:04:34
|
|
Mainos
|
|
|
|
Hujo
Suspended permanently
|
13. kesäkuuta 2008 @ 00:26 |
Linkki tähän viestiin
|
Voiko tietsikka koskaan toimia?
|
|
