|
Mulla on ilmeisesti virus? Hjt-logi ohessa.
|
|
|
Camping
Junior Member
|
10. kesäkuuta 2008 @ 15:03 |
Linkki tähän viestiin
|
Logfile of HijackThis v1.99.1
Scan saved at 14:59:22, on 10.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Lexmark 5200 series\lxbtbmon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\AutoEJCD.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\F-Secure\ANTI-S~2\fsaw.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\Documents and Settings\Joonatan\Työpöytä\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: (no name) - {487C9905-26A8-42C8-8033-C58AD3D2AEC3} - C:\WINDOWS\system32\tuvsTnOF.dll (file missing)
O2 - BHO: (no name) - {6086228E-0E8B-44D3-B224-C94444BEE5DA} - C:\WINDOWS\system32\awtrSlif.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: {628c255d-e50a-4f58-51c4-0e93b610512a} - {a215016b-39e0-4c15-85f4-a05ed552c826} - C:\WINDOWS\system32\yfubigwi.dll
O2 - BHO: (no name) - {A3351B32-CA51-4EEE-988B-90B40F44BBD5} - C:\WINDOWS\system32\khfCuVmJ.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Lexmark 5200 series] "C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe"
O4 - HKLM\..\Run: [LXBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AutoEJCD_0ACE2011] C:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\AutoEJCD.EXE /VID=0ACE /PID=2011
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
O4 - HKLM\..\Run: [Windows svchost] service.exe
O4 - HKLM\..\Run: [f8230906] rundll32.exe "C:\WINDOWS\system32\pbmloetg.dll",b
O4 - HKLM\..\Run: [BMfb103a9a] Rundll32.exe "C:\WINDOWS\system32\otmnorwy.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: tuvsTnOF - tuvsTnOF.dll (file missing)
O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: lxbt_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbtcoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
Toisen koneen sain putsattua täällä, mutta nyt olisi tämä toinenkin, jos joku vielä haluaisi auttaa niin olisin ruton kiitollinen :)
|
|
Hujo
Suspended permanently
|
12. kesäkuuta 2008 @ 01:52 |
Linkki tähän viestiin
|
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
============
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 12. kesäkuuta 2008 @ 01:53
|
|
Camping
Junior Member
|
12. kesäkuuta 2008 @ 14:37 |
Linkki tähän viestiin
|
ComboFix 08-06-10.5 - Joonatan 2008-06-12 14:09:25.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.104 [GMT 3:00]
Running from: C:\Documents and Settings\Joonatan\Työpöytä\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\BMfb103a9a.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\awqgcpnu.ini
C:\WINDOWS\system32\filSrtwa.ini
C:\WINDOWS\system32\filSrtwa.ini2
C:\WINDOWS\system32\goxqctbd.exe
C:\WINDOWS\system32\grrbycbh.ini
C:\WINDOWS\system32\gteolmbp.ini
C:\WINDOWS\system32\JmVuCfhk.ini
C:\WINDOWS\system32\JmVuCfhk.ini2
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\plwswsbh.ini
C:\WINDOWS\system32\sahrdben.exe
C:\WINDOWS\system32\xpachedw.exe
.
((((( Tiedostot, jotka on luotu seuraavalla aikav?lill?: 2008-05-12 to 2008-06-12 )))))))))))))))))
.
2008-06-09 12:05 . 2008-06-09 12:05 100,864 --------- C:\WINDOWS\system32\OTMNORWY.0LL
2008-06-06 21:37 . 2008-06-06 21:55 <KANSIO> d-------- C:\vmonde
2008-06-06 20:41 . 2008-06-06 20:41 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-06-06 20:40 . 2008-06-06 20:40 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-06 20:32 . 2008-06-06 20:32 100,864 --a------ C:\WINDOWS\system32\fihyiuap.dll
2008-06-06 20:31 . 2008-06-06 20:32 347,136 --a------ C:\WINDOWS\system32\KHFCUVMJ.0LL
2008-06-01 18:42 . 2008-06-01 18:42 373,248 --a------ C:\WINDOWS\system32\AWTRSLIF.0LL
2008-06-01 18:37 . 2008-06-01 18:37 57,344 --a------ C:\WINDOWS\system32\tuvsTnOF.dll.bak
2008-05-26 20:48 . 2008-05-26 20:48 268 --ah----- C:\sqmdata11.sqm
2008-05-26 20:48 . 2008-05-26 20:48 244 --ah----- C:\sqmnoopt11.sqm
2008-05-16 16:23 . 2005-02-24 16:41 273,408 --a------ C:\WINDOWS\system32\drivers\ZD1211U.sys
2008-05-16 16:23 . 2004-01-14 11:25 81,920 --a------ C:\WINDOWS\system32\ZDPN50.dll
2008-05-16 16:23 . 2004-10-28 19:24 36,352 --a------ C:\WINDOWS\system32\uninst_Zyxel.exe
2008-05-16 16:23 . 2004-03-23 16:38 28,672 --a------ C:\WINDOWS\system32\InsDrvZD.dll
2008-05-16 16:23 . 2003-03-14 12:24 24,576 --a------ C:\WINDOWS\system32\ZyDelReg.exe
2008-05-16 16:23 . 2004-01-14 11:30 17,151 --a------ C:\WINDOWS\system32\ZDPNDIS5.sys
2008-05-16 16:22 . 2008-05-16 16:22 <KANSIO> d-------- C:\Program Files\AutoInstall
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-12 11:03 --------- d-----w C:\Documents and Settings\Joonatan\Application Data\OpenOffice.org2
2008-06-06 17:41 --------- d-----w C:\Program Files\Lavasoft
2008-06-02 16:14 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-06-02 07:24 --------- d-----w C:\Program Files\Lx_cats
2008-05-21 17:58 --------- d-----w C:\Program Files\Pesonen3
2008-05-17 08:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-01 15:37 --------- d-----w C:\Documents and Settings\Joonatan\Application Data\bang
2008-04-23 11:05 --------- d-----w C:\Program Files\Winamp
2008-02-28 18:07 32 ----a-r C:\Documents and Settings\All Users\hash.dat
.
(((((((((((((((((((((((((((((( Rekisterin k?ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji? arvoja ja laillisia oletusarvoja ei n?ytet?
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6086228E-0E8B-44D3-B224-C94444BEE5DA}]
C:\WINDOWS\system32\awtrSlif.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a215016b-39e0-4c15-85f4-a05ed552c826}]
C:\WINDOWS\system32\yfubigwi.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3351B32-CA51-4EEE-988B-90B40F44BBD5}]
C:\WINDOWS\system32\khfCuVmJ.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 16:12 15360]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2005-11-30 16:56 1306624]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"SoundMan"="SOUNDMAN.EXE" [2006-03-02 07:22 577536 C:\WINDOWS\soundman.exe]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-21 20:14 35328]
"Lexmark 5200 series"="C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe" [2004-06-04 12:58 57344]
"LXBTCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll" [2004-03-17 19:30 65536]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 17:57 133016]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 21:43 7630848]
"nwiz"="nwiz.exe" [2006-08-11 21:43 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 21:43 86016]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2005-12-13 08:49 217088]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2005-10-26 04:51 122929]
"F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"AutoEJCD_0ACE2011"="C:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\AutoEJCD.exe" [2004-08-11 19:02 40960]
"Windows UDP Control"="winudspm.exe" []
"Windows svchost"="service.exe" []
"f8230906"="C:\WINDOWS\system32\pbmloetg.dll" [ ]
"BMfb103a9a"="C:\WINDOWS\system32\otmnorwy.dll" [ ]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-14 16:12 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvsTnOF]
tuvsTnOF.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires\\EMPIRESX.EXE"=
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2006-10-12 13:19]
R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2007-06-21 23:12]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2005-08-19 16:37]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-10-06 17:30]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2005-08-19 16:37]
R3 ZD1211U(ZyXEL);ZyXEL G-220F 802.11g Wireless USB Adapter Driver (USB)(ZyXEL);C:\WINDOWS\system32\DRIVERS\zd1211u.sys [2005-02-24 16:41]
S3 cel90xbe;cel90xbe;C:\DOCUME~1\Joonatan\LOCALS~1\Temp\cel90xbe.sys []
.
'Ajoitetut teht?v?t'-kansion sis?lt?
"2008-05-19 05:48:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-12 14:20:37
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32.exe
C:\Program Files\F-Secure\common\FSMA32.EXE
C:\Program Files\F-Secure\common\FSMB32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\F-Secure\common\FCH32.EXE
C:\Program Files\F-Secure\common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Anti-Virus\FSRW.exe
C:\Program Files\F-Secure\common\FNRB32.exe
C:\Program Files\F-Secure\FWES\program\fsdfwd.exe
C:\Program Files\F-Secure\common\FIH32.exe
C:\Program Files\Lexmark 5200 Series\lxbtbmon.exe
C:\Program Files\F-Secure\Anti-Virus\FSAV32.exe
C:\PROGRA~1\F-Secure\ANTI-S~2\FSAW.exe
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.bin
.
**************************************************************************
.
Completion time: 2008-06-12 14:34:12 - machine was rebooted [Joonatan]
ComboFix-quarantined-files.txt 2008-06-12 11:32:42
Pre-Run: 7,756,349,440 tavua vapaana
Post-Run: 9,546,940,416 tavua vapaana
158 --- E O F --- 2008-05-17 19:57:16
|
|
Hujo
Suspended permanently
|
12. kesäkuuta 2008 @ 14:58 |
Linkki tähän viestiin
|
Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
Lainaus:
File::
C:\WINDOWS\system32\tuvsTnOF.dll
C:\WINDOWS\system32\awtrSlif.dll
C:\WINDOWS\system32\yfubigwi.dll
C:\WINDOWS\system32\khfCuVmJ.dll
C:\WINDOWS\winudspm.exe
C:\WINDOWS\service.exe
C:\WINDOWS\system32\pbmloetg.dll
C:\WINDOWS\system32\otmnorwy.dll
C:\WINDOWS\system32\OTMNORWY.0LL
C:\WINDOWS\system32\KHFCUVMJ.0LL
C:\WINDOWS\system32\AWTRSLIF.0LL
C:\sqmdata11.sqm
C:\sqmnoopt11.sqm
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
=============
scannaa hjt:llä merkkaa paina Fix checked
O2 - BHO: (no name) - {487C9905-26A8-42C8-8033-C58AD3D2AEC3} - C:\WINDOWS\system32\tuvsTnOF.dll (file missing)
O2 - BHO: (no name) - {6086228E-0E8B-44D3-B224-C94444BEE5DA} - C:\WINDOWS\system32\awtrSlif.dll (file missing)
O2 - BHO: {628c255d-e50a-4f58-51c4-0e93b610512a} - {a215016b-39e0-4c15-85f4-a05ed552c826} - C:\WINDOWS\system32\yfubigwi.dll
O2 - BHO: (no name) - {A3351B32-CA51-4EEE-988B-90B40F44BBD5} - C:\WINDOWS\system32\khfCuVmJ.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
O4 - HKLM\..\Run: [Windows svchost] service.exe
O4 - HKLM\..\Run: [f8230906] rundll32.exe "C:\WINDOWS\system32\pbmloetg.dll",b
O4 - HKLM\..\Run: [BMfb103a9a] Rundll32.exe "C:\WINDOWS\system32\otmnorwy.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O20 - Winlogon Notify: tuvsTnOF - tuvsTnOF.dll (file missing)
O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
================
aja Malwarebytes' Anti-Malware
Voiko tietsikka koskaan toimia?
|
|
Camping
Junior Member
|
12. kesäkuuta 2008 @ 17:06 |
Linkki tähän viestiin
|
|
Malwarebytes' Anti-Malware 1.17
Tietokantaversio: 849
17:05:06 12.6.2008
mbam-log-6-12-2008 (17-05-06).txt
Tarkistustyyppi: Täysi tarkistus (C:\|D:\|G:\|)
Tarkistetut kohteet: 155129
Kulunut aika: 2 hour(s), 21 minute(s), 34 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 3
Saastuneita rekisteriarvoja: 4
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 14
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
Saastuneita rekisteriarvoja:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows UDP Control (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows svchost (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f8230906 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BMfb103a9a (Trojan.Agent) -> Quarantined and deleted successfully.
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
C:\QooBox\Quarantine\C\WINDOWS\system32\goxqctbd.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\sahrdben.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\xpachedw.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{2BC4FED2-B6D2-4815-A02A-1DD1976B01EE}\RP385\A0120558.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{2BC4FED2-B6D2-4815-A02A-1DD1976B01EE}\RP388\A0123689.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{2BC4FED2-B6D2-4815-A02A-1DD1976B01EE}\RP389\A0123696.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{2BC4FED2-B6D2-4815-A02A-1DD1976B01EE}\RP389\A0124682.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{2BC4FED2-B6D2-4815-A02A-1DD1976B01EE}\RP392\A0124882.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{2BC4FED2-B6D2-4815-A02A-1DD1976B01EE}\RP392\A0124883.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{2BC4FED2-B6D2-4815-A02A-1DD1976B01EE}\RP392\A0124884.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\AWTRSLIF.0LL (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tuvsTnOF.dll.bak (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jonski\Local Settings\Temp\opr40.tmp (Heuristics.Malware) -> Quarantined and deleted successfully.
|
|
Hujo
Suspended permanently
|
12. kesäkuuta 2008 @ 17:16 |
Linkki tähän viestiin
|
|
1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
2. Valitse ominaisuudet
3. Valitse järjestelmän palauttaminen välilehti
4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä
6. Paina ok
7. Sammuta ja käynnistä
8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
9. Käytä ja OK
Voiko tietsikka koskaan toimia?
|
|
Camping
Junior Member
|
12. kesäkuuta 2008 @ 17:20 |
Linkki tähän viestiin
|
ComboFix 08-06-10.5 - Joonatan 2008-06-12 17:09:23.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.93 [GMT 3:00]
Running from: C:\Documents and Settings\Joonatan\Työpöytä\ComboFix.exe
Command switches used :: C:\Documents and Settings\Joonatan\Työpöytä\CFScript.txt
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\sqmdata11.sqm
C:\sqmnoopt11.sqm
C:\WINDOWS\service.exe
C:\WINDOWS\system32\AWTRSLIF.0LL
C:\WINDOWS\system32\awtrSlif.dll
C:\WINDOWS\system32\KHFCUVMJ.0LL
C:\WINDOWS\system32\khfCuVmJ.dll
C:\WINDOWS\system32\OTMNORWY.0LL
C:\WINDOWS\system32\otmnorwy.dll
C:\WINDOWS\system32\pbmloetg.dll
C:\WINDOWS\system32\tuvsTnOF.dll
C:\WINDOWS\system32\yfubigwi.dll
C:\WINDOWS\winudspm.exe
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\sqmdata11.sqm
C:\sqmnoopt11.sqm
C:\WINDOWS\system32\KHFCUVMJ.0LL
C:\WINDOWS\system32\OTMNORWY.0LL
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-12 to 2008-06-12 )))))))))))))))))
.
2008-06-12 14:42 . 2008-06-12 14:42 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-12 14:42 . 2008-06-12 14:42 <KANSIO> d-------- C:\Documents and Settings\Joonatan\Application Data\Malwarebytes
2008-06-12 14:42 . 2008-06-12 14:42 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-06-12 14:42 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-12 14:42 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-12 14:32 . 2008-06-12 14:32 <KANSIO> d-------- C:\WINDOWS\LastGood
2008-06-06 21:37 . 2008-06-06 21:55 <KANSIO> d-------- C:\vmonde
2008-06-06 20:41 . 2008-06-06 20:41 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-06-06 20:40 . 2008-06-06 20:40 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-16 16:23 . 2005-02-24 16:41 273,408 --a------ C:\WINDOWS\system32\drivers\ZD1211U.sys
2008-05-16 16:23 . 2004-01-14 11:25 81,920 --a------ C:\WINDOWS\system32\ZDPN50.dll
2008-05-16 16:23 . 2004-10-28 19:24 36,352 --a------ C:\WINDOWS\system32\uninst_Zyxel.exe
2008-05-16 16:23 . 2004-03-23 16:38 28,672 --a------ C:\WINDOWS\system32\InsDrvZD.dll
2008-05-16 16:23 . 2003-03-14 12:24 24,576 --a------ C:\WINDOWS\system32\ZyDelReg.exe
2008-05-16 16:23 . 2004-01-14 11:30 17,151 --a------ C:\WINDOWS\system32\ZDPNDIS5.sys
2008-05-16 16:22 . 2008-05-16 16:22 <KANSIO> d-------- C:\Program Files\AutoInstall
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-12 11:23 --------- d-----w C:\Documents and Settings\Joonatan\Application Data\OpenOffice.org2
2008-06-06 17:41 --------- d-----w C:\Program Files\Lavasoft
2008-06-02 16:14 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-06-02 07:24 --------- d-----w C:\Program Files\Lx_cats
2008-05-21 17:58 --------- d-----w C:\Program Files\Pesonen3
2008-05-17 08:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-01 15:37 --------- d-----w C:\Documents and Settings\Joonatan\Application Data\bang
2008-04-23 11:05 --------- d-----w C:\Program Files\Winamp
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-02-28 18:07 32 ----a-r C:\Documents and Settings\All Users\hash.dat
.
((((((((((((((((((((((((((((( snapshot@2008-06-12_14.31.49.14 )))))))))))))))))))))))))))))))))))))))))
.
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6086228E-0E8B-44D3-B224-C94444BEE5DA}]
C:\WINDOWS\system32\awtrSlif.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a215016b-39e0-4c15-85f4-a05ed552c826}]
C:\WINDOWS\system32\yfubigwi.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3351B32-CA51-4EEE-988B-90B40F44BBD5}]
C:\WINDOWS\system32\khfCuVmJ.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 16:12 15360]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2005-11-30 16:56 1306624]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"SoundMan"="SOUNDMAN.EXE" [2006-03-02 07:22 577536 C:\WINDOWS\soundman.exe]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-21 20:14 35328]
"Lexmark 5200 series"="C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe" [2004-06-04 12:58 57344]
"LXBTCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll" [2004-03-17 19:30 65536]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 17:57 133016]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-11 21:43 7630848]
"nwiz"="nwiz.exe" [2006-08-11 21:43 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-11 21:43 86016]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2005-12-13 08:49 217088]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2005-10-26 04:51 122929]
"F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"AutoEJCD_0ACE2011"="C:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\AutoEJCD.exe" [2004-08-11 19:02 40960]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-14 16:12 15360]
C:\Documents and Settings\Joonatan\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe [2005-10-15 02:02:32 61440]
C:\Documents and Settings\All Users.WINDOWS\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
F-Secure Automatic Update.lnk - C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe [2007-06-21 23:12:00 32807]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvsTnOF]
tuvsTnOF.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires\\EMPIRESX.EXE"=
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2006-10-12 13:19]
R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2007-06-21 23:12]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2005-08-19 16:37]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-10-06 17:30]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2005-08-19 16:37]
R3 ZD1211U(ZyXEL);ZyXEL G-220F 802.11g Wireless USB Adapter Driver (USB)(ZyXEL);C:\WINDOWS\system32\DRIVERS\zd1211u.sys [2005-02-24 16:41]
S3 cel90xbe;cel90xbe;C:\DOCUME~1\Joonatan\LOCALS~1\Temp\cel90xbe.sys []
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-05-19 05:48:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-12 17:13:02
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-12 17:19:14
ComboFix-quarantined-files.txt 2008-06-12 14:18:51
ComboFix2.txt 2008-06-12 11:34:18
Pre-Run: 9,900,347,392 tavua vapaana
Post-Run: 9,887,629,312 tavua vapaana
142 --- E O F --- 2008-05-17 19:57:16
|
|
Camping
Junior Member
|
12. kesäkuuta 2008 @ 17:25 |
Linkki tähän viestiin
|
|
Kiitoksia neuvoista, ajoin tuon malwaren kerran. Pitääkös se ajaa taas, kun niin sanoit/annoit neuvon. Kun poistin hjt:llä noita antamasia tiedostoja niin kaikkia ei löytynyt, ilmeisesti ne oli jo poistettu?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 12. kesäkuuta 2008 @ 17:28
|
|
Hujo
Suspended permanently
|
12. kesäkuuta 2008 @ 17:34 |
Linkki tähän viestiin
|
|
juu aja tuo Malwarebytes' Anti-Malware uudelleen
ja laita viimisenä uusi hjt:n loki
===============
etsi tuo C:\vmonde
katso siintä ominaisuudet ja mikä versio
mikä firma
Voiko tietsikka koskaan toimia?
|
|
Camping
Junior Member
|
12. kesäkuuta 2008 @ 17:38 |
Linkki tähän viestiin
|
|
versio: 1.0.4.0
firma: Copyright © 2008 F-Secure Corporation
Teenkö tuon järjestelmänpalautusjutun ennen malwaren pyöritystä?
|
|
Hujo
Suspended permanently
|
12. kesäkuuta 2008 @ 17:55 |
Linkki tähän viestiin
|
|
juu ensin järjestelmän palautus juttuu
sitten malwaren pyöritystä
Voiko tietsikka koskaan toimia?
|
|
Camping
Junior Member
|
12. kesäkuuta 2008 @ 22:12 |
Linkki tähän viestiin
|
|
Malwarebytes' Anti-Malware 1.17
Tietokantaversio: 849
22:11:59 12.6.2008
mbam-log-6-12-2008 (22-11-59).txt
Tarkistustyyppi: Täysi tarkistus (C:\|D:\|G:\|)
Tarkistetut kohteet: 150515
Kulunut aika: 2 hour(s), 12 minute(s), 13 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)
Nyt taitaa olla kone puhas?
|
|
Hujo
Suspended permanently
|
13. kesäkuuta 2008 @ 00:27 |
Linkki tähän viestiin
|
|
scannaa uusi hjt:n loki
Voiko tietsikka koskaan toimia?
|
|
Camping
Junior Member
|
13. kesäkuuta 2008 @ 11:47 |
Linkki tähän viestiin
|
Logfile of HijackThis v1.99.1
Scan saved at 11:44:00, on 13.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Lexmark 5200 series\lxbtbmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\AutoEJCD.EXE
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\PROGRA~1\COMMON~1\PCSuite\Services\SERVIC~1.EXE
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\PROGRA~1\F-Secure\ANTI-S~2\fsaw.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\WINDOWS\system32\wuauclt.exe
D:\pelit\sims2\TSBin\Sims2.exe
C:\DOCUME~1\Joonatan\LOCALS~1\Temp\~e5.0001
C:\Documents and Settings\Joonatan\Työpöytä\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Lexmark 5200 series] "C:\Program Files\Lexmark 5200 series\lxbtbmgr.exe"
O4 - HKLM\..\Run: [LXBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -onlytray
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [AutoEJCD_0ACE2011] C:\Program Files\AutoInstall\ZD1211_Auto_Install_CD_Only_Gen_0ACE2011\AutoEJCD.EXE /VID=0ACE /PID=2011
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: lxbt_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbtcoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
|
|
Hujo
Suspended permanently
|
13. kesäkuuta 2008 @ 15:39 |
Linkki tähän viestiin
|
|
scannnaa hjt:llä merkkaa paina Fix checked
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
Voiko tietsikka koskaan toimia?
|
|
Camping
Junior Member
|
13. kesäkuuta 2008 @ 15:45 |
Linkki tähän viestiin
|
|
Kiitoksia erittäin paljon avusta, tein tuon mitä pyysit, olisiko kone nyt puhdas?
|
|
Hujo
Suspended permanently
|
13. kesäkuuta 2008 @ 15:52 |
Linkki tähän viestiin
|
|
kunnossa on
mites kone toiumii
Voiko tietsikka koskaan toimia?
|
|
Mainos
|
|
|
|
Camping
Junior Member
|
13. kesäkuuta 2008 @ 15:56 |
Linkki tähän viestiin
|
|
Loistavaa, kone toimii todella hyvin aikoihin.
|
