|
mese- virus + hjt logi
|
|
|
Camping
Junior Member
|
9. kesäkuuta 2008 @ 13:06 |
Linkki tähän viestiin
|
Logfile of HijackThis v1.99.1
Scan saved at 12:57:35, on 9.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
D:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
D:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
D:\Program Files\F-Secure\Anti-Virus\fssm32.exe
D:\Program Files\F-Secure\Common\FSMA32.EXE
D:\Program Files\F-Secure\Common\FSMB32.EXE
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\F-Secure\Common\FCH32.EXE
D:\Program Files\F-Secure\Anti-Virus\fsqh.exe
D:\Program Files\F-Secure\Common\FAMEH32.EXE
D:\Program Files\F-Secure\Anti-Virus\fsrw.exe
D:\Program Files\F-Secure\Common\FNRB32.EXE
D:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
D:\Program Files\F-Secure\Common\FIH32.EXE
D:\Program Files\F-Secure\Anti-Virus\fsav32.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\F-Secure\Common\FSM32.EXE
D:\Program Files\Analog Devices\SoundMAX\SMTray.exe
D:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
D:\WINDOWS\vsnpstd3.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\AutoEJCD.EXE
D:\Program Files\F-Secure\FSGUI\fsguidll.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
D:\Program Files\Skype\Phone\Skype.exe
D:\Program Files\DNA\btdna.exe
D:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe
D:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\ZyXEL Communications Corporation\ZyXEL G-220F Utility\ZyXEL_G-220F_GUI.exe
D:\WINDOWS\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe
D:\Program Files\OpenOffice.org 2.3\program\soffice.exe
D:\WINDOWS\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe
D:\WINDOWS\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe
D:\WINDOWS\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe
D:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
D:\Program Files\Skype\Plugin Manager\skypePM.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
D:\Documents and Settings\Isot\Työpöytä\HijackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [F-Secure Manager] "D:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [Smapp] D:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] D:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [StartCCC] "D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [F-Secure TNB] "D:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [snpstd3] D:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AutoEJCD_0ACE2011] D:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\AutoEJCD.EXE /VID=0ACE /PID=2011
O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [BitTorrent DNA] "D:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [DriverUpdaterPro] D:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe -t
O4 - Startup: OpenOffice.org 2.3.lnk = D:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Startup: RocketDock.lnk = D:\WINDOWS\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe
O4 - Startup: UberIcon.lnk = D:\WINDOWS\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = D:\WINDOWS\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe
O4 - Startup: Y'z Toolbar.lnk = D:\WINDOWS\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe
O4 - Global Startup: F-Secure Automatic Update.lnk = D:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O4 - Global Startup: ZyXEL G-220F Utility GUI.lnk = ?
O8 - Extra context menu item: &Block this popup - D:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - D:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - D:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: d:\program files\bonjour\mdnsnsp.dll
O10 - Unknown file in Winsock LSP: d:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\program files\f-secure\fsps\program\fslsp.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - D:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - D:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - D:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - D:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - D:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - D:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - D:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
Tässä olisi oma logini.
|
|
Hujo
Suspended permanently
|
9. kesäkuuta 2008 @ 18:07 |
Linkki tähän viestiin
|
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Voiko tietsikka koskaan toimia?
|
|
Camping
Junior Member
|
9. kesäkuuta 2008 @ 19:36 |
Linkki tähän viestiin
|
ComboFix 08-06-08.8 - Isot 2008-06-09 19:25:38.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.369 [GMT 3:00]
Running from: D:\Documents and Settings\Isot\Työpöytä\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-09 to 2008-06-09 )))))))))))))))))
.
2008-06-03 16:18 . 2008-06-03 16:18 <KANSIO> d-------- D:\Program Files\BitTorrent
2008-06-03 13:35 . 2008-06-03 13:35 <KANSIO> d-------- D:\Documents and Settings\Pienet\Application Data\BitDefender
2008-06-02 19:05 . 2008-06-02 19:05 <KANSIO> d-------- D:\Documents and Settings\Isot\Application Data\BitDefender
2008-06-02 19:04 . 2008-06-02 19:04 <KANSIO> d-------- D:\Program Files\BitDefender
2008-06-02 19:04 . 2008-06-02 19:05 <KANSIO> d-------- D:\Documents and Settings\All Users\Application Data\BitDefender
2008-06-02 19:02 . 2008-06-03 16:18 <KANSIO> d-------- D:\Program Files\Common Files\BitDefender
2008-05-29 21:07 . 2008-05-29 21:10 86,340 -r-hs---- D:\WINDOWS\WINUDSPM.0XE
2008-05-20 18:16 . 2008-05-20 18:16 <KANSIO> d-------- D:\Program Files\XPC Tools
2008-05-20 18:16 . 2008-05-20 18:16 <KANSIO> d--h----- D:\Documents and Settings\All Users\Application Data\{9784CF0C-B63B-4A60-A1B8-0D38CDF756EB}
2008-05-19 14:37 . 2008-05-19 14:37 <KANSIO> d-------- D:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-05-16 15:35 . 2008-05-16 15:35 <KANSIO> d-------- D:\Program Files\ZyXEL Communications Corporation
2008-05-16 15:35 . 2005-02-24 16:41 273,408 --a------ D:\WINDOWS\system32\drivers\ZD1211U.sys
2008-05-16 15:35 . 2004-01-14 11:25 81,920 --a------ D:\WINDOWS\system32\ZDPN50.dll
2008-05-16 15:35 . 2004-10-28 19:24 36,352 --a------ D:\WINDOWS\system32\uninst_Zyxel.exe
2008-05-16 15:35 . 2004-03-23 16:38 28,672 --a------ D:\WINDOWS\system32\InsDrvZD.dll
2008-05-16 15:35 . 2003-03-14 12:24 24,576 --a------ D:\WINDOWS\system32\ZyDelReg.exe
2008-05-16 15:35 . 2004-01-14 11:30 17,151 --a------ D:\WINDOWS\system32\ZDPNDIS5.sys
2008-05-16 15:34 . 2008-05-16 15:34 <KANSIO> d-------- D:\Program Files\AutoInstall
2008-05-12 14:11 . 2008-05-12 14:11 268 --ah----- D:\sqmdata02.sqm
2008-05-12 14:11 . 2008-05-12 14:11 244 --ah----- D:\sqmnoopt02.sqm
2008-05-11 09:46 . 2001-08-17 22:02 9,600 --a------ D:\WINDOWS\system32\drivers\hidusb.sys
2008-05-11 09:46 . 2001-08-17 22:02 9,600 --a--c--- D:\WINDOWS\system32\dllcache\hidusb.sys
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-09 16:28 --------- d-----w D:\Documents and Settings\Isot\Application Data\Skype
2008-06-09 16:22 --------- d-----w D:\Documents and Settings\Isot\Application Data\DNA
2008-06-09 13:02 --------- d-----w D:\Documents and Settings\Isot\Application Data\skypePM
2008-06-09 09:52 --------- d-----w D:\Documents and Settings\Isot\Application Data\OpenOffice.org2
2008-06-03 13:18 --------- d-----w D:\Documents and Settings\Isot\Application Data\BitTorrent
2008-05-16 12:35 --------- d--h--w D:\Program Files\InstallShield Installation Information
2008-04-29 11:42 --------- d-----w D:\Documents and Settings\Isot\Application Data\bang
2008-03-25 04:51 621,344 ----a-w D:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w D:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w D:\WINDOWS\system32\win32k.sys
2007-12-12 14:56 32 ----a-w D:\Documents and Settings\All Users\Application Data\ezsid.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-09-14 17:12 15360]
"MsnMsgr"="D:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"Skype"="D:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 16:08 21686568]
"BitTorrent DNA"="D:\Program Files\DNA\btdna.exe" [2008-05-08 14:22 289088]
"DriverUpdaterPro"="D:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe" [2008-05-19 20:08 2480164]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"F-Secure Manager"="D:\Program Files\F-Secure\Common\FSM32.exe" [2005-10-26 04:51 122929]
"Smapp"="D:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2003-01-31 17:49 98304]
"DrvLsnr"="D:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe" [2002-05-28 09:37 69632]
"StartCCC"="D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"F-Secure TNB"="D:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-06-14 19:32 132760]
"snpstd3"="D:\WINDOWS\vsnpstd3.exe" [2004-07-30 19:50 286720]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-09 01:31 185896]
"QuickTime Task"="D:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2008-02-04 15:18 267048]
"AutoEJCD_0ACE2011"="D:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\AutoEJCD.exe" [2004-08-11 19:02 40960]
"Windows UDP Control"="winudspm.exe" []
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\System32\CTFMON.EXE" [2004-09-14 17:12 15360]
D:\Documents and Settings\Isot\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
OpenOffice.org 2.3.lnk - D:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 23:57:56 393216]
RocketDock.lnk - D:\WINDOWS\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe [2006-05-14 23:47:48 344064]
UberIcon.lnk - D:\WINDOWS\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe [2006-02-05 15:20:14 180224]
Y'z Shadow.lnk - D:\WINDOWS\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe [2002-09-30 22:09:06 131072]
Y'z Toolbar.lnk - D:\WINDOWS\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe [2002-09-29 15:41:10 90112]
D:\Documents and Settings\All Users\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
F-Secure Automatic Update.lnk - D:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe [2007-12-03 20:59:14 32807]
ZyXEL G-220F Utility GUI.lnk - D:\Program Files\ZyXEL Communications Corporation\ZyXEL G-220F Utility\ZyXEL_G-220F_GUI.exe [2008-05-16 15:35:02 1318912]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
"D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"D:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"D:\\Program Files\\BitTorrent\\bittorrent.exe"=
"D:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\WINDOWS\\system32\\dpvsetup.exe"=
"D:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"D:\\Program Files\\Microsoft Games\\Age of Empires\\EMPIRESX.EXE"=
"D:\\Program Files\\Microsoft Games\\Age of Empires\\EMPIRES.EXE"=
"D:\\WINDOWS\\system32\\dplaysvr.exe"=
"D:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"D:\\Program Files\\iTunes\\iTunes.exe"=
"D:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"D:\\Program Files\\DNA\\btdna.exe"=
"C:\\Pelit\\liero\\LieroX v0.56 Pack 1.9\\LieroX.exe"=
"C:\\Pelit\\liero\\LieroX v0.56b Pack 1.7\\LieroX.exe"=
"C:\\Pelit\\aeo2\\AoE2\\empires2.exe"=
"C:\\Pelit\\aeo2\\AoE2\\age2_x1\\age2_x1.exe"=
"D:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"=
"D:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 FSFW;F-Secure Firewall Driver;D:\WINDOWS\system32\drivers\fsdfw.sys [2006-10-12 13:19]
R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;D:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2007-12-03 20:59]
R2 F-Secure Filter;F-Secure File System Filter;D:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2005-08-19 16:37]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;D:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-10-06 17:30]
R2 F-Secure Recognizer;F-Secure File System Recognizer;D:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2005-08-19 16:37]
S3 ZD1211U(ZyXEL);ZyXEL G-220F 802.11g Wireless USB Adapter Driver (USB)(ZyXEL);D:\WINDOWS\system32\DRIVERS\zd1211u.sys [2005-02-24 16:41]
*Newly Created Service* - CATCHME
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-03-20 21:27:02 D:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- D:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-09 19:27:56
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: D:\WINDOWS\explorer.exe
-> D:\WINDOWS\BricoPacks\Crystal Clear\UberIcon\UberIcon.dll
-> D:\WINDOWS\BricoPacks\Crystal Clear\RocketDock\MouseHook2.dll
.
Completion time: 2008-06-09 19:31:01
ComboFix-quarantined-files.txt 2008-06-09 16:29:56
Pre-Run: 59,150,647,296 tavua vapaana
Post-Run: 61,977,210,880 tavua vapaana
133 --- E O F --- 2008-06-03 13:24:59
|
|
Hujo
Suspended permanently
|
9. kesäkuuta 2008 @ 20:01 |
Linkki tähän viestiin
|
Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
Lainaus:
File::
D:\sqmdata02.sqm
D:\sqmnoopt02.sqm
D:\WINDOWS\winudspm.exe
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
=============
scannaa hjt:llä merkkaa paina Fix checked
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
=============
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.
Voiko tietsikka koskaan toimia?
|
|
Camping
Junior Member
|
9. kesäkuuta 2008 @ 20:08 |
Linkki tähän viestiin
|
ComboFix 08-06-08.8 - Isot 2008-06-09 20:04:23.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.370 [GMT 3:00]
Running from: D:\Documents and Settings\Isot\Työpöytä\ComboFix.exe
Command switches used :: D:\Documents and Settings\Isot\Työpöytä\CFScript.txt
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
D:\sqmdata02.sqm
D:\sqmnoopt02.sqm
D:\WINDOWS\winudspm.exe
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
D:\sqmdata02.sqm
D:\sqmnoopt02.sqm
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-09 to 2008-06-09 )))))))))))))))))
.
2008-06-03 16:18 . 2008-06-03 16:18 <KANSIO> d-------- D:\Program Files\BitTorrent
2008-06-03 13:35 . 2008-06-03 13:35 <KANSIO> d-------- D:\Documents and Settings\Pienet\Application Data\BitDefender
2008-06-02 19:05 . 2008-06-02 19:05 <KANSIO> d-------- D:\Documents and Settings\Isot\Application Data\BitDefender
2008-06-02 19:04 . 2008-06-02 19:04 <KANSIO> d-------- D:\Program Files\BitDefender
2008-06-02 19:04 . 2008-06-02 19:05 <KANSIO> d-------- D:\Documents and Settings\All Users\Application Data\BitDefender
2008-06-02 19:02 . 2008-06-03 16:18 <KANSIO> d-------- D:\Program Files\Common Files\BitDefender
2008-05-29 21:07 . 2008-05-29 21:10 86,340 -r-hs---- D:\WINDOWS\WINUDSPM.0XE
2008-05-20 18:16 . 2008-05-20 18:16 <KANSIO> d-------- D:\Program Files\XPC Tools
2008-05-20 18:16 . 2008-05-20 18:16 <KANSIO> d--h----- D:\Documents and Settings\All Users\Application Data\{9784CF0C-B63B-4A60-A1B8-0D38CDF756EB}
2008-05-19 14:37 . 2008-05-19 14:37 <KANSIO> d-------- D:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-05-16 15:35 . 2008-05-16 15:35 <KANSIO> d-------- D:\Program Files\ZyXEL Communications Corporation
2008-05-16 15:35 . 2005-02-24 16:41 273,408 --a------ D:\WINDOWS\system32\drivers\ZD1211U.sys
2008-05-16 15:35 . 2004-01-14 11:25 81,920 --a------ D:\WINDOWS\system32\ZDPN50.dll
2008-05-16 15:35 . 2004-10-28 19:24 36,352 --a------ D:\WINDOWS\system32\uninst_Zyxel.exe
2008-05-16 15:35 . 2004-03-23 16:38 28,672 --a------ D:\WINDOWS\system32\InsDrvZD.dll
2008-05-16 15:35 . 2003-03-14 12:24 24,576 --a------ D:\WINDOWS\system32\ZyDelReg.exe
2008-05-16 15:35 . 2004-01-14 11:30 17,151 --a------ D:\WINDOWS\system32\ZDPNDIS5.sys
2008-05-16 15:34 . 2008-05-16 15:34 <KANSIO> d-------- D:\Program Files\AutoInstall
2008-05-11 09:46 . 2001-08-17 22:02 9,600 --a------ D:\WINDOWS\system32\drivers\hidusb.sys
2008-05-11 09:46 . 2001-08-17 22:02 9,600 --a--c--- D:\WINDOWS\system32\dllcache\hidusb.sys
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-09 17:02 --------- d-----w D:\Documents and Settings\Isot\Application Data\DNA
2008-06-09 16:52 --------- d-----w D:\Documents and Settings\Isot\Application Data\Skype
2008-06-09 13:02 --------- d-----w D:\Documents and Settings\Isot\Application Data\skypePM
2008-06-09 09:52 --------- d-----w D:\Documents and Settings\Isot\Application Data\OpenOffice.org2
2008-06-03 13:18 --------- d-----w D:\Documents and Settings\Isot\Application Data\BitTorrent
2008-05-16 12:35 --------- d--h--w D:\Program Files\InstallShield Installation Information
2008-04-29 11:42 --------- d-----w D:\Documents and Settings\Isot\Application Data\bang
2008-03-25 04:51 621,344 ----a-w D:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w D:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w D:\WINDOWS\system32\win32k.sys
2007-12-12 14:56 32 ----a-w D:\Documents and Settings\All Users\Application Data\ezsid.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-09-14 17:12 15360]
"MsnMsgr"="D:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"Skype"="D:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 16:08 21686568]
"BitTorrent DNA"="D:\Program Files\DNA\btdna.exe" [2008-05-08 14:22 289088]
"DriverUpdaterPro"="D:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe" [2008-05-19 20:08 2480164]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"F-Secure Manager"="D:\Program Files\F-Secure\Common\FSM32.exe" [2005-10-26 04:51 122929]
"Smapp"="D:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2003-01-31 17:49 98304]
"DrvLsnr"="D:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe" [2002-05-28 09:37 69632]
"StartCCC"="D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"F-Secure TNB"="D:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-06-14 19:32 132760]
"snpstd3"="D:\WINDOWS\vsnpstd3.exe" [2004-07-30 19:50 286720]
"TkBellExe"="D:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-09 01:31 185896]
"QuickTime Task"="D:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2008-02-04 15:18 267048]
"AutoEJCD_0ACE2011"="D:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\AutoEJCD.exe" [2004-08-11 19:02 40960]
"Windows UDP Control"="winudspm.exe" []
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\System32\CTFMON.EXE" [2004-09-14 17:12 15360]
D:\Documents and Settings\Isot\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
OpenOffice.org 2.3.lnk - D:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 23:57:56 393216]
RocketDock.lnk - D:\WINDOWS\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe [2006-05-14 23:47:48 344064]
UberIcon.lnk - D:\WINDOWS\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe [2006-02-05 15:20:14 180224]
Y'z Shadow.lnk - D:\WINDOWS\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe [2002-09-30 22:09:06 131072]
Y'z Toolbar.lnk - D:\WINDOWS\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe [2002-09-29 15:41:10 90112]
D:\Documents and Settings\All Users\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
F-Secure Automatic Update.lnk - D:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe [2007-12-03 20:59:14 32807]
ZyXEL G-220F Utility GUI.lnk - D:\Program Files\ZyXEL Communications Corporation\ZyXEL G-220F Utility\ZyXEL_G-220F_GUI.exe [2008-05-16 15:35:02 1318912]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
"D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"D:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"D:\\Program Files\\BitTorrent\\bittorrent.exe"=
"D:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\WINDOWS\\system32\\dpvsetup.exe"=
"D:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"D:\\Program Files\\Microsoft Games\\Age of Empires\\EMPIRESX.EXE"=
"D:\\Program Files\\Microsoft Games\\Age of Empires\\EMPIRES.EXE"=
"D:\\WINDOWS\\system32\\dplaysvr.exe"=
"D:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"D:\\Program Files\\iTunes\\iTunes.exe"=
"D:\\Program Files\\The All-Seeing Eye\\eye.exe"=
"D:\\Program Files\\DNA\\btdna.exe"=
"C:\\Pelit\\liero\\LieroX v0.56 Pack 1.9\\LieroX.exe"=
"C:\\Pelit\\liero\\LieroX v0.56b Pack 1.7\\LieroX.exe"=
"C:\\Pelit\\aeo2\\AoE2\\empires2.exe"=
"C:\\Pelit\\aeo2\\AoE2\\age2_x1\\age2_x1.exe"=
"D:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"=
"D:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 FSFW;F-Secure Firewall Driver;D:\WINDOWS\system32\drivers\fsdfw.sys [2006-10-12 13:19]
R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;D:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2007-12-03 20:59]
R2 F-Secure Filter;F-Secure File System Filter;D:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2005-08-19 16:37]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;D:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-10-06 17:30]
R2 F-Secure Recognizer;F-Secure File System Recognizer;D:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2005-08-19 16:37]
S3 ZD1211U(ZyXEL);ZyXEL G-220F 802.11g Wireless USB Adapter Driver (USB)(ZyXEL);D:\WINDOWS\system32\DRIVERS\zd1211u.sys [2005-02-24 16:41]
*Newly Created Service* - CATCHME
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-03-20 21:27:02 D:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- D:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-09 20:05:19
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
Completion time: 2008-06-09 20:07:38
ComboFix-quarantined-files.txt 2008-06-09 17:06:34
ComboFix2.txt 2008-06-09 16:31:02
Pre-Run: 61,985,378,304 tavua vapaana
Post-Run: 61,975,904,256 tavua vapaana
137 --- E O F --- 2008-06-03 13:24:59
|
|
Camping
Junior Member
|
9. kesäkuuta 2008 @ 20:56 |
Linkki tähän viestiin
|
|
Malwarebytes' Anti-Malware 1.15
Tietokantaversio: 842
20:54:54 9.6.2008
mbam-log-6-9-2008 (20-54-54).txt
Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
Tarkistetut kohteet: 118649
Kulunut aika: 40 minute(s), 47 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 2
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
D:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\CuteCD.part01.exe (Rogue.Installer) -> Quarantined and deleted successfully.
D:\WINDOWS\WINUDSPM.0XE (Backdoor.Bot) -> Quarantined and deleted successfully.
|
|
Hujo
Suspended permanently
|
9. kesäkuuta 2008 @ 20:58 |
Linkki tähän viestiin
|
|
scannaa uusi hjt:n loki
Voiko tietsikka koskaan toimia?
|
|
Camping
Junior Member
|
9. kesäkuuta 2008 @ 21:00 |
Linkki tähän viestiin
|
Logfile of HijackThis v1.99.1
Scan saved at 20:59:46, on 9.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
D:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
D:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
D:\Program Files\F-Secure\Anti-Virus\fssm32.exe
D:\Program Files\F-Secure\Common\FSMA32.EXE
D:\Program Files\F-Secure\Common\FSMB32.EXE
D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\F-Secure\Common\FCH32.EXE
D:\Program Files\F-Secure\Anti-Virus\fsqh.exe
D:\Program Files\F-Secure\Common\FAMEH32.EXE
D:\Program Files\F-Secure\Anti-Virus\fsrw.exe
D:\Program Files\F-Secure\Common\FNRB32.EXE
D:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
D:\Program Files\F-Secure\Common\FIH32.EXE
D:\Program Files\F-Secure\Anti-Virus\fsav32.exe
D:\Program Files\F-Secure\Common\FSM32.EXE
D:\Program Files\Analog Devices\SoundMAX\SMTray.exe
D:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
D:\Program Files\Common Files\Real\Update_OB\realsched.exe
D:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\AutoEJCD.EXE
D:\Program Files\F-Secure\FSGUI\fsguidll.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
D:\Program Files\Skype\Phone\Skype.exe
D:\Program Files\DNA\btdna.exe
D:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe
D:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\ZyXEL Communications Corporation\ZyXEL G-220F Utility\ZyXEL_G-220F_GUI.exe
D:\WINDOWS\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe
D:\Program Files\OpenOffice.org 2.3\program\soffice.exe
D:\WINDOWS\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe
D:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
D:\Program Files\Skype\Plugin Manager\skypePM.exe
D:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
D:\Program Files\Windows Live\Messenger\usnsvc.exe
D:\WINDOWS\system32\notepad.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\WINDOWS\system32\notepad.exe
D:\WINDOWS\explorer.exe
D:\WINDOWS\system32\NOTEPAD.EXE
D:\WINDOWS\system32\NOTEPAD.EXE
D:\WINDOWS\system32\NOTEPAD.EXE
D:\Documents and Settings\Isot\Työpöytä\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [F-Secure Manager] "D:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [Smapp] D:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] D:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [StartCCC] "D:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [F-Secure TNB] "D:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [snpstd3] D:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AutoEJCD_0ACE2011] D:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\AutoEJCD.EXE /VID=0ACE /PID=2011
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [BitTorrent DNA] "D:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [DriverUpdaterPro] D:\Program Files\XPC Tools\Driver Updater Pro\DriverUpdaterPro.exe -t
O4 - Startup: OpenOffice.org 2.3.lnk = D:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Startup: RocketDock.lnk = D:\WINDOWS\BricoPacks\Crystal Clear\RocketDock\RocketDock.exe
O4 - Startup: UberIcon.lnk = D:\WINDOWS\BricoPacks\Crystal Clear\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = D:\WINDOWS\BricoPacks\Crystal Clear\YzShadow\YzShadow.exe
O4 - Startup: Y'z Toolbar.lnk = D:\WINDOWS\BricoPacks\Crystal Clear\YzToolbar\YzToolBar.exe
O4 - Global Startup: F-Secure Automatic Update.lnk = D:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O4 - Global Startup: ZyXEL G-220F Utility GUI.lnk = ?
O8 - Extra context menu item: &Block this popup - D:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - D:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - D:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: d:\program files\bonjour\mdnsnsp.dll
O10 - Unknown file in Winsock LSP: d:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: d:\program files\f-secure\fsps\program\fslsp.dll
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - D:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - D:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - D:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - D:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - D:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - D:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - D:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: FSMA - F-Secure Corporation - D:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - D:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
|
|
Hujo
Suspended permanently
|
9. kesäkuuta 2008 @ 21:29 |
Linkki tähän viestiin
|
|
scannaa hjt:llä merkkaa paina Fix checked
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AutoEJCD_0ACE2011] D:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\AutoEJCD.EXE /VID=0ACE /PID=2011
==========
mites kone tökkii
Voiko tietsikka koskaan toimia?
|
|
Camping
Junior Member
|
9. kesäkuuta 2008 @ 21:35 |
Linkki tähän viestiin
|
|
Kiitoksia paljon tähän astisista neuvoista. Ei kone töki mitenkää, eli toimii iha normaalisti niinku ennenki, toisinaan tosin ihmeellistä sekoilua joka saattaa johtua viruksesta, mikä ois seuraava vaihe? Vai pitäisikö nyt olla puhdas?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 9. kesäkuuta 2008 @ 21:39
|
|
Hujo
Suspended permanently
|
9. kesäkuuta 2008 @ 21:49 |
Linkki tähän viestiin
|
Voiko tietsikka koskaan toimia?
|
|
Camping
Junior Member
|
10. kesäkuuta 2008 @ 13:08 |
Linkki tähän viestiin
|
|
Tue Jun 10 13:00:58 2008 => Scanning Folder: D:\WINDOWS\WinSxS\x86_Microsoft.Tools.VisualCPlusPlus.Runtime-Libraries_6595b64144ccf1df_6.0.9792.0_x-ww_08a6620a\*.*
Tue Jun 10 13:00:58 2008 => Scanning Folder: D:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841\*.*
Tue Jun 10 13:00:58 2008 => Scanning Folder: D:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.1433_x-ww_5cf844d2\*.*
Tue Jun 10 13:00:59 2008 => Scanning Folder: D:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\*.*
Tue Jun 10 13:00:59 2008 => Scanning Folder: D:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\*.*
Tue Jun 10 13:00:59 2008 => Scanning Folder: D:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\*.*
Tue Jun 10 13:01:00 2008 => Scanning Folder: D:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\*.*
Tue Jun 10 13:01:00 2008 => Scanning Folder: D:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\*.*
Tue Jun 10 13:01:01 2008 => Scanning Folder: D:\WINDOWS\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0ee63867\*.*
Tue Jun 10 13:01:01 2008 => Scanning Folder: D:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\*.*
Tue Jun 10 13:01:01 2008 => Scanning Folder: D:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\*.*
Tue Jun 10 13:01:01 2008 => Scanning Folder: D:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\*.*
Tue Jun 10 13:01:01 2008 => Scanning Folder: D:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.0.0_x-ww_2726e76a\*.*
Tue Jun 10 13:01:01 2008 => Scanning Folder: D:\WINDOWS\WinSxS\x86_Microsoft.Windows.CPlusPlusRuntime_6595b64144ccf1df_7.0.2600.2180_x-ww_b2505ed9\*.*
Tue Jun 10 13:01:01 2008 => Scanning Folder: D:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.0.0_x-ww_8d353f13\*.*
Tue Jun 10 13:01:01 2008 => Scanning Folder: D:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\*.*
Tue Jun 10 13:01:01 2008 => Scanning Folder: D:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.Dxmrtp_6595b64144ccf1df_5.2.2.3_x-ww_468466a7\*.*
Tue Jun 10 13:01:02 2008 => Scanning Folder: D:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcDll_6595b64144ccf1df_5.2.2.3_x-ww_d6bd8b95\*.*
Tue Jun 10 13:01:02 2008 => Scanning Folder: D:\WINDOWS\WinSxS\x86_Microsoft.Windows.Networking.RtcRes_6595b64144ccf1df_5.2.2.3_fi_7def5406\*.*
Tue Jun 10 13:01:02 2008 => Scanning Folder: D:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\*.*
Tue Jun 10 13:01:02 2008 => ***** Checking for specific ITW Viruses *****
Tue Jun 10 13:01:02 2008 => Checking for Welchia Virus...
Tue Jun 10 13:01:02 2008 => Checking for LovGate Virus...
Tue Jun 10 13:01:02 2008 => Checking for CodeRed Virus...
Tue Jun 10 13:01:02 2008 => Checking for OpaServ Virus...
Tue Jun 10 13:01:02 2008 => Checking for Sobig.e Virus...
Tue Jun 10 13:01:02 2008 => Checking for Winupie Virus...
Tue Jun 10 13:01:02 2008 => Checking for Swen Virus...
Tue Jun 10 13:01:02 2008 => Checking for JS.Fortnight Virus...
Tue Jun 10 13:01:02 2008 => Checking for Novarg Virus...
Tue Jun 10 13:01:02 2008 => Checking for Pagabot Virus...
Tue Jun 10 13:01:02 2008 => Checking for Parite.b Virus...
Tue Jun 10 13:01:02 2008 => Checking for Parite.a Virus...
Tue Jun 10 13:01:02 2008 => ***** Scanning complete. *****
Tue Jun 10 13:01:02 2008 => Total Number of Files Scanned: 83562
Tue Jun 10 13:01:02 2008 => Total Number of Virus(es) Found: 1
Tue Jun 10 13:01:02 2008 => Total Number of Disinfected Files: 0
Tue Jun 10 13:01:02 2008 => Total Number of Files Renamed: 1
Tue Jun 10 13:01:02 2008 => Total Number of Deleted Files: 0
Tue Jun 10 13:01:02 2008 => Total Number of Errors: 808
Tue Jun 10 13:01:02 2008 => Time Elapsed: 01:27:01
Tue Jun 10 13:01:02 2008 => Virus Database Date: 2008/06/10
Tue Jun 10 13:01:02 2008 => Virus Database Count: 845582
Tue Jun 10 13:01:02 2008 => Scan Completed.
|
|
Camping
Junior Member
|
10. kesäkuuta 2008 @ 13:12 |
Linkki tähän viestiin
|
File D:\Documents and Settings\Isot\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Quarantine\QUAR1.54499 infected by "Backdoor.Win32.IRCBot.dgj" Virus. Action Taken: File Renamed.
|
|
Hujo
Suspended permanently
|
10. kesäkuuta 2008 @ 13:13 |
Linkki tähän viestiin
|
|
yksi virus löyty ja se nimetty uudelleen sekin näämmä tuolla
Malwarebytes' Anti-Malware\Quarantine
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 10. kesäkuuta 2008 @ 13:15
|
|
Camping
Junior Member
|
10. kesäkuuta 2008 @ 13:15 |
Linkki tähän viestiin
|
|
Eli pitääks mun vielä tehä jotai? Ton scannauksen aikana f-secure ilmotti viruksesta(sama virus jonka toi ohjelma löys mielestäni)ja pyys poistaan, mutta riittääkö, että poistin sen f-securella vai pitääkö tuhota viel jollai muulla ohjelmalla? Kiitos tähän astisista neuvoista. :)
|
|
Hujo
Suspended permanently
|
10. kesäkuuta 2008 @ 13:25 |
Linkki tähän viestiin
|
|
poista ne kaikki sieltä deletoi
tyhjää roskis
siis tuolta
Malwarebytes' Anti-Malware\Quarantine
:D
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 10. kesäkuuta 2008 @ 13:26
|
|
Camping
Junior Member
|
10. kesäkuuta 2008 @ 13:27 |
Linkki tähän viestiin
|
|
nyt meni hiukan ohi, eli mistä ohjelmasta oli nyt kyse?
|
|
Camping
Junior Member
|
10. kesäkuuta 2008 @ 13:38 |
Linkki tähän viestiin
|
|
aivan :), pääsin tohon isoihin saakka mut tota application dataa ei löytyny, ilmeisesti f-secure poisti jo sen?
|
|
Hujo
Suspended permanently
|
10. kesäkuuta 2008 @ 13:54 |
Linkki tähän viestiin
|
|
täytyy vissin olla noi piilotiedostot näkyvissä
* Klikkaa Käynnistä.
* Avaa Oma Tietokone.
* Valitse Työkalut ylämenusta ja klikkaa Kansion asetukset.
* Valitse Näytä välilehti.
* Piilotiedostot/kansiot kohdalla valitse Näytä piilotetut tiedostot ja kansiot.
* Poista rasti ruudusta -> Piilota suojatut käyttöjärjestelmätiedostot
* Klikkaa Kyllä varmistaaksesi muutokset.
* Klikkaa OK.
Voiko tietsikka koskaan toimia?
|
|
Camping
Junior Member
|
10. kesäkuuta 2008 @ 13:57 |
Linkki tähän viestiin
|
|
Eli poistanko kokonaan ton malwarebytes kansion?
|
|
Hujo
Suspended permanently
|
10. kesäkuuta 2008 @ 14:06 |
Linkki tähän viestiin
|
|
älä nyt hyvää ohjelmaa mene poistamaan
vaan avat sen ja menet sen karanteeniin ja deletoit sieltä kaikki
Voiko tietsikka koskaan toimia?
|
|
Camping
Junior Member
|
10. kesäkuuta 2008 @ 14:08 |
Linkki tähän viestiin
|
|
tuol oli yks tommone tiedostono karanteenikansios et jos poistaa ni sit jotku sovellukset tms. ei välttämättä toimi, se on tommosena haaleenpana ku noi muut. tuhoonko senki?
|
|
Hujo
Suspended permanently
|
10. kesäkuuta 2008 @ 14:13 |
Linkki tähän viestiin
|
|
älä tuhoo.....
laitas tänne mikä se on
===============
Laitas noi piilotiedostot pois näkyvistä
Muuten tulee tuhoo
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 10. kesäkuuta 2008 @ 14:16
|
|
Camping
Junior Member
|
10. kesäkuuta 2008 @ 14:15 |
Linkki tähän viestiin
|
|
QUAR1.54499.mwt
MWT-tiedosto
85kt
|
|
Mainos
|
|
|
|
Hujo
Suspended permanently
|
10. kesäkuuta 2008 @ 14:23 |
Linkki tähän viestiin
|
|
annetaas tuon olla ihan rauhassa.
Voiko tietsikka koskaan toimia?
|
