|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
HjT_loki Muutama troya ei lähde, enkä myöskään saa taustakuvaa vaihdettua .KiitoS
|
|
|
samipami
Junior Member
|
2. syyskuuta 2008 @ 03:17 |
Linkki tähän viestiin
|
Siis AVG antivirus ei löydä enää mitään.....
Malwarebytes löytää 7 , eli 3 x Trojan BHO.H ja 4 x Trojan.Agent Ja scannauksen jälkeen yritän poistaa nämä , mutta ne eivät lähde. Kerrohan mitä teen Hujo..... ja vilpitön kiitos taas vaihteeksi sinulle.
|
|
Hujo
Suspended permanently
|
2. syyskuuta 2008 @ 12:45 |
Linkki tähän viestiin
|
|
Malwarebytes päivitä ja aja uudelleen laita se loki siintä
Voiko tietsikka koskaan toimia?
|
|
samipami
Junior Member
|
2. syyskuuta 2008 @ 16:10 |
Linkki tähän viestiin
|
|
Malwarebytes' Anti-Malware 1.26
Tietokantaversio: 1103
Windows 5.1.2600 Service Pack 3
2.9.2008 16:07:55
mbam-log-2008-09-02 (16-07-55).txt
Tarkistustyyppi: Täysi tarkistus (C:\|F:\|)
Tarkistetut kohteet: 81954
Kulunut aika: 22 minute(s), 20 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 2
Saastuneita rekisteriarvoja: 4
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 1
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a99091b0-d5c1-40df-bf12-8f929063a311} (Trojan.BHO.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{a99091b0-d5c1-40df-bf12-8f929063a311} (Trojan.BHO.H) -> Delete on reboot.
Saastuneita rekisteriarvoja:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Delete on reboot.
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
C:\Documents and Settings\Sami\Local Settings\Temporary Internet Files\Content.IE5\GACH46F5\3077htsbdjyf[1].dll (Trojan.BHO.H) -> Quarantined and deleted successfully.
|
|
Hujo
Suspended permanently
|
2. syyskuuta 2008 @ 16:28 |
Linkki tähän viestiin
|
|
scannaa uusi combofix loki
Voiko tietsikka koskaan toimia?
|
|
samipami
Junior Member
|
2. syyskuuta 2008 @ 17:03 |
Linkki tähän viestiin
|
ComboFix 08-09-01.01 - Sami 2008-09-02 16:57:27.7 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1035.18.1402 [GMT 3:00]
Running from: C:\Documents and Settings\Sami\Työpöytä\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-08-02 to 2008-09-02 )))))))))))))))))
.
2008-09-02 16:12 . 2008-09-02 16:12 61,440 --a------ C:\WINDOWS\system32\drivers\znth.sys
2008-09-02 08:54 . 2008-09-02 08:54 <KANSIO> d-------- C:\Program Files\Common Files\PCSuite
2008-09-02 08:54 . 2008-09-02 13:18 <KANSIO> d-------- C:\Program Files\Common Files\Nokia
2008-09-02 08:53 . 2008-09-02 08:53 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution
2008-09-02 08:53 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-09-01 19:17 . 2008-09-01 21:17 50 --a------ C:\23990098.$$$
2008-09-01 17:44 . 2008-09-01 18:03 <KANSIO> d-------- C:\Downloads
2008-09-01 17:44 . 2008-09-01 18:01 <KANSIO> d-------- C:\Bases
2008-09-01 17:41 . 2008-09-01 19:26 <KANSIO> d-------- C:\Kaspersky
2008-08-29 16:26 . 2008-08-29 16:26 <KANSIO> d-------- C:\Program Files\DIFX
2008-08-29 00:39 . 2008-08-29 00:39 <KANSIO> d-------- C:\Program Files\RegSeeker
2008-08-29 00:35 . 2008-08-31 20:00 5,120 --ahs---- C:\WINDOWS\system32\Thumbs.db
2008-08-26 20:56 . 2008-08-29 01:33 98 --a------ C:\index.ini
2008-08-26 16:35 . 2008-09-02 12:10 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-26 16:35 . 2008-09-02 00:16 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-26 16:35 . 2008-09-02 00:16 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-26 12:04 . 2008-08-26 12:04 579,072 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-08-26 12:03 . 2008-08-26 12:03 <KANSIO> d-------- C:\WINDOWS\ERUNT
2008-08-26 01:36 . 2008-08-26 01:36 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\PrevxCSI
2008-08-26 00:16 . 2008-08-26 00:16 <KANSIO> d-------- C:\Documents and Settings\Sami\Application Data\Malwarebytes
2008-08-26 00:16 . 2008-08-26 00:16 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-25 23:59 . 2008-08-26 12:52 <KANSIO> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-25 23:59 . 2008-08-26 12:52 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-22 19:00 . 2008-08-22 19:00 <KANSIO> d-------- C:\Program Files\Sygate
2008-08-22 19:00 . 2004-10-15 18:32 83,096 --a------ C:\WINDOWS\system32\SSSensor.dll
2008-08-22 19:00 . 2004-10-15 18:17 60,496 --a------ C:\WINDOWS\system32\drivers\Teefer.sys
2008-08-22 19:00 . 2004-10-15 18:18 21,075 --a------ C:\WINDOWS\system32\drivers\wpsdrvnt.sys
2008-08-22 19:00 . 2004-10-15 18:32 14,568 --a------ C:\WINDOWS\system32\drivers\wg6n.sys
2008-08-22 19:00 . 2004-10-15 18:32 14,568 --a------ C:\WINDOWS\system32\drivers\wg5n.sys
2008-08-22 19:00 . 2004-10-15 18:32 14,568 --a------ C:\WINDOWS\system32\drivers\wg4n.sys
2008-08-22 19:00 . 2004-10-15 18:32 14,568 --a------ C:\WINDOWS\system32\drivers\wg3n.sys
2008-08-22 16:22 . 18,688 C:\WINDOWS\system32\drivers\vlvmrura.dat
2008-08-22 16:22 . 5,120 C:\WINDOWS\system32\drivers\jkueopxu.dat
2008-08-17 09:10 . 2008-08-17 09:10 335 --a------ C:\WINDOWS\mozregistry.dat
2008-08-16 07:58 . 2008-09-02 13:27 <KANSIO> d-------- C:\WINDOWS\system32\drivers\Avg
2008-08-16 07:58 . 2008-09-02 16:57 <KANSIO> d--h----- C:\$AVG8.VAULT$
2008-08-16 05:45 . 2008-08-16 07:57 <KANSIO> d-------- C:\Program Files\RegCure
2008-08-16 00:48 . 2008-08-29 03:12 97,928 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-08-16 00:48 . 2008-08-22 18:19 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-08-16 00:48 . 2008-08-22 18:19 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-08-15 22:01 . 2008-08-15 22:01 <KANSIO> d-------- C:\Documents and Settings\Sami\Application Data\Windows Search
2008-08-15 22:00 . 2008-08-15 22:00 <KANSIO> d-------- C:\Documents and Settings\Sami\Application Data\Windows Desktop Search
2008-08-15 21:59 . 2008-08-15 21:59 <KANSIO> d-------- C:\WINDOWS\system32\GroupPolicy
2008-08-15 21:59 . 2008-08-15 21:59 <KANSIO> d-------- C:\Program Files\Windows Desktop Search
2008-08-15 21:59 . 2008-07-22 17:52 1,214,526 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-08-15 21:59 . 2008-07-22 17:52 790,846 -----c--- C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-08-15 21:59 . 2008-03-07 20:02 192,000 -----c--- C:\WINDOWS\system32\dllcache\offfilt.dll
2008-08-15 21:59 . 2008-03-07 20:02 98,304 -----c--- C:\WINDOWS\system32\dllcache\nlhtml.dll
2008-08-15 21:59 . 2008-03-07 20:02 29,696 -----c--- C:\WINDOWS\system32\dllcache\mimefilt.dll
2008-08-15 21:59 . 2008-07-22 17:52 9,696 -----c--- C:\WINDOWS\system32\dllcache\drvmain.sdb
2008-08-15 14:16 . 2008-04-11 22:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-08-15 14:16 . 2008-05-01 17:35 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-11 16:22 . 2008-09-02 10:20 12,288 --ahs---- C:\WINDOWS\Thumbs.db
2008-08-07 07:46 . 2008-08-07 07:46 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\RTL Winter Sports 2008
2008-08-07 01:46 . 2008-08-07 01:46 278,728 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-08-07 01:46 . 2008-08-07 01:46 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-08-05 19:04 . 2008-08-05 19:04 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\ATI
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-02 10:49 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-02 10:19 --------- d-----w C:\Program Files\Nokia
2008-09-02 10:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
2008-09-02 09:05 --------- d-----w C:\Documents and Settings\Sami\Application Data\Nokia
2008-09-02 03:47 --------- d-----w C:\Program Files\CCleaner
2008-08-26 15:15 --------- d-----w C:\Program Files\Java
2008-08-22 15:59 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-08-22 15:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8
2008-08-16 22:54 --------- d-----w C:\Program Files\real
2008-08-16 04:58 --------- d-----w C:\Program Files\Skype
2008-08-11 13:22 --------- d-----w C:\Program Files\Windows Media Connect
2008-08-07 05:50 --------- d-----w C:\Documents and Settings\Sami\Application Data\Skype
2008-08-07 05:35 --------- d-----w C:\Documents and Settings\Sami\Application Data\skypePM
2008-08-07 03:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-06 15:55 --------- d-----w C:\Documents and Settings\Sami\Application Data\U3
2008-08-05 15:54 --------- d-----w C:\Program Files\ATI Technologies
2008-08-05 15:54 --------- d-----w C:\Program Files\ATI
2008-08-05 15:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\ATI(2)
2008-08-05 15:53 --------- d-----w C:\Program Files\Sygate(2)
2008-08-05 15:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-08-02 17:46 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-08-01 02:54 --------- d-----w C:\Documents and Settings\Sami\Application Data\PC Suite
2008-07-25 04:11 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2008-07-24 21:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Disk Cleaner
2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-05 03:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Registry Helper
2008-07-02 21:04 --------- d-----w C:\Program Files\OpenOffice.org 2.4
2008-07-02 20:50 --------- d-----w C:\Documents and Settings\Sami\Application Data\OpenOffice.org2
2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:29 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:47 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-03 03:46 10,276,864 ----a-w C:\WINDOWS\system32\atioglx2.dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX(9).dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX(8).dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX(7).dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX(6).dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX(5).dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX(4).dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX(3).dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX(2).dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX(11).dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX(10).dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag(9).dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag(8).dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag(7).dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag(6).dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag(5).dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag(4).dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag(3).dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag(12).dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag(11).dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag(10).dll
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx(9).exe
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx(8).exe
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx(7).exe
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx(6).exe
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx(5).exe
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx(4).exe
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx(3).exe
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx(2).exe
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx(11).exe
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx(10).exe
2008-06-03 03:08 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2(9).dll
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2(8).dll
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2(7).dll
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2(6).dll
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2(5).dll
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2(4).dll
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2(3).dll
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2(12).dll
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2(11).dll
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2(10).dll
2008-06-03 03:02 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag.dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag(9).dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag(8).dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag(7).dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag(6).dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag(5).dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag(4).dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag(3).dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag(12).dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag(11).dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag(10).dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx(9).dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx(8).dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx(7).dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx(6).dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx(5).dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx(4).dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx(3).dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx(12).dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx(11).dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx(10).dll
2008-05-14 00:06 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Sivuhistoria\History.IE5\MSHist012008051420080515\index.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A99091B0-D5C1-40DF-BF12-8F929063A311}]
C:\Documents and Settings\Sami\Local Settings\Temporary Internet Files\Content.IE5\GACH46F5\3077htsbdjyf[1].dll [BU]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
|
|
Hujo
Suspended permanently
|
2. syyskuuta 2008 @ 17:44 |
Linkki tähän viestiin
|
Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
Lainaus:
File::
C:\Documents and Settings\Sami\Local Settings\Temporary Internet Files\Content.IE5\GACH46F5\3077htsbdjyf[1].dll [BU]
C:\23990098.$$$
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A99091B0-D5C1-40DF-BF12-8F929063A311}]
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
Voiko tietsikka koskaan toimia?
|
|
samipami
Junior Member
|
2. syyskuuta 2008 @ 22:31 |
Linkki tähän viestiin
|
Ok ok eli näyttäisi hiljaa hyvän tulevan toivottavasti..... Kiitos ja lisää tehtävää.. : )
ComboFix 08-09-01.03 - Sami 2008-09-02 22:16:44.11 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1035.18.1557 [GMT 3:00]
Running from: C:\Documents and Settings\Sami\Työpöytä\ComboFix.exe
Command switches used :: C:\Documents and Settings\Sami\Työpöytä\CFScript.txt
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\23990098.$$$
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-08-02 to 2008-09-02 )))))))))))))))))
.
2008-09-02 08:54 . 2008-09-02 08:54 <KANSIO> d-------- C:\Program Files\Common Files\PCSuite
2008-09-02 08:54 . 2008-09-02 13:18 <KANSIO> d-------- C:\Program Files\Common Files\Nokia
2008-09-02 08:53 . 2008-09-02 08:53 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution
2008-09-02 08:53 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-09-01 17:44 . 2008-09-01 18:03 <KANSIO> d-------- C:\Downloads
2008-09-01 17:44 . 2008-09-01 18:01 <KANSIO> d-------- C:\Bases
2008-09-01 17:41 . 2008-09-01 19:26 <KANSIO> d-------- C:\Kaspersky
2008-08-29 16:26 . 2008-08-29 16:26 <KANSIO> d-------- C:\Program Files\DIFX
2008-08-29 00:39 . 2008-08-29 00:39 <KANSIO> d-------- C:\Program Files\RegSeeker
2008-08-29 00:35 . 2008-08-31 20:00 5,120 --ahs---- C:\WINDOWS\system32\Thumbs.db
2008-08-26 20:56 . 2008-08-29 01:33 98 --a------ C:\index.ini
2008-08-26 16:35 . 2008-09-02 12:10 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-26 16:35 . 2008-09-02 00:16 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-26 16:35 . 2008-09-02 00:16 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-26 12:04 . 2008-08-26 12:04 579,072 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-08-26 12:03 . 2008-08-26 12:03 <KANSIO> d-------- C:\WINDOWS\ERUNT
2008-08-26 01:36 . 2008-08-26 01:36 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\PrevxCSI
2008-08-26 00:16 . 2008-08-26 00:16 <KANSIO> d-------- C:\Documents and Settings\Sami\Application Data\Malwarebytes
2008-08-26 00:16 . 2008-08-26 00:16 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-25 23:59 . 2008-08-26 12:52 <KANSIO> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-25 23:59 . 2008-08-26 12:52 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-22 19:00 . 2008-08-22 19:00 <KANSIO> d-------- C:\Program Files\Sygate
2008-08-22 19:00 . 2004-10-15 18:32 83,096 --a------ C:\WINDOWS\system32\SSSensor.dll
2008-08-22 19:00 . 2004-10-15 18:17 60,496 --a------ C:\WINDOWS\system32\drivers\Teefer.sys
2008-08-22 19:00 . 2004-10-15 18:18 21,075 --a------ C:\WINDOWS\system32\drivers\wpsdrvnt.sys
2008-08-22 19:00 . 2004-10-15 18:32 14,568 --a------ C:\WINDOWS\system32\drivers\wg6n.sys
2008-08-22 19:00 . 2004-10-15 18:32 14,568 --a------ C:\WINDOWS\system32\drivers\wg5n.sys
2008-08-22 19:00 . 2004-10-15 18:32 14,568 --a------ C:\WINDOWS\system32\drivers\wg4n.sys
2008-08-22 19:00 . 2004-10-15 18:32 14,568 --a------ C:\WINDOWS\system32\drivers\wg3n.sys
2008-08-22 16:22 . 18,688 C:\WINDOWS\system32\drivers\vlvmrura.dat
2008-08-22 16:22 . 5,120 C:\WINDOWS\system32\drivers\jkueopxu.dat
2008-08-17 09:10 . 2008-08-17 09:10 335 --a------ C:\WINDOWS\mozregistry.dat
2008-08-16 07:58 . 2008-09-02 13:27 <KANSIO> d-------- C:\WINDOWS\system32\drivers\Avg
2008-08-16 07:58 . 2008-09-02 22:16 <KANSIO> d--h----- C:\$AVG8.VAULT$
2008-08-16 05:45 . 2008-08-16 07:57 <KANSIO> d-------- C:\Program Files\RegCure
2008-08-16 00:48 . 2008-08-29 03:12 97,928 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-08-16 00:48 . 2008-08-22 18:19 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-08-16 00:48 . 2008-08-22 18:19 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-08-15 22:01 . 2008-08-15 22:01 <KANSIO> d-------- C:\Documents and Settings\Sami\Application Data\Windows Search
2008-08-15 22:00 . 2008-08-15 22:00 <KANSIO> d-------- C:\Documents and Settings\Sami\Application Data\Windows Desktop Search
2008-08-15 21:59 . 2008-08-15 21:59 <KANSIO> d-------- C:\WINDOWS\system32\GroupPolicy
2008-08-15 21:59 . 2008-08-15 21:59 <KANSIO> d-------- C:\Program Files\Windows Desktop Search
2008-08-15 21:59 . 2008-07-22 17:52 1,214,526 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-08-15 21:59 . 2008-07-22 17:52 790,846 -----c--- C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-08-15 21:59 . 2008-03-07 20:02 192,000 -----c--- C:\WINDOWS\system32\dllcache\offfilt.dll
2008-08-15 21:59 . 2008-03-07 20:02 98,304 -----c--- C:\WINDOWS\system32\dllcache\nlhtml.dll
2008-08-15 21:59 . 2008-03-07 20:02 29,696 -----c--- C:\WINDOWS\system32\dllcache\mimefilt.dll
2008-08-15 21:59 . 2008-07-22 17:52 9,696 -----c--- C:\WINDOWS\system32\dllcache\drvmain.sdb
2008-08-15 14:16 . 2008-04-11 22:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-08-15 14:16 . 2008-05-01 17:35 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-11 16:22 . 2008-09-02 10:20 12,288 --ahs---- C:\WINDOWS\Thumbs.db
2008-08-07 07:46 . 2008-08-07 07:46 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\RTL Winter Sports 2008
2008-08-07 01:46 . 2008-08-07 01:46 278,728 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-08-07 01:46 . 2008-08-07 01:46 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-08-05 19:04 . 2008-08-05 19:04 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\ATI
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-02 14:36 --------- d-----w C:\Program Files\CCleaner
2008-09-02 10:49 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-02 10:19 --------- d-----w C:\Program Files\Nokia
2008-09-02 10:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
2008-09-02 09:05 --------- d-----w C:\Documents and Settings\Sami\Application Data\Nokia
2008-08-26 15:15 --------- d-----w C:\Program Files\Java
2008-08-22 15:59 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-08-22 15:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8
2008-08-16 22:54 --------- d-----w C:\Program Files\real
2008-08-16 04:58 --------- d-----w C:\Program Files\Skype
2008-08-11 13:22 --------- d-----w C:\Program Files\Windows Media Connect
2008-08-07 05:50 --------- d-----w C:\Documents and Settings\Sami\Application Data\Skype
2008-08-07 05:35 --------- d-----w C:\Documents and Settings\Sami\Application Data\skypePM
2008-08-07 03:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-06 15:55 --------- d-----w C:\Documents and Settings\Sami\Application Data\U3
2008-08-05 15:54 --------- d-----w C:\Program Files\ATI Technologies
2008-08-05 15:54 --------- d-----w C:\Program Files\ATI
2008-08-05 15:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\ATI(2)
2008-08-05 15:53 --------- d-----w C:\Program Files\Sygate(2)
2008-08-05 15:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-08-02 17:46 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-08-01 02:54 --------- d-----w C:\Documents and Settings\Sami\Application Data\PC Suite
2008-07-25 04:11 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2008-07-24 21:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Disk Cleaner
2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-05 03:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Registry Helper
2008-07-02 21:04 --------- d-----w C:\Program Files\OpenOffice.org 2.4
2008-07-02 20:50 --------- d-----w C:\Documents and Settings\Sami\Application Data\OpenOffice.org2
2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:29 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:47 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-03 03:46 10,276,864 ----a-w C:\WINDOWS\system32\atioglx2.dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX(9).dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX(8).dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX(7).dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX(6).dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX(5).dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX(4).dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX(3).dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX(2).dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX(11).dll
2008-06-03 03:22 413,696 ----a-w C:\WINDOWS\system32\ATIDEMGX(10).dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag(9).dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag(8).dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag(7).dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag(6).dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag(5).dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag(4).dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag(3).dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag(12).dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag(11).dll
2008-06-03 03:21 306,688 ----a-w C:\WINDOWS\system32\ati2dvag(10).dll
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx(9).exe
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx(8).exe
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx(7).exe
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx(6).exe
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx(5).exe
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx(4).exe
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx(3).exe
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx(2).exe
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx(11).exe
2008-06-03 03:09 552,960 ----a-w C:\WINDOWS\system32\ati2evxx(10).exe
2008-06-03 03:08 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2(9).dll
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2(8).dll
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2(7).dll
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2(6).dll
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2(5).dll
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2(4).dll
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2(3).dll
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2(12).dll
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2(11).dll
2008-06-03 03:04 245,760 ----a-w C:\WINDOWS\system32\atiok3x2(10).dll
2008-06-03 03:02 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag.dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag(9).dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag(8).dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag(7).dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag(6).dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag(5).dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag(4).dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag(3).dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag(12).dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag(11).dll
2008-06-03 02:59 3,500,352 ----a-w C:\WINDOWS\system32\ati3duag(10).dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx(9).dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx(8).dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx(7).dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx(6).dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx(5).dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx(4).dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx(3).dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx(12).dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx(11).dll
2008-06-03 02:48 2,120,832 ----a-w C:\WINDOWS\system32\ativvaxx(10).dll
2008-05-14 00:06 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Sivuhistoria\History.IE5\MSHist012008051420080515\index.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A99091B0-D5C1-40DF-BF12-8F929063A311}]
C:\Documents and Settings\Sami\Local Settings\Temporary Internet Files\Content.IE5\GACH46F5\3077htsbdjyf[1].dll [BU]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-08-11 1124352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-29 1235736]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 2577632]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 C:\WINDOWS\system32\bthprops.cpl]
"Run StartupMonitor"="StartupMonitor.exe" [2000-05-20 C:\WINDOWS\StartupMonitor.exe]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\WINDOWS\\system32\\dxdiag.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"F:\\Pelit\\Return to Castle Wolfenstein\\WolfMP.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Kaspersky\\kavupd.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"22556:TCP"= 22556:TCP:BitCometBeta 22556 TCP
"22556:UDP"= 22556:UDP:BitCometBeta 22556 UDP
"13824:TCP"= 13824:TCP:BitCometBeta 13824 TCP
"13824:UDP"= 13824:UDP:BitCometBeta 13824 UDP
"8973:TCP"= 8973:TCP:BitComet 8973 TCP
"8973:UDP"= 8973:UDP:BitComet 8973 UDP
"14519:TCP"= 14519:TCP:BitComet 14519 TCP
"14519:UDP"= 14519:UDP:BitComet 14519 UDP
R0 kkgutnpm;kkgutnpm;C:\WINDOWS\system32\drivers\vlvmrura.dat [ ]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-29 97928]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-29 875288]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-08-22 76040]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;C:\WINDOWS\system32\DRIVERS\ADM8511.SYS [2001-08-17 20160]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f5b062a5-2f54-11dd-a797-00508dc84ead}]
\Shell\AutoRun\command - H:\LaunchU3.exe -a
*Newly Created Service* - CATCHME
.
'Ajoitetut tehtävät'-kansion sisältö
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-02 22:18:57
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\kkgutnpm]
"ImagePath"="system32\drivers\vlvmrura.dat"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\vsdatant]
"ImagePath"=""
.
Completion time: 2008-09-02 22:19:59
ComboFix-quarantined-files.txt 2008-09-02 19:19:52
ComboFix2.txt 2008-09-02 15:48:47
ComboFix3.txt 2008-09-02 14:00:03
ComboFix4.txt 2008-08-28 22:10:30
Pre-Run: 16,363,417,600 tavua vapaana
Post-Run: 16,348,803,072 tavua vapaana
257 --- E O F --- 2008-08-22 15:59:47
|
|
Hujo
Suspended permanently
|
2. syyskuuta 2008 @ 23:27 |
Linkki tähän viestiin
|
|
scannaa uusi hjt:n loki
Voiko tietsikka koskaan toimia?
|
|
samipami
Junior Member
|
3. syyskuuta 2008 @ 21:32 |
Linkki tähän viestiin
|
Hei ja kiitoksia sinnikyydestäsi.....
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:31:01, on 3.9.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\StartupMonitor.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.telkku.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A99091B0-D5C1-40DF-BF12-8F929063A311} - C:\Documents and Settings\Sami\Local Settings\Temporary Internet Files\Content.IE5\GACH46F5\3077htsbdjyf[1].dll (file missing)
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsu...b?1199268633166
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
--
End of file - 5076 bytes
|
|
Hujo
Suspended permanently
|
4. syyskuuta 2008 @ 13:39 |
Linkki tähän viestiin
|
|
Kun fixsaat tuo rivin hjt:llä
O2 - BHO: (no name) - {A99091B0-D5C1-40DF-BF12-8F929063A311} - C:\Documents and Settings\Sami\Local Settings\Temporary Internet Files\Content.IE5\GACH46F5\3077htsbdjyf[1].dll (file missing)
kysyykö jokin siihen lupaa poistoon deletointiin.
Voiko tietsikka koskaan toimia?
|
|
samipami
Junior Member
|
4. syyskuuta 2008 @ 13:53 |
Linkki tähän viestiin
|
|
Siis jos fixaan tuon rivin..... se on heti siellä kun scannaan uudelleen..... :(
|
|
Hujo
Suspended permanently
|
4. syyskuuta 2008 @ 14:10 |
Linkki tähän viestiin
|
Luo poistolista:
? Avaa HiJackThis
? Klikkaa "Configure" valintaa oikealla alhaalla
? Klikkaa "Misc Tools"
? Klikkaa boxia joka sanoo "Uninstall Manager"
? Klikkaa valintaa "Save list"
? Kopioi ja liitä kyseinen lista muistiosta ketjuusi
Voiko tietsikka koskaan toimia?
|
|
samipami
Junior Member
|
4. syyskuuta 2008 @ 14:52 |
Linkki tähän viestiin
|
Adobe Flash Player ActiveX
Adobe Flash Player Plugin
Adobe Reader 8.1.2 - Suomi
Apple Software Update
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Display Driver
AVG Free 8.0
CCleaner (remove only)
DriverAgent by TouchStone Software
DriverAgent Plugin for Netscape by TouchStone Software
Full Tilt Poker
GTA San Andreas
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.0 (KB932471)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows XP (KB915800-v4)
Hotfix-korjauspäivitys Windows Media Player 11:lle (KB939683)
Hotfix-päivitys Windows Internet Explorer 7:lle (KB947864)
Hotfix-päivitys Windows XP:lle (KB952287)
IrfanView (remove only)
Java(TM) 6 Update 7
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Finnish Language Pack
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Language Pack - FIN
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 3.0 Finnish Language Pack
Microsoft .NET Framework 3.0 Service Pack 1
Microsoft .NET Framework 3.0:n suomen kielipaketti
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft National Language Support Downlevel APIs
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.5
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.0.1)
MSVC80_x86
MSXML 4.0 SP2 (KB936181)
MSXML 6.0 Parser (KB933579)
Nokia Connectivity Cable Driver
Nokia Flashing Cable Driver
Nokia PC Suite
Nokia PC Suite
Nokia Software Updater
PC Connectivity Solution
Päivitys Windows XP:lle (KB951072-v2)
Päivitys Windows XP:lle (KB951618-v2)
Päivitys Windows XP:lle (KB951978)
QuickTime
REALTEK GbE & FE Ethernet PCI NIC Driver
Realtek High Definition Audio Driver
RTL Winter Sports 2008
Skype? 3.6
StartupMonitor
Steam
Suojauspäivitys ohjelmistolle Windows XP (KB941569)
Suojauspäivitys Windows Internet Explorer 7:lle (KB938127)
Suojauspäivitys Windows Internet Explorer 7:lle (KB942615)
Suojauspäivitys Windows Internet Explorer 7:lle (KB944533)
Suojauspäivitys Windows Internet Explorer 7:lle (KB950759)
Suojauspäivitys Windows Internet Explorer 7:lle (KB953838)
Suojauspäivitys Windows Media Player 11:lle (KB936782)
Suojauspäivitys Windows XP:lle (KB923789)
Suojauspäivitys Windows XP:lle (KB946648)
Suojauspäivitys Windows XP:lle (KB950760)
Suojauspäivitys Windows XP:lle (KB950762)
Suojauspäivitys Windows XP:lle (KB950974)
Suojauspäivitys Windows XP:lle (KB951066)
Suojauspäivitys Windows XP:lle (KB951376)
Suojauspäivitys Windows XP:lle (KB951376-v2)
Suojauspäivitys Windows XP:lle (KB951698)
Suojauspäivitys Windows XP:lle (KB951748)
Suojauspäivitys Windows XP:lle (KB952954)
Suojauspäivitys Windows XP:lle (KB953839)
Sygate Personal Firewall
Terrorist Takedown 2 (1.01)
Windows Imaging Component
Windows Live installer
Windows Live Messenger
Windows Liven kirjautumisavustaja
Windows Liven sähköposti
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows Presentation Foundation
Windows Presentation Foundation Language Pack (FIN)
Windows Search 4.0
Windows Workflow Foundation FI Language Pack
Windows XP Service Pack 3
Windowsin ohjainpaketti - Nokia Modem (05/22/2008 3.8)
Windowsin ohjainpaketti - Nokia Modem (05/22/2008 7.00.0.1)
Windowsin ohjainpaketti - Nokia pccsmcfd (10/12/2007 6.85.4.0)
WinRAR-pakkausohjelma
XML Paper Specification Shared Components Language Pack 1.0
Vai ymmärsinkö mitään :-0
|
|
Hujo
Suspended permanently
|
4. syyskuuta 2008 @ 15:09 |
Linkki tähän viestiin
|
|
Poista lisää poista sovelutuksesta
StartupMonitor
poista C:\WINDOWS\StartupMonitor.exe vikasiedossa
============
scannaa hjt:llä merkkaa paina Fix checked
O2 - BHO: (no name) - {A99091B0-D5C1-40DF-BF12-8F929063A311} - C:\Documents and Settings\Sami\Local Settings\Temporary Internet Files\Content.IE5\GACH46F5\3077htsbdjyf[1].dll (file missing)
=============
sammuta ja käynnistä
=============
scannaaa Malwarebytes' Anti-Malware:lla uudelleen täysi scannaus
===================
scannaa uusi hjt:n loki
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 4. syyskuuta 2008 @ 15:10
|
|
samipami
Junior Member
|
5. syyskuuta 2008 @ 16:39 |
Linkki tähän viestiin
|
|
Terve.... Ai niin olen unohtanut sanoa että saan jopa taustakuvia taas laitettua....mutta tein kuten käskit eikä lähde HjTllä .... Huomasin rekisterieditorilla että se sijaitsee kansiossa InProcServer32 En saa sitä sieltä manuaalisesti poistettua..... Malware scannaa joten lähetän sen lokin kuten HJTn mutta Esim Malware on jo löytänyt toijia eli sen Trojan.BHO.H ja Trojan.Agentin. huh huh tää vääntö on pitkä,toivottavasti myös palkitseva
|
|
samipami
Junior Member
|
5. syyskuuta 2008 @ 18:42 |
Linkki tähän viestiin
|
Tarkistustyyppi Täysi tarkistus (CF)
Tarkistetut kohteet 84057
Kulunut aika 30 minute(s), 55 second(s)
Saastuneita muistiprosesseja 0
Saastuneita muistimoduuleja 0
Saastuneita rekisteriavaimia 2
Saastuneita rekisteriarvoja 4
Saastuneita rekisterikohteita 0
Saastuneita hakemistoja 0
Saastuneita tiedostoja 1
Saastuneita muistiprosesseja
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Helper Objects{a99091b0-d5c1-40df-bf12-8f929063a311} (Trojan.BHO.H) - Delete on reboot.
HKEY_CLASSES_ROOTCLSID{a99091b0-d5c1-40df-bf12-8f929063a311} (Trojan.BHO.H) - Delete on reboot.
Saastuneita rekisteriarvoja
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Settingsbf (Trojan.Agent) - Delete on reboot.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Settingsbk (Trojan.Agent) - Delete on reboot.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Settingsiu (Trojan.Agent) - Delete on reboot.
HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser Settingsmu (Trojan.Agent) - Delete on reboot.
Saastuneita rekisterikohteita
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja
CDocuments and SettingsSamiLocal SettingsTemporary Internet FilesContent.IE5GACH46F53077htsbdjyf[1].dll (Trojan.BHO.H) - Quarantined and deleted successfully.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:41:12, on 5.9.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgscanx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.telkku.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A99091B0-D5C1-40DF-BF12-8F929063A311} - C:\Documents and Settings\Sami\Local Settings\Temporary Internet Files\Content.IE5\GACH46F5\3077htsbdjyf[1].dll (file missing)
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Steam] "F:\Program Files\Steam\Steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsu...b?1199268633166
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
--
End of file - 5331 bytes
|
|
Hujo
Suspended permanently
|
5. syyskuuta 2008 @ 20:20 |
Linkki tähän viestiin
|
siellähän se istuu.....
O2 - BHO: (no name) - {A99091B0-D5C1-40DF-BF12-8F929063A311} - C:\Documents and Settings\Sami\Local Settings\Temporary Internet Files\Content.IE5\GACH46F5\3077htsbdjyf[1].dll (file missing)
=======================
Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
Lainaus:
File::
C:\Documents and Settings\Sami\Local Settings\Temporary Internet Files\Content.IE5\GACH46F5\3077htsbdjyf[1].dll [BU]
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A99091B0-D5C1-40DF-BF12-8F929063A311}]
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
====================
Nyt tuon punasella merkityn laitat tyhjään muistioon
käynnistä nappi >apuohjelmat > muistio
Kohde: työpöytä
sittten vasemmasta ylä reunasta tiedosto > tallenna nimellä CFScript.txt
tallenusmuoto kaikki tiedostot
sitten raahaat sen kuvan osoitamalla tavalla
combofix työstää tulee sininen taulu paina numeroa 1 ja enter
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 5. syyskuuta 2008 @ 20:22
|
|
samipami
Junior Member
|
5. syyskuuta 2008 @ 21:17 |
Linkki tähän viestiin
|
|
Kun olen raahannut comboon sen CFScriptin tulee error : CFS nimivirhe Yrititkö ajaa CFScriptin?
Nimi CFScript on kirjoitettu väärin... Apuuuuva
|
|
Hujo
Suspended permanently
|
5. syyskuuta 2008 @ 21:44 |
Linkki tähän viestiin
|
hmmmmm..... mikä siellä nyt mättäää
noin se tulee CFScript.txt
================
Lataa NoLop työpöydällesi yhdestä seuraavista linkeistä...
Linkki1
Linkki2
Linkki3
1.Sulje kaikki ohjelmat, koska tämä vaihe vaatii uudelleenkäynnistyksen
2.Tuplaklikkaa NoLop.exe ajaaksesi sen
3.Klikkaa nappulaa "Search and Destroy"
<<Tietokoneesi skannataan saastuneiden tiedostojen osalta>>
4, Kun skannaus on valmis, sinua pyydetään käynnistämään kone uudestaan, jos infektio löytyy. Klikkaa OK
5. Klikkaa "REBOOT"-painiketta.
6. NoLopin pitäisi antaa viesti. Jos ei, tuplaklikkaa ohjelmaa ja se valmistuu. Lähetä C:\NoLop.log-tiedoston sisältö uuden HijackThis-lokin kera.
-- Jos saat seuraavan virheen, "mscomctl.ocx or one of its dependencies are not correctly registered," lataa mscomctl.ocx ja tallenna se system32-hakemistoosi (yleensä c:\Windows\system32). Tämän jälkeen aja ohjelma uudestaan.
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 5. syyskuuta 2008 @ 21:53
|
|
samipami
Junior Member
|
7. syyskuuta 2008 @ 04:19 |
Linkki tähän viestiin
|
ComboFix 08-09-05.02 - Sami 2008-09-07 4:13:48.19 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1035.18.1398 [GMT 3:00]
Running from: C:\Documents and Settings\Sami\Työpöytä\ComboFix.exe
Command switches used :: C:\Documents and Settings\Sami\Työpöytä\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-08-07 to 2008-09-07 )))))))))))))))))
.
2008-09-06 21:56 . 2008-09-07 02:15 212 --a------ C:\delete.bat
2008-09-06 21:11 . 2008-09-06 21:11 <KANSIO> d-------- C:\WINDOWS\LastGood
2008-09-05 02:40 . 2008-09-05 02:40 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\U3
2008-09-04 18:44 . 2008-09-04 18:56 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-09-04 13:45 . 2008-09-05 01:18 <KANSIO> d-------- C:\Program Files\QuickTime
2008-09-02 08:54 . 2008-09-02 08:54 <KANSIO> d-------- C:\Program Files\Common Files\PCSuite
2008-09-02 08:54 . 2008-09-02 13:18 <KANSIO> d-------- C:\Program Files\Common Files\Nokia
2008-09-02 08:53 . 2008-09-02 08:53 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution
2008-09-02 08:53 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-09-01 17:44 . 2008-09-01 18:03 <KANSIO> d-------- C:\Downloads
2008-09-01 17:44 . 2008-09-01 18:01 <KANSIO> d-------- C:\Bases
2008-09-01 17:41 . 2008-09-01 19:26 <KANSIO> d-------- C:\Kaspersky
2008-08-29 16:26 . 2008-08-29 16:26 <KANSIO> d-------- C:\Program Files\DIFX
2008-08-29 00:39 . 2008-08-29 00:39 <KANSIO> d-------- C:\Program Files\RegSeeker
2008-08-29 00:35 . 2008-09-05 02:08 8,192 --ahs---- C:\WINDOWS\system32\Thumbs.db
2008-08-26 20:56 . 2008-08-29 01:33 98 --a------ C:\index.ini
2008-08-26 16:35 . 2008-09-02 12:10 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-26 16:35 . 2008-09-02 00:16 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-26 16:35 . 2008-09-02 00:16 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-26 12:04 . 2008-08-26 12:04 579,072 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-08-26 12:03 . 2008-08-26 12:03 <KANSIO> d-------- C:\WINDOWS\ERUNT
2008-08-26 01:36 . 2008-08-26 01:36 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\PrevxCSI
2008-08-26 00:16 . 2008-08-26 00:16 <KANSIO> d-------- C:\Documents and Settings\Sami\Application Data\Malwarebytes
2008-08-26 00:16 . 2008-08-26 00:16 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-25 23:59 . 2008-08-26 12:52 <KANSIO> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-25 23:59 . 2008-08-26 12:52 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-22 19:00 . 2008-08-22 19:00 <KANSIO> d-------- C:\Program Files\Sygate
2008-08-22 19:00 . 2004-10-15 18:32 83,096 --a------ C:\WINDOWS\system32\SSSensor.dll
2008-08-22 19:00 . 2004-10-15 18:17 60,496 --a------ C:\WINDOWS\system32\drivers\Teefer.sys
2008-08-22 19:00 . 2004-10-15 18:18 21,075 --a------ C:\WINDOWS\system32\drivers\wpsdrvnt.sys
2008-08-22 19:00 . 2004-10-15 18:32 14,568 --a------ C:\WINDOWS\system32\drivers\wg6n.sys
2008-08-22 19:00 . 2004-10-15 18:32 14,568 --a------ C:\WINDOWS\system32\drivers\wg5n.sys
2008-08-22 19:00 . 2004-10-15 18:32 14,568 --a------ C:\WINDOWS\system32\drivers\wg4n.sys
2008-08-22 19:00 . 2004-10-15 18:32 14,568 --a------ C:\WINDOWS\system32\drivers\wg3n.sys
2008-08-22 16:22 . 18,688 C:\WINDOWS\system32\drivers\vlvmrura.dat
2008-08-22 16:22 . 5,120 C:\WINDOWS\system32\drivers\jkueopxu.dat
2008-08-17 09:10 . 2008-08-17 09:10 335 --a------ C:\WINDOWS\mozregistry.dat
2008-08-16 07:58 . 2008-09-06 21:11 <KANSIO> d-------- C:\WINDOWS\system32\drivers\Avg
2008-08-16 07:58 . 2008-09-07 04:12 <KANSIO> d--h----- C:\$AVG8.VAULT$
2008-08-16 05:45 . 2008-08-16 07:57 <KANSIO> d-------- C:\Program Files\RegCure
2008-08-16 00:48 . 2008-08-29 03:12 97,928 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-08-16 00:48 . 2008-08-22 18:19 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-08-16 00:48 . 2008-08-22 18:19 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-08-15 22:01 . 2008-08-15 22:01 <KANSIO> d-------- C:\Documents and Settings\Sami\Application Data\Windows Search
2008-08-15 22:00 . 2008-08-15 22:00 <KANSIO> d-------- C:\Documents and Settings\Sami\Application Data\Windows Desktop Search
2008-08-15 21:59 . 2008-08-15 21:59 <KANSIO> d-------- C:\WINDOWS\system32\GroupPolicy
2008-08-15 21:59 . 2008-08-15 21:59 <KANSIO> d-------- C:\Program Files\Windows Desktop Search
2008-08-15 21:59 . 2008-07-22 17:52 1,214,526 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-08-15 21:59 . 2008-07-22 17:52 790,846 -----c--- C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-08-15 21:59 . 2008-03-07 20:02 192,000 -----c--- C:\WINDOWS\system32\dllcache\offfilt.dll
2008-08-15 21:59 . 2008-03-07 20:02 98,304 -----c--- C:\WINDOWS\system32\dllcache\nlhtml.dll
2008-08-15 21:59 . 2008-03-07 20:02 29,696 -----c--- C:\WINDOWS\system32\dllcache\mimefilt.dll
2008-08-15 21:59 . 2008-07-22 17:52 9,696 -----c--- C:\WINDOWS\system32\dllcache\drvmain.sdb
2008-08-15 14:16 . 2008-04-11 22:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-08-15 14:16 . 2008-05-01 17:35 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-11 16:22 . 2008-09-02 10:20 12,288 --ahs---- C:\WINDOWS\Thumbs.db
2008-08-07 07:46 . 2008-08-07 07:46 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\RTL Winter Sports 2008
2008-08-07 01:46 . 2008-08-07 01:46 278,728 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-08-07 01:46 . 2008-08-07 01:46 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-05 13:50 --------- d-----w C:\Program Files\CCleaner
2008-09-04 10:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-09-04 04:34 --------- d-----w C:\Program Files\Nokia
2008-09-02 10:49 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-02 10:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Installations
2008-09-02 09:05 --------- d-----w C:\Documents and Settings\Sami\Application Data\Nokia
2008-08-26 15:15 --------- d-----w C:\Program Files\Java
2008-08-22 15:59 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-08-22 15:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8
2008-08-16 22:54 --------- d-----w C:\Program Files\real
2008-08-16 04:58 --------- d-----w C:\Program Files\Skype
2008-08-11 13:22 --------- d-----w C:\Program Files\Windows Media Connect
2008-08-07 05:50 --------- d-----w C:\Documents and Settings\Sami\Application Data\Skype
2008-08-07 05:35 --------- d-----w C:\Documents and Settings\Sami\Application Data\skypePM
2008-08-07 03:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-06 15:55 --------- d-----w C:\Documents and Settings\Sami\Application Data\U3
2008-08-05 16:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\ATI
2008-08-05 15:54 --------- d-----w C:\Program Files\ATI Technologies
2008-08-05 15:54 --------- d-----w C:\Program Files\ATI
2008-08-05 15:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\ATI(2)
2008-08-05 15:53 --------- d-----w C:\Program Files\Sygate(2)
2008-08-02 17:46 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-08-01 02:54 --------- d-----w C:\Documents and Settings\Sami\Application Data\PC Suite
2008-07-25 04:11 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2008-07-24 21:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Disk Cleaner
2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 19:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 19:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:29 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:47 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-05-19 16:10 94,208 ----a-w C:\Documents and Settings\Sami\Application Data\ezplay.sys
2008-05-19 16:09 47,360 ----a-w C:\Documents and Settings\Sami\Application Data\pcouffin.sys
2008-01-28 00:19 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-05-14 00:06 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Sivuhistoria\History.IE5\MSHist012008051420080515\index.dat
.
((((((((((((((((((((((((((((( snapshot@2008-09-05_20.34.41.96 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-07-30 17:19:10 271,224 ----a-w C:\WINDOWS\LastGood\system32\mucltui.dll
+ 2007-07-30 17:19:04 207,736 ----a-w C:\WINDOWS\LastGood\system32\muweb.dll
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A99091B0-D5C1-40DF-BF12-8F929063A311}]
C:\Documents and Settings\Sami\Local Settings\Temporary Internet Files\Content.IE5\GACH46F5\3077htsbdjyf[1].dll [BU]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-08-11 1124352]
"Steam"="F:\Program Files\Steam\Steam.exe" [2008-09-04 1271032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-29 1235736]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 2577632]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 413696]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 C:\WINDOWS\system32\bthprops.cpl]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^LaunchU3.exe.lnk]
path=C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys\LaunchU3.exe.lnk
backup=C:\WINDOWS\pss\LaunchU3.exe.lnkCommon Startup
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\WINDOWS\\system32\\dxdiag.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"F:\\Pelit\\Return to Castle Wolfenstein\\WolfMP.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Kaspersky\\kavupd.exe"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"22556:TCP"= 22556:TCP:BitCometBeta 22556 TCP
"22556:UDP"= 22556:UDP:BitCometBeta 22556 UDP
"13824:TCP"= 13824:TCP:BitCometBeta 13824 TCP
"13824:UDP"= 13824:UDP:BitCometBeta 13824 UDP
"8973:TCP"= 8973:TCP:BitComet 8973 TCP
"8973:UDP"= 8973:UDP:BitComet 8973 UDP
"14519:TCP"= 14519:TCP:BitComet 14519 TCP
"14519:UDP"= 14519:UDP:BitComet 14519 UDP
R0 kkgutnpm;kkgutnpm;C:\WINDOWS\system32\drivers\vlvmrura.dat [ ]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-29 97928]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-29 875288]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-08-22 76040]
S3 ADM8511;ADMtek ADM8511/AN986 USB To Fast Ethernet Converter;C:\WINDOWS\system32\DRIVERS\ADM8511.SYS [2001-08-17 20160]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f5b062a5-2f54-11dd-a797-00508dc84ead}]
\Shell\AutoRun\command - H:\LaunchU3.exe -a
.
'Ajoitetut tehtävät'-kansion sisältö
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-07 04:15:35
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\kkgutnpm]
"ImagePath"="system32\drivers\vlvmrura.dat"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\vsdatant]
"ImagePath"=""
.
Completion time: 2008-09-07 4:16:27
ComboFix-quarantined-files.txt 2008-09-07 01:16:22
ComboFix2.txt 2008-09-07 00:44:22
ComboFix3.txt 2008-09-07 00:36:32
ComboFix4.txt 2008-09-06 19:22:24
ComboFix5.txt 2008-09-07 00:56:37
Pre-Run: 15,830,437,888 tavua vapaana
Post-Run: 15,817,003,008 tavua vapaana
207 --- E O F --- 2008-08-22 15:59:47
|
|
samipami
Junior Member
|
9. syyskuuta 2008 @ 04:32 |
Linkki tähän viestiin
|
|
Hujoooooo ApuaaaaA oon hukassa tän koneen kanssa
|
|
Hujo
Suspended permanently
|
9. syyskuuta 2008 @ 18:24 |
Linkki tähän viestiin
|
Lataa OTMoveIt
OTMoveIt ja tallenna se työpöydällesi.
Tuplaklikkaa OTMoveIt.exe.
Klikkaa CleanUp!.
Valitse Yes kun kysytään "Begin cleanup Process?".
Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.
HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.
Voiko tietsikka koskaan toimia?
|
|
samipami
Junior Member
|
11. syyskuuta 2008 @ 06:40 |
Linkki tähän viestiin
|
Eli ei auttanut valitettavasti. Ccleaner ilmoittaa asian esim : InProcServer32\C:\Documents and Settings\Sami\Local Settings\Temporary Internet Files\Content.IE5\GACH46F5\3077htsbdjyf[1].dll
Ja Hjt tekstin näin : BHO: (no name) - {A99091B0-D5C1-40DF-BF12-8F929063A311} - C:\Documents and Settings\Sami\Local Settings\Temporary Internet Files\Content.IE5\GACH46F5\3077htsbdjyf[1].dll (file missing)
|
|
Hujo
Suspended permanently
|
11. syyskuuta 2008 @ 12:18 |
Linkki tähän viestiin
|
|
Mites se kone noin muuten toimii
Voiko tietsikka koskaan toimia?
|
|
Mainos
|
|
|
|
samipami
Junior Member
|
11. syyskuuta 2008 @ 12:33 |
Linkki tähän viestiin
|
|
Siis en ymmärtänyt .... Voisitko tarkentaa asian " miten kone noin toimi "
|
|
