|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
HJT-loki, koko masiina pykii
|
|
|
heilahdus
Newbie
|
2. lokakuuta 2008 @ 03:49 |
Linkki tähän viestiin
|
Eli siis..
Todennäköisesti tartunta tuli jommastakummasta netissä esiintyvästä Close Combat: Cross of Iron -torrentina ladattuna tiedostoista.. tai jostain keygenistä. Käytössä vielä päällekkäin Nortonin AntiVirus ja AntiVir personal edition classic.. Palomuurina vieläkin nortonin oma, ZoneAlarmia en oo vielä saanut asennettua kun kone hidastelee niin urakalla.. Norton valittelee käynnistyksestä lähtien C:\WINDOWS\Temp\tmp***.tmp -tiedostoissa (*** tilalla juokseva kirjain/numero sarjaa 1-27D, niin pitkälle kuin klikkailu jaksaa kiinnostaa) olevasta Trojan.nebulerista ja AntiVir valittaa käynnistäessa joko Mundo-troijalaisesta tai jostain muusta. Netti toimii erittäin hitaasti jos ollenkaan, kone kaatuilee ja sammuttaessa ei pyöritä loppuun asti vaan jää päälle viimeistään tyhjä musta ruutu ja osoitin näytöllä -tilaan. Lisäksi (ainakin Firefoxilla) neettisivuilla on tapana (latautuessaan) esiintyä tuplana, eli siis sama sivu tulee alaspäin scrollatessa uudestaan.. Apuja kaipailtaisiin, opinnäytetyö pahasti kesken :)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:15:25, on 2.10.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Norton Internet Security\ISSVC.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\sm56hlpr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ASUS\ASUS Live Update\ALU.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\faceback.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ASUS\Asus ChkMail\ChkMail.exe
C:\WINDOWS\system32\dumprep.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.asus.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - c:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exe
O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Zshutdown] c:\sysprep\patch\sysprep.cmd
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ppmate] C:\Program Files\PPMate\ppmate.exe -autoplay
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\faceback.exe 61A847B5BBF7281337983D466188719AB689201522886B092CBD44BD8689220221DD3257
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxie.exe] C:\WINDOWS\system32\kdxie.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [BM9ff7d710] Rundll32.exe "C:\WINDOWS\system32\vtqgsren.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ASUS ChkMail.lnk = C:\Program Files\ASUS\Asus ChkMail\ChkMail.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C334E6E1-50D0-4ABA-AF1C-0FA188ABC0CA}: NameServer = 85.255.114.44,85.255.112.237
O17 - HKLM\System\CCS\Services\Tcpip\..\{E2F002BD-9E0C-4278-856A-493162949161}: NameServer = 85.255.114.44,85.255.112.237
O20 - AppInit_DLLs: bkytfq.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - c:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
--
End of file - 9673 bytes
Innerspace-traveller
|
Senior Member
4 tuotearviota
|
2. lokakuuta 2008 @ 13:04 |
Linkki tähän viestiin
|
1. Lataa Combofix.exe työpöydällesi jommastakummasta linkistä:
Combofix.exe
Combofix.exe
Avaa Combofix.exe ja seuraa näyttöön tulevia ohjeita
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne.
Tyhjennä roskakori ja käynnistä koneesi uudelleen.
Postita tänne seuraavat lokit:
* Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
* (C:\ComboFix.txt) raportti
*
Lataa Malwarebytes' Anti-Malware työpöydällesi.
* Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
* Lopuksi varmistu, että seuraavat on valittu: Päivitä Malwarebytes' Anti-Malware ja Käynnistä Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Lopeta.
* Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
* Kun ohjelma on latautunut, valitse Suorita täysi tarkistus ja klikkaa Tarkista.
* Kun skanni on valmis, klikkaa OK ja sitten Näytä tulokset nähdäksesi tulokset.
* Varmistu, että kaikki on merkitty ja klikkaa Poista valitut.
* Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös
täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
* Lähetä lokin sisältö seuraavassa viestissäsi + uusi hjt-loki.
|
|
heilahdus
Newbie
|
2. lokakuuta 2008 @ 17:32 |
Linkki tähän viestiin
|
|
Jostain syystä en saa ladattua ComboFixiä, yllä olevat linkit ei toimi ja googlella etsiessä törmäsin samaan ongelmaan (ainakin bleepingcomputer.com -sivustoa ei löydy). Lisäksi useassa paikassa kehotettiin olemaan käyttämättä ComboFix:ä, sillä se poistaisi kaikki SYSTEM -kansion tiedostot tjn..? Sen sijaan ehdotettiin ComboScan-ohjelman käyttöä.. So what to do?
Innerspace-traveller
|
Senior Member
4 tuotearviota
|
2. lokakuuta 2008 @ 17:35 |
Linkki tähän viestiin
|
|
Jatka ohjeita eteen päin vaan eli tuohon Malwarebytesi kohtaan.
|
|
heilahdus
Newbie
|
2. lokakuuta 2008 @ 17:39 |
Linkki tähän viestiin
|
Innerspace-traveller
|
Senior Member
4 tuotearviota
|
2. lokakuuta 2008 @ 17:41 |
Linkki tähän viestiin
|
|
Jatka vaan malwareen kun ei ole luotettava latauksen lähde tuo linkki ja combo ei toimi kuin noista linkeistä ladattuna (eli ne mitkä ohjeessa on)
|
|
heilahdus
Newbie
|
2. lokakuuta 2008 @ 18:35 |
Linkki tähän viestiin
|
|
Jaahas.. seuraava ongelma.. Malwarebytes suostuu ajamaan täyttä tarkistusta vain 7 sekuntia.. (kokeilin jo useamman kerran) ja jumahtaa tarkistettaessa tiedostoa [992] \??\C:\WINDOWS\system32\csrss.exe ja saastuneita kohteita on löytynyt jo 22 tähän mennessä.. (1398 kohdetta tarkistettuna)
Ehdotuksia??
Vai kokeilisinko sitä ComboScan:a?
Innerspace-traveller
|
Senior Member
4 tuotearviota
|
2. lokakuuta 2008 @ 19:05 |
Linkki tähän viestiin
|
Anna vaan niitten combocannien olla ettei kone poksahda :D
Käynnistä kone vikasietotilaan ja koita siellä skannata malwarebytesillä.
Vikasietotilaan
|
|
heilahdus
Newbie
|
2. lokakuuta 2008 @ 19:19 |
Linkki tähän viestiin
|
|
Jostain syystä erään toisen tämän sivuston käyttäjän samoista ohjeista/ niissä olevasta jälkimmäisestä ComboFixin linkistä sain tuon nyt vihdoin asentumaan koneelleni.. Eli seuraan nyt ohjeita alusta käsin.. lokeja tulossa piakkoin.. :)
Innerspace-traveller
|
|
heilahdus
Newbie
|
2. lokakuuta 2008 @ 19:51 |
Linkki tähän viestiin
|
|
Combofix on nyt raksutellut puolisen tuntia jo.. onko toi mahdollisesti jumiutunut? Kannattaako vielä odotella vai laittaa uudestaan..? Kone kyllä voi olla tosi saastunut, että aikaa voi toki vierähtää, ainakin siltä tuntuu..
Alkuun pomppasi käynnistyksen jälkeen Avirin ikkuna(jotenkin ilmeisesti Combofixin kanssa yhdessä toimien??), jossa oli tekstiä tyyliin: ... on löytänyt virheellistä koodia sisältävän tiedoston.. laitoin tuohon deny access.. ja combofixin ikkunaan ilmeistyi teksti:
Combofix on muuttanut aika-asetuksia. Älä muuta niitä takaisin, ne muutetaan myöhemmin..
Sen jälkeen tuli seuraavaa..:
C:\autorun.inf
C:\WINDOWS\faceback.exe
C:\WINDOWS\pskt.ini
C:\system32\drivers.str.sys
C:\system32\mcrh.tmp
C:\Temp\log.txt
D:\Autorun.inf
Valmis Osio_1
Valmis Osio_2
Valmis Osio_3
Valmis Osio_4
Valmis Osio_5
Valmis Osio_6
Valmis Osio_7
ja tämän jälkeen ei ole hetkeen tapahtunut mitään.. tosin nuo osiot valmistuivat hitaalla välillä. Eli montakos osiota tossa on..?
Innerspace-traveller
|
Senior Member
4 tuotearviota
|
2. lokakuuta 2008 @ 20:27 |
Linkki tähän viestiin
|
|
noita osiota on 100 asti eli sammuta se antivir tuon combofixin ajaksi tai skannaa tuolla Malwarebytesillä.
|
|
heilahdus
Newbie
|
2. lokakuuta 2008 @ 21:18 |
Linkki tähän viestiin
|
ComboFix 08-10-01.05 - Turbiina 2008-10-02 20:51:12.3 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.598 [GMT 3:00]
Sijainti: C:\Documents and Settings\Yleinen\Ty?p?yt?\ComboFix.exe
VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !!
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\BM9ff7d710.txt
C:\WINDOWS\BM9ff7d710.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\bkytfq.dll
C:\WINDOWS\system32\cbXPfDwU.dll
C:\WINDOWS\system32\fdfwum.dll
C:\WINDOWS\system32\fnukrl.dll
C:\WINDOWS\system32\irnutn.dll
C:\WINDOWS\system32\iurfoqly.ini
C:\WINDOWS\system32\jbeyfixg.dll
C:\WINDOWS\system32\ljJaYqqo.dll
C:\WINDOWS\system32\lnbdrcgh.dll
C:\WINDOWS\system32\ncpbfklw.dll
C:\WINDOWS\system32\nlthhogp.dll
C:\WINDOWS\system32\oqqYaJjl.ini
C:\WINDOWS\system32\oqqYaJjl.ini2
C:\WINDOWS\system32\raevwnot.dll
C:\WINDOWS\system32\rfxgwi.dll
C:\WINDOWS\system32\sqxqvtlx.dll
C:\WINDOWS\system32\tonwvear.ini
C:\WINDOWS\system32\tskeoafg.dll
C:\WINDOWS\system32\tuvtuTLE.dll
C:\WINDOWS\system32\winrkq32.dll
C:\WINDOWS\system32\winwil32.dll
C:\WINDOWS\system32\vtqgsren.dll
C:\WINDOWS\system32\vvakrvjp.dll
C:\WINDOWS\system32\xipwbnxn.dll
C:\WINDOWS\system32\xltvqxqs.ini
C:\WINDOWS\system32\xxyASmnl.dll
C:\WINDOWS\system32\ylqofrui.dll
C:\WINDOWS\Temp\tmp3.tmp
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-09-02 to 2008-10-02 )))))))))))))))))
.
2008-10-02 17:46 . 2008-10-02 17:46 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-02 17:46 . 2008-10-02 17:46 <KANSIO> d-------- C:\Documents and Settings\Yleinen\Application Data\Malwarebytes
2008-10-02 17:46 . 2008-10-02 17:46 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-02 17:46 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-02 17:46 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-02 16:44 . 2008-10-02 16:44 <KANSIO> d-------- C:\Program Files\Spyware Doctor
2008-10-02 16:44 . 2008-10-02 16:44 <KANSIO> d-------- C:\Program Files\Common Files\PC Tools
2008-10-02 16:44 . 2008-10-02 16:44 <KANSIO> d-------- C:\Documents and Settings\Yleinen\Application Data\PC Tools
2008-10-02 16:44 . 2008-10-02 16:44 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-02 16:44 . 2008-10-02 16:44 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\PC Tools
2008-10-02 16:44 . 2008-07-28 11:29 160,792 --a------ C:\WINDOWS\system32\drivers\pctfw2.sys
2008-10-02 16:44 . 2008-08-25 11:36 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-10-02 16:44 . 2008-08-25 11:36 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-10-02 16:44 . 2008-08-25 11:36 40,840 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-10-02 16:44 . 2008-06-02 15:19 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-10-02 05:49 . 2008-10-02 05:49 <KANSIO> d-------- C:\Documents and Settings\Yleinen\Application Data\vlc
2008-09-30 17:29 . 2008-09-30 17:29 <KANSIO> d--hs---- C:\FOUND.075
2008-09-30 15:37 . 2008-09-30 15:37 <KANSIO> d--hs---- C:\FOUND.074
2008-09-30 15:28 . 2008-09-30 15:28 <KANSIO> d--hs---- C:\FOUND.073
2008-09-29 16:35 . 2008-09-29 16:35 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-09-29 04:25 . 2008-09-29 04:25 964,128 ---hs---- C:\WINDOWS\system32\ptfhhlvi.ini
2008-09-28 20:21 . 2008-09-28 20:21 <KANSIO> d-------- C:\Program Files\Avira
2008-09-28 20:21 . 2008-09-28 20:21 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-09-28 19:27 . 2008-09-28 19:27 <KANSIO> d-------- C:\Documents and Settings\Turbiina\DoctorWeb
2008-09-28 19:14 . 2008-09-28 19:14 30,976 --a------ C:\WINDOWS\system32\drivers\arjyqcm.sys
2008-09-28 04:25 . 2008-09-28 21:31 964,146 ---hs---- C:\WINDOWS\system32\vhtyefat.ini
2008-09-28 02:24 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys
2008-09-28 02:24 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\dllcache\usbser.sys
2008-09-28 02:24 . 2008-09-28 02:24 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-09-28 02:23 . 2008-09-28 02:24 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-09-28 01:17 . 2008-09-28 01:17 964,128 ---hs---- C:\WINDOWS\system32\csipifmd.ini
2008-09-28 01:15 . 2008-09-28 01:15 <KANSIO> dr-hs---- C:\resycled
2008-09-28 01:12 . 2008-09-28 01:12 30,976 --a------ C:\WINDOWS\system32\drivers\mrbtgbrr.sys
2008-09-28 01:11 . 2008-09-28 01:11 30,976 --a------ C:\WINDOWS\system32\drivers\rajiu.sys
2008-09-28 01:11 . 2008-09-28 19:14 2 --a------ C:\-1664818141
2008-09-28 01:06 . 2008-09-28 01:06 36 --a------ C:\WINDOWS\DaemonPlugin.INI
2008-09-28 00:54 . 2008-09-28 00:54 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite
2008-09-28 00:50 . 2008-09-28 00:50 <KANSIO> d-------- C:\Documents and Settings\Antti\Application Data\DAEMON Tools
2008-09-28 00:50 . 2008-09-28 00:50 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-09-17 07:26 . 2008-09-17 07:26 <KANSIO> d-------- C:\Documents and Settings\Antti\Application Data\TERMINAL Studio
2008-09-17 07:18 . 2007-12-13 10:45 9,273,344 --a------ C:\WINDOWS\system32\Magic Forest 3D Screensaver.scr
2008-09-17 07:16 . 2007-12-12 15:24 14,925,824 --a------ C:\WINDOWS\system32\Egypt 3D Screensaver.scr
2008-09-17 07:12 . 2007-12-13 12:32 19,968,000 --a------ C:\WINDOWS\system32\Egyptian Pyramids 3D Screensaver.scr
2008-09-17 07:10 . 2007-12-12 15:48 4,915,200 --a------ C:\WINDOWS\system32\Living Cell 3D Screensaver.scr
2008-09-17 07:09 . 2007-12-12 16:19 3,694,592 --a------ C:\WINDOWS\system32\Sun 3D Screensaver.scr
2008-09-17 07:08 . 2008-08-28 11:27 10,362,880 --a------ C:\WINDOWS\system32\3D Waterfall Screensaver.scr
2008-09-13 21:16 . 2008-09-13 21:16 <KANSIO> d-------- C:\Program Files\Common Files\PCSuite
2008-09-13 21:16 . 2008-09-13 21:16 <KANSIO> d-------- C:\Program Files\Common Files\Nokia
2008-09-13 21:15 . 2008-09-13 21:15 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution
2008-09-13 21:15 . 2008-05-07 07:38 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys
2008-09-13 21:15 . 2008-06-06 09:24 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
2008-09-13 21:14 . 2008-09-13 21:14 <KANSIO> d-------- C:\Program Files\Nokia
2008-09-13 21:14 . 2008-05-07 07:39 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-09-13 21:14 . 2008-05-07 07:38 659,968 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-09-13 21:14 . 2008-05-07 07:38 20,864 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys
2008-09-13 21:14 . 2008-05-07 07:38 17,536 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys
2008-09-13 18:20 . 2008-09-13 18:20 268 --ah----- C:\sqmdata17.sqm
2008-09-13 18:20 . 2008-09-13 18:20 244 --ah----- C:\sqmnoopt17.sqm
2008-09-13 01:59 . 2008-09-13 01:59 268 --ah----- C:\sqmdata16.sqm
2008-09-13 01:59 . 2008-09-13 01:59 244 --ah----- C:\sqmnoopt16.sqm
2008-09-12 21:59 . 2008-09-12 21:59 268 --ah----- C:\sqmdata15.sqm
2008-09-12 21:59 . 2008-09-12 21:59 244 --ah----- C:\sqmnoopt15.sqm
2008-09-12 12:01 . 2008-09-12 12:01 268 --ah----- C:\sqmdata14.sqm
2008-09-12 12:01 . 2008-09-12 12:01 244 --ah----- C:\sqmnoopt14.sqm
2008-09-11 23:50 . 2008-09-11 23:50 268 --ah----- C:\sqmdata13.sqm
2008-09-11 23:50 . 2008-09-11 23:50 244 --ah----- C:\sqmnoopt13.sqm
2008-09-11 15:08 . 2008-09-11 15:08 268 --ah----- C:\sqmdata12.sqm
2008-09-11 15:08 . 2008-09-11 15:08 244 --ah----- C:\sqmnoopt12.sqm
2008-09-11 10:31 . 2008-09-11 10:31 268 --ah----- C:\sqmdata11.sqm
2008-09-11 10:31 . 2008-09-11 10:31 244 --ah----- C:\sqmnoopt11.sqm
2008-09-10 12:29 . 2008-09-10 12:29 268 --ah----- C:\sqmdata10.sqm
2008-09-10 12:29 . 2008-09-10 12:29 244 --ah----- C:\sqmnoopt10.sqm
2008-09-10 11:25 . 2008-09-10 11:25 <KANSIO> d--hs---- C:\FOUND.072
2008-09-10 11:16 . 2008-09-10 11:16 <KANSIO> d--hs---- C:\FOUND.071
2008-09-10 10:03 . 2008-09-10 10:03 <KANSIO> d--hs---- C:\FOUND.070
2008-09-10 09:55 . 2008-09-10 09:55 <KANSIO> d--hs---- C:\FOUND.069
2008-09-10 09:45 . 2008-09-10 09:45 <KANSIO> d--hs---- C:\FOUND.068
2008-09-10 09:27 . 2008-09-10 09:27 <KANSIO> d--hs---- C:\FOUND.067
2008-09-10 09:02 . 2008-09-10 09:02 <KANSIO> d--hs---- C:\FOUND.066
2008-09-10 07:50 . 2008-09-10 07:50 <KANSIO> d--hs---- C:\FOUND.065
2008-09-10 07:32 . 2008-09-10 07:32 <KANSIO> d--hs---- C:\FOUND.064
2008-09-10 05:44 . 2008-09-10 05:44 <KANSIO> d--hs---- C:\FOUND.063
2008-09-10 05:35 . 2008-09-10 05:35 <KANSIO> d--hs---- C:\FOUND.062
2008-09-10 05:17 . 2008-09-10 05:17 <KANSIO> d--hs---- C:\FOUND.061
2008-09-10 04:59 . 2008-09-10 04:59 <KANSIO> d--hs---- C:\FOUND.060
2008-09-10 03:38 . 2008-09-10 03:38 <KANSIO> d--hs---- C:\FOUND.059
2008-09-10 03:29 . 2008-09-10 03:29 <KANSIO> d--hs---- C:\FOUND.058
2008-09-10 03:11 . 2008-09-10 03:11 <KANSIO> d--hs---- C:\FOUND.057
2008-09-10 02:26 . 2008-09-10 02:26 <KANSIO> d--hs---- C:\FOUND.056
2008-09-10 01:59 . 2008-09-10 01:59 <KANSIO> d--hs---- C:\FOUND.055
2008-09-09 22:59 . 2008-09-09 22:59 <KANSIO> d--hs---- C:\FOUND.054
2008-09-09 22:50 . 2008-09-09 22:50 <KANSIO> d--hs---- C:\FOUND.053
2008-09-09 22:32 . 2008-09-09 22:32 <KANSIO> d--hs---- C:\FOUND.052
2008-09-08 02:49 . 2008-09-08 02:49 268 --ah----- C:\sqmdata09.sqm
2008-09-08 02:49 . 2008-09-08 02:49 244 --ah----- C:\sqmnoopt09.sqm
2008-09-07 05:41 . 2008-09-07 05:41 <KANSIO> d-------- C:\Documents and Settings\Antti\Application Data\Winamp
2008-09-04 12:57 . 2008-09-04 12:57 <KANSIO> d--hs---- C:\FOUND.051
2008-09-04 12:30 . 2008-09-04 12:30 <KANSIO> d--hs---- C:\FOUND.050
2008-09-04 12:21 . 2008-09-04 12:21 <KANSIO> d--hs---- C:\FOUND.049
2008-09-04 11:27 . 2008-09-04 11:27 <KANSIO> d--hs---- C:\FOUND.048
2008-09-04 09:48 . 2008-09-04 09:48 <KANSIO> d--hs---- C:\FOUND.047
2008-09-04 09:30 . 2008-09-04 09:30 <KANSIO> d--hs---- C:\FOUND.046
2008-09-03 20:48 . 2008-09-03 20:48 <KANSIO> d--hs---- C:\FOUND.045
2008-09-03 20:39 . 2008-09-03 20:39 <KANSIO> d--hs---- C:\FOUND.044
2008-09-03 20:03 . 2008-09-03 20:03 <KANSIO> d--hs---- C:\FOUND.043
2008-09-03 19:27 . 2008-09-03 19:27 <KANSIO> d--hs---- C:\FOUND.042
2008-09-03 19:09 . 2008-09-03 19:09 <KANSIO> d--hs---- C:\FOUND.041
2008-09-03 16:22 . 2008-09-03 16:22 <KANSIO> d--hs---- C:\FOUND.040
2008-09-02 14:23 . 2006-06-29 17:47 7,942,144 --a------ C:\WINDOWS\system32\Planet Earth 3D Screensaver.scr
2008-09-02 14:23 . 2006-06-29 17:48 3,222 --a------ C:\WINDOWS\system32\PlanetEarth3DScreensaver.html
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-02 02:49 --------- d-----w C:\Documents and Settings\Yleinen\Application Data\vlc
2008-08-31 12:43 --------- d-----w C:\Program Files\Winamp Remote
2008-08-31 12:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\OrbNetworks
2008-08-31 12:41 --------- d-----w C:\Documents and Settings\Turbiina\Application Data\Winamp
2008-08-29 11:29 --------- d-----w C:\Documents and Settings\Turbiina\Application Data\Nokia Multimedia Player
2008-08-24 14:19 --------- d-----w C:\Program Files\PPMate
2008-08-24 12:49 --------- d-----w C:\Program Files\sopcast
2008-08-24 12:43 --------- d-----w C:\Documents and Settings\Antti\Application Data\PPMate
2008-08-16 14:16 --------- d-----w C:\Documents and Settings\Turbiina\Application Data\vlc
2008-08-15 11:02 --------- d-----w C:\Program Files\Astro Gemini Software
2008-08-15 11:02 --------- d-----w C:\Documents and Settings\Antti\Application Data\Astro Gemini Software
2008-08-15 10:04 --------- d-----w C:\Program Files\Google
2008-08-15 03:00 396,512 ----a-w C:\WINDOWS\system32\scrsv.scr
2008-08-14 15:26 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-14 14:10 --------- d-----w C:\Documents and Settings\Antti\Application Data\AdobeUM
2008-08-13 06:16 --------- d-----w C:\Documents and Settings\Antti\Application Data\vlc
2008-08-12 17:27 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Application Data\PC Suite
2008-08-11 09:14 14,663,680 ----a-w C:\WINDOWS\system32\Solar System 3D Screensaver.scr
2008-08-05 10:10 --------- d-----w C:\Documents and Settings\Turbiina\Application Data\BitTorrent
2008-08-04 23:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll
2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2008-07-18 19:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 19:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-18 18:39 586,752 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:31 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-04-17 110592]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-27 7573504]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-04-27 86016]
"ASUS Live Update"="C:\Program Files\ASUS\ASUS Live Update\ALU.exe" [2006-02-21 180224]
"Wireless Console 2"="C:\Program Files\Wireless Console 2\wcourier.exe" [2005-10-17 987136]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-10-21 761945]
"RemoteControl"="C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe" [2004-11-02 32768]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
"ccApp"="c:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 58984]
"Power_Gear"="C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe" [2006-03-06 86016]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2008-07-28 100056]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"ppmate"="C:\Program Files\PPMate\ppmate.exe" [2006-11-03 1527879]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"nwiz"="nwiz.exe" [2006-04-27 C:\WINDOWS\system32\nwiz.exe]
"SMSERIAL"="sm56hlpr.exe" [2006-01-19 C:\WINDOWS\sm56hlpr.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-12-19 C:\WINDOWS\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"system"="kdakl.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=bkytfq.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.asv2"= asusasv2.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\MSNMSGR.EXE"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"D:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Messenger\\MSMSGS.EXE"=
"C:\\Program Files\\PPMate\\ppmate.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"C:\\WINDOWS\\system32\\winver.exe"=
R1 pctfw2;pctfw2;C:\WINDOWS\system32\drivers\pctfw2.sys [2008-07-28 160792]
R3 ASNDIS5;ASNDIS5 Protocol Driver;C:\WINDOWS\system32\ASNDIS5.SYS [2002-09-09 16269]
R3 SynMini;USB2.0 1.3M Web Cam;C:\WINDOWS\system32\Drivers\SynMini.sys [2005-10-03 720470]
R3 SynScan;USB2.0 1.3M Web Cam Still Image;C:\WINDOWS\system32\Drivers\SynScan.sys [2005-10-03 8278]
S3 MBAMSwissArmy;MBAMSwissArmy;C:\WINDOWS\system32\drivers\mbamswissarmy.sys [2008-09-10 38528]
.
'Ajoitetut tehtävät'-kansion sisältö
.
- - - - POISTETUT JÄMÄRIVIT - - - -
BHO-{5ce9a350-efe1-4095-afed-ba8cebd005cf} - C:\WINDOWS\system32\bkytfq.dll
BHO-{6773E026-7906-43B9-9841-8D5F9D8AF245} - C:\WINDOWS\system32\ljJaYqqo.dll
HKLM-Run-C:\WINDOWS\system32\kdxie.exe - C:\WINDOWS\system32\kdxie.exe
HKLM-Run-Zshutdown - c:\sysprep\patch\sysprep.cmd
HKLM-Run-BM9ff7d710 - C:\WINDOWS\system32\vtqgsren.dll
Notify-byXRJAsS - byXRJAsS.dll
Notify-winrkq32 - winrkq32.dll
.
------- Täydentävä tarkistus -------
.
FireFox -: Profile - C:\Documents and Settings\Turbiina\Application Data\Mozilla\Firefox\Profiles\wkne4pbi.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fi
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\DNA\plugins\npbtdna.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-02 21:05:00
Windows 5.1.2600 Service Pack 2 FAT NTAPI
tarkistaa piilotettuja prosesseja ...
tarkistaa piilotettuja käynnistysarvoja ...
tarkistaa piilotettuja tiedostoja ...
C:\WINDOWS\system32\kdakl.exe 65536 bytes
tarkistus on valmis
piilotetut tiedostot: 1
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\krgfgofrjdfdi]
"ImagePath"="\??\C:\WINDOWS\system32\drivers\arjyqcm.sys"
--
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\oesrwzgvn]
"ImagePath"="\??\C:\WINDOWS\system32\drivers\mrbtgbrr.sys"
--
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tckjr]
"ImagePath"="\??\C:\WINDOWS\system32\drivers\rajiu.sys"
.
------------------------ Muut prosessit ------------------------
.
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPROXY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\NORTON INTERNET SECURITY\ISSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SNDSRVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\AVIRA\ANTIVIR PERSONALEDITION CLASSIC\SCHED.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ASUS\Asus ChkMail\ChkMail.exe
C:\PROGRAM FILES\AVIRA\ANTIVIR PERSONALEDITION CLASSIC\AVGUARD.EXE
C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\ALUSCHEDULERSVC.EXE
C:\PROGRAM FILES\NORTON INTERNET SECURITY\NORTON ANTIVIRUS\NAVAPSVC.EXE
C:\WINDOWS\SYSTEM32\NVSVC32.EXE
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\WINDOWS\SYSTEM32\WDFMGR.EXE
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Valmistumisajankohta: 2008-10-02 21:12:02 - kone käynnistettiin uudelleen
ComboFix-quarantined-files.txt 2008-10-02 18:11:48
Ennen ajoa: 28˙573˙368˙320 tavua vapaana
Ajon jälkeen: 33,019,887,616 tavua vapaana
323 --- E O F --- 2008-09-10 18:32:32
ja HJT-loki
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:16:41, on 2.10.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
c:\Program Files\Norton Internet Security\ISSVC.exe
c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\sm56hlpr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ASUS\Asus ChkMail\ChkMail.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://activation.metropolia.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - c:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - c:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exe
O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ppmate] C:\Program Files\PPMate\ppmate.exe -autoplay
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdakl.exe] C:\WINDOWS\system32\kdakl.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ASUS ChkMail.lnk = C:\Program Files\ASUS\Asus ChkMail\ChkMail.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{C334E6E1-50D0-4ABA-AF1C-0FA188ABC0CA}: NameServer = 85.255.114.44,85.255.112.237
O17 - HKLM\System\CCS\Services\Tcpip\..\{E2F002BD-9E0C-4278-856A-493162949161}: NameServer = 85.255.114.44,85.255.112.237
O20 - AppInit_DLLs: bkytfq.dll
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - c:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - c:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
--
End of file - 9553 bytes
Innerspace-traveller
|
Senior Member
4 tuotearviota
|
2. lokakuuta 2008 @ 22:21 |
Linkki tähän viestiin
|
Sammuta selain ja muut ohjelmat Fixin ajaksi. (ei virustorjuntaa)
Käynnistä HijackThis:ja Scan ja ruksaa seuraavat punaisella listatut tiedostot sekä poista ne.(fix Chekked)
O17 - HKLM\System\CCS\Services\Tcpip\..\{C334E6E1-50D0-4ABA-AF1C-0FA188ABC0CA}: NameServer = 85.255.114.44,85.255.112.237
O17 - HKLM\System\CCS\Services\Tcpip\..\{E2F002BD-9E0C-4278-856A-493162949161}: NameServer = 85.255.114.44,85.255.112.237
O20 - AppInit_DLLs: bkytfq.dll
1. Lataa Combofix.exe työpöydällesi jommastakummasta linkistä:
Combofix.exe
Combofix.exe
Avaa Muistio ja kopioi/liitä Lainaus: laatikon sisältö sinne:
Lainaus:
File::
C:\WINDOWS\system32\bkytfq.dll
Tallenna nimellä CFScript (itse asiassa combofix tunnistaa tuon vaikka tiedostopääte ei olisi
edes .txt).
Sitten raahaa ja pudota CFScript ComboFix.exeen kuten alla.(Älä klikkaa)
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne.
Tyhjennä roskakori ja käynnistä koneesi uudelleen.
Postita tänne seuraavat lokit:
* Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
* (C:\ComboFix.txt) raportti
*
Lataa Malwarebytes' Anti-Malware työpöydällesi.
* Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
* Lopuksi varmistu, että seuraavat on valittu: Päivitä Malwarebytes' Anti-Malware ja Käynnistä Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Lopeta.
* Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
* Kun ohjelma on latautunut, valitse Suorita täysi tarkistus ja klikkaa Tarkista.
* Kun skanni on valmis, klikkaa OK ja sitten Näytä tulokset nähdäksesi tulokset.
* Varmistu, että kaikki on merkitty ja klikkaa Poista valitut.
* Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös
täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
* Lähetä lokin sisältö seuraavassa viestissäsi + uusi hjt-loki.
|
|
heilahdus
Newbie
|
2. lokakuuta 2008 @ 23:47 |
Linkki tähän viestiin
|
|
Scripti käytetty Combofixissä ja kone käynnistyi tsekkauksen jälkeen uudelleen.. Avir valitti heti uudelleenkäynnistäessä löytäneensä seuraavan viruksen: TR\DNSChanger.jik tiedostosta C:\WINDOWS\system32\kdakl.exe
ja nyt kone ei päästä mua nettiin laittamaan lokia ainakaan ilman taas uutta käynnistystä. Pitäiskö tolle tehdä tässä välissä jotain vai laitanko vaan lokit jos onnistuu ja jatkan Malwarebytesilla vai hyppäänkö suoraan tuohon Mbamiin ??
Innerspace-traveller
|
|
heilahdus
Newbie
|
3. lokakuuta 2008 @ 01:43 |
Linkki tähän viestiin
|
Ei pyörinyt vieläkään Malwarebytes läpi asti.. Tässä välissä lokia Combofixistä ja HJT:stä. Avir ilmotteli Nortonin temp -fileistä juoksevalla numeroinnilla joku.gen -läppää, jotain statistiikkakalastelua. Poistin koko Nortonin palomuurin ja Anti-virus 2005:n ja vaihdoin tilalle ZoneAlarmin ja jätin pelkän Aviran Antivir Personal Edition Classicin hoitelemaan virustorjuntaa.. ZoneAlarmin anti-virusosaa en ottanut käyttöön.. Tässä näitä lokeja ajalta ennen Malwarebytesia:
ComboFix 08-10-01.05 - Turbiina 2008-10-02 23:13:04.4 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.579 [GMT 3:00]
Sijainti: C:\Documents and Settings\Turbiina\Ty?p?yt?\ComboFix.exe
Käytetyt komentorivivalitsimet :: C:\Documents and Settings\Turbiina\Ty?p?yt?\CFScript.txt
* Uusi palautuspiste luotu
VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !!
FILE ::
C:\WINDOWS\system32\bkytfq.dll
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-09-02 to 2008-10-02 )))))))))))))))))
.
2008-10-02 17:46 . 2008-10-02 17:46 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-02 17:46 . 2008-10-02 17:46 <KANSIO> d-------- C:\Documents and Settings\Yleinen\Application Data\Malwarebytes
2008-10-02 17:46 . 2008-10-02 17:46 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-02 17:46 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-02 17:46 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-02 16:44 . 2008-10-02 16:44 <KANSIO> d-------- C:\Program Files\Spyware Doctor
2008-10-02 16:44 . 2008-10-02 16:44 <KANSIO> d-------- C:\Program Files\Common Files\PC Tools
2008-10-02 16:44 . 2008-10-02 16:44 <KANSIO> d-------- C:\Documents and Settings\Yleinen\Application Data\PC Tools
2008-10-02 16:44 . 2008-10-02 16:44 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-02 16:44 . 2008-10-02 16:44 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\PC Tools
2008-10-02 16:44 . 2008-07-28 11:29 160,792 --a------ C:\WINDOWS\system32\drivers\pctfw2.sys
2008-10-02 16:44 . 2008-08-25 11:36 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-10-02 16:44 . 2008-08-25 11:36 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-10-02 16:44 . 2008-08-25 11:36 40,840 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-10-02 16:44 . 2008-06-02 15:19 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-10-02 05:49 . 2008-10-02 05:49 <KANSIO> d-------- C:\Documents and Settings\Yleinen\Application Data\vlc
2008-09-30 17:29 . 2008-09-30 17:29 <KANSIO> d--hs---- C:\FOUND.075
2008-09-30 15:37 . 2008-09-30 15:37 <KANSIO> d--hs---- C:\FOUND.074
2008-09-30 15:28 . 2008-09-30 15:28 <KANSIO> d--hs---- C:\FOUND.073
2008-09-29 16:35 . 2008-09-29 16:35 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-09-29 04:25 . 2008-09-29 04:25 964,128 ---hs---- C:\WINDOWS\system32\ptfhhlvi.ini
2008-09-28 20:21 . 2008-09-28 20:21 <KANSIO> d-------- C:\Program Files\Avira
2008-09-28 20:21 . 2008-09-28 20:21 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-09-28 19:27 . 2008-09-28 19:27 <KANSIO> d-------- C:\Documents and Settings\Turbiina\DoctorWeb
2008-09-28 04:25 . 2008-09-28 21:31 964,146 ---hs---- C:\WINDOWS\system32\vhtyefat.ini
2008-09-28 02:24 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys
2008-09-28 02:24 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\dllcache\usbser.sys
2008-09-28 02:24 . 2008-09-28 02:24 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-09-28 02:23 . 2008-09-28 02:24 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-09-28 01:17 . 2008-09-28 01:17 964,128 ---hs---- C:\WINDOWS\system32\csipifmd.ini
2008-09-28 01:15 . 2008-09-28 01:15 <KANSIO> dr-hs---- C:\resycled
2008-09-28 01:11 . 2008-09-28 19:14 2 --a------ C:\-1664818141
2008-09-28 01:06 . 2008-09-28 01:06 36 --a------ C:\WINDOWS\DaemonPlugin.INI
2008-09-28 00:54 . 2008-09-28 00:54 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite
2008-09-28 00:50 . 2008-09-28 00:50 <KANSIO> d-------- C:\Documents and Settings\Antti\Application Data\DAEMON Tools
2008-09-28 00:50 . 2008-09-28 00:50 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-09-17 07:26 . 2008-09-17 07:26 <KANSIO> d-------- C:\Documents and Settings\Antti\Application Data\TERMINAL Studio
2008-09-17 07:18 . 2007-12-13 10:45 9,273,344 --a------ C:\WINDOWS\system32\Magic Forest 3D Screensaver.scr
2008-09-17 07:16 . 2007-12-12 15:24 14,925,824 --a------ C:\WINDOWS\system32\Egypt 3D Screensaver.scr
2008-09-17 07:12 . 2007-12-13 12:32 19,968,000 --a------ C:\WINDOWS\system32\Egyptian Pyramids 3D Screensaver.scr
2008-09-17 07:10 . 2007-12-12 15:48 4,915,200 --a------ C:\WINDOWS\system32\Living Cell 3D Screensaver.scr
2008-09-17 07:09 . 2007-12-12 16:19 3,694,592 --a------ C:\WINDOWS\system32\Sun 3D Screensaver.scr
2008-09-17 07:08 . 2008-08-28 11:27 10,362,880 --a------ C:\WINDOWS\system32\3D Waterfall Screensaver.scr
2008-09-13 21:16 . 2008-09-13 21:16 <KANSIO> d-------- C:\Program Files\Common Files\PCSuite
2008-09-13 21:16 . 2008-09-13 21:16 <KANSIO> d-------- C:\Program Files\Common Files\Nokia
2008-09-13 21:15 . 2008-09-13 21:15 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution
2008-09-13 21:15 . 2008-05-07 07:38 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys
2008-09-13 21:15 . 2008-06-06 09:24 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
2008-09-13 21:14 . 2008-09-13 21:14 <KANSIO> d-------- C:\Program Files\Nokia
2008-09-13 21:14 . 2008-05-07 07:39 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-09-13 21:14 . 2008-05-07 07:38 659,968 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-09-13 21:14 . 2008-05-07 07:38 20,864 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys
2008-09-13 21:14 . 2008-05-07 07:38 17,536 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys
2008-09-13 18:20 . 2008-09-13 18:20 268 --ah----- C:\sqmdata17.sqm
2008-09-13 18:20 . 2008-09-13 18:20 244 --ah----- C:\sqmnoopt17.sqm
2008-09-13 01:59 . 2008-09-13 01:59 268 --ah----- C:\sqmdata16.sqm
2008-09-13 01:59 . 2008-09-13 01:59 244 --ah----- C:\sqmnoopt16.sqm
2008-09-12 21:59 . 2008-09-12 21:59 268 --ah----- C:\sqmdata15.sqm
2008-09-12 21:59 . 2008-09-12 21:59 244 --ah----- C:\sqmnoopt15.sqm
2008-09-12 12:01 . 2008-09-12 12:01 268 --ah----- C:\sqmdata14.sqm
2008-09-12 12:01 . 2008-09-12 12:01 244 --ah----- C:\sqmnoopt14.sqm
2008-09-11 23:50 . 2008-09-11 23:50 268 --ah----- C:\sqmdata13.sqm
2008-09-11 23:50 . 2008-09-11 23:50 244 --ah----- C:\sqmnoopt13.sqm
2008-09-11 15:08 . 2008-09-11 15:08 268 --ah----- C:\sqmdata12.sqm
2008-09-11 15:08 . 2008-09-11 15:08 244 --ah----- C:\sqmnoopt12.sqm
2008-09-11 10:31 . 2008-09-11 10:31 268 --ah----- C:\sqmdata11.sqm
2008-09-11 10:31 . 2008-09-11 10:31 244 --ah----- C:\sqmnoopt11.sqm
2008-09-10 12:29 . 2008-09-10 12:29 268 --ah----- C:\sqmdata10.sqm
2008-09-10 12:29 . 2008-09-10 12:29 244 --ah----- C:\sqmnoopt10.sqm
2008-09-10 11:25 . 2008-09-10 11:25 <KANSIO> d--hs---- C:\FOUND.072
2008-09-10 11:16 . 2008-09-10 11:16 <KANSIO> d--hs---- C:\FOUND.071
2008-09-10 10:03 . 2008-09-10 10:03 <KANSIO> d--hs---- C:\FOUND.070
2008-09-10 09:55 . 2008-09-10 09:55 <KANSIO> d--hs---- C:\FOUND.069
2008-09-10 09:45 . 2008-09-10 09:45 <KANSIO> d--hs---- C:\FOUND.068
2008-09-10 09:27 . 2008-09-10 09:27 <KANSIO> d--hs---- C:\FOUND.067
2008-09-10 09:02 . 2008-09-10 09:02 <KANSIO> d--hs---- C:\FOUND.066
2008-09-10 07:50 . 2008-09-10 07:50 <KANSIO> d--hs---- C:\FOUND.065
2008-09-10 07:32 . 2008-09-10 07:32 <KANSIO> d--hs---- C:\FOUND.064
2008-09-10 05:44 . 2008-09-10 05:44 <KANSIO> d--hs---- C:\FOUND.063
2008-09-10 05:35 . 2008-09-10 05:35 <KANSIO> d--hs---- C:\FOUND.062
2008-09-10 05:17 . 2008-09-10 05:17 <KANSIO> d--hs---- C:\FOUND.061
2008-09-10 04:59 . 2008-09-10 04:59 <KANSIO> d--hs---- C:\FOUND.060
2008-09-10 03:38 . 2008-09-10 03:38 <KANSIO> d--hs---- C:\FOUND.059
2008-09-10 03:29 . 2008-09-10 03:29 <KANSIO> d--hs---- C:\FOUND.058
2008-09-10 03:11 . 2008-09-10 03:11 <KANSIO> d--hs---- C:\FOUND.057
2008-09-10 02:26 . 2008-09-10 02:26 <KANSIO> d--hs---- C:\FOUND.056
2008-09-10 01:59 . 2008-09-10 01:59 <KANSIO> d--hs---- C:\FOUND.055
2008-09-09 22:59 . 2008-09-09 22:59 <KANSIO> d--hs---- C:\FOUND.054
2008-09-09 22:50 . 2008-09-09 22:50 <KANSIO> d--hs---- C:\FOUND.053
2008-09-09 22:32 . 2008-09-09 22:32 <KANSIO> d--hs---- C:\FOUND.052
2008-09-08 02:49 . 2008-09-08 02:49 268 --ah----- C:\sqmdata09.sqm
2008-09-08 02:49 . 2008-09-08 02:49 244 --ah----- C:\sqmnoopt09.sqm
2008-09-07 05:41 . 2008-09-07 05:41 <KANSIO> d-------- C:\Documents and Settings\Antti\Application Data\Winamp
2008-09-04 12:57 . 2008-09-04 12:57 <KANSIO> d--hs---- C:\FOUND.051
2008-09-04 12:30 . 2008-09-04 12:30 <KANSIO> d--hs---- C:\FOUND.050
2008-09-04 12:21 . 2008-09-04 12:21 <KANSIO> d--hs---- C:\FOUND.049
2008-09-04 11:27 . 2008-09-04 11:27 <KANSIO> d--hs---- C:\FOUND.048
2008-09-04 09:48 . 2008-09-04 09:48 <KANSIO> d--hs---- C:\FOUND.047
2008-09-04 09:30 . 2008-09-04 09:30 <KANSIO> d--hs---- C:\FOUND.046
2008-09-03 20:48 . 2008-09-03 20:48 <KANSIO> d--hs---- C:\FOUND.045
2008-09-03 20:39 . 2008-09-03 20:39 <KANSIO> d--hs---- C:\FOUND.044
2008-09-03 20:03 . 2008-09-03 20:03 <KANSIO> d--hs---- C:\FOUND.043
2008-09-03 19:27 . 2008-09-03 19:27 <KANSIO> d--hs---- C:\FOUND.042
2008-09-03 19:09 . 2008-09-03 19:09 <KANSIO> d--hs---- C:\FOUND.041
2008-09-03 16:22 . 2008-09-03 16:22 <KANSIO> d--hs---- C:\FOUND.040
2008-09-02 14:23 . 2006-06-29 17:47 7,942,144 --a------ C:\WINDOWS\system32\Planet Earth 3D Screensaver.scr
2008-09-02 14:23 . 2006-06-29 17:48 3,222 --a------ C:\WINDOWS\system32\PlanetEarth3DScreensaver.html
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-02 02:49 --------- d-----w C:\Documents and Settings\Yleinen\Application Data\vlc
2008-08-31 12:43 --------- d-----w C:\Program Files\Winamp Remote
2008-08-31 12:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\OrbNetworks
2008-08-31 12:41 --------- d-----w C:\Documents and Settings\Turbiina\Application Data\Winamp
2008-08-29 11:29 --------- d-----w C:\Documents and Settings\Turbiina\Application Data\Nokia Multimedia Player
2008-08-24 14:19 --------- d-----w C:\Program Files\PPMate
2008-08-24 12:49 --------- d-----w C:\Program Files\sopcast
2008-08-24 12:43 --------- d-----w C:\Documents and Settings\Antti\Application Data\PPMate
2008-08-16 14:16 --------- d-----w C:\Documents and Settings\Turbiina\Application Data\vlc
2008-08-15 11:02 --------- d-----w C:\Program Files\Astro Gemini Software
2008-08-15 11:02 --------- d-----w C:\Documents and Settings\Antti\Application Data\Astro Gemini Software
2008-08-15 10:04 --------- d-----w C:\Program Files\Google
2008-08-15 03:00 396,512 ----a-w C:\WINDOWS\system32\scrsv.scr
2008-08-14 15:26 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-14 14:10 --------- d-----w C:\Documents and Settings\Antti\Application Data\AdobeUM
2008-08-13 06:16 --------- d-----w C:\Documents and Settings\Antti\Application Data\vlc
2008-08-12 17:27 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Application Data\PC Suite
2008-08-11 09:14 14,663,680 ----a-w C:\WINDOWS\system32\Solar System 3D Screensaver.scr
2008-08-05 10:10 --------- d-----w C:\Documents and Settings\Turbiina\Application Data\BitTorrent
2008-08-04 23:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll
2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2008-07-18 19:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 19:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-18 18:39 586,752 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:31 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C:\WINDOWS\system32\kdakl.exe"="C:\WINDOWS\system32\kdakl.exe" [2007-06-13 53248]
"HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-04-17 110592]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-27 7573504]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-04-27 86016]
"ASUS Live Update"="C:\Program Files\ASUS\ASUS Live Update\ALU.exe" [2006-02-21 180224]
"Wireless Console 2"="C:\Program Files\Wireless Console 2\wcourier.exe" [2005-10-17 987136]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-10-21 761945]
"RemoteControl"="C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe" [2004-11-02 32768]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
"ccApp"="c:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 58984]
"Power_Gear"="C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe" [2006-03-06 86016]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2008-07-28 100056]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"ppmate"="C:\Program Files\PPMate\ppmate.exe" [2006-11-03 1527879]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"nwiz"="nwiz.exe" [2006-04-27 C:\WINDOWS\system32\nwiz.exe]
"SMSERIAL"="sm56hlpr.exe" [2006-01-19 C:\WINDOWS\sm56hlpr.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-12-19 C:\WINDOWS\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.asv2"= asusasv2.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\MSNMSGR.EXE"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"D:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Messenger\\MSMSGS.EXE"=
"C:\\Program Files\\PPMate\\ppmate.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=
"C:\\WINDOWS\\system32\\winver.exe"=
R1 pctfw2;pctfw2;C:\WINDOWS\system32\drivers\pctfw2.sys [2008-07-28 160792]
R3 SynMini;USB2.0 1.3M Web Cam;C:\WINDOWS\system32\Drivers\SynMini.sys [2005-10-03 720470]
R3 SynScan;USB2.0 1.3M Web Cam Still Image;C:\WINDOWS\system32\Drivers\SynScan.sys [2005-10-03 8278]
S3 ASNDIS5;ASNDIS5 Protocol Driver;C:\WINDOWS\system32\ASNDIS5.SYS [2002-09-09 16269]
S3 MBAMSwissArmy;MBAMSwissArmy;C:\WINDOWS\system32\drivers\mbamswissarmy.sys [2008-09-10 38528]
.
'Ajoitetut tehtävät'-kansion sisältö
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-02 23:26:12
Windows 5.1.2600 Service Pack 2 FAT NTAPI
tarkistaa piilotettuja prosesseja ...
tarkistaa piilotettuja käynnistysarvoja ...
tarkistaa piilotettuja tiedostoja ...
tarkistus on valmis
piilotetut tiedostot: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\krgfgofrjdfdi]
"ImagePath"="\??\C:\WINDOWS\system32\drivers\arjyqcm.sys"
--
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\oesrwzgvn]
"ImagePath"="\??\C:\WINDOWS\system32\drivers\mrbtgbrr.sys"
--
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tckjr]
"ImagePath"="\??\C:\WINDOWS\system32\drivers\rajiu.sys"
.
------------------------ Muut prosessit ------------------------
.
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCPROXY.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCSETMGR.EXE
C:\PROGRAM FILES\NORTON INTERNET SECURITY\ISSVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\SNDSRVC.EXE
C:\PROGRAM FILES\COMMON FILES\SYMANTEC SHARED\CCEVTMGR.EXE
C:\PROGRAM FILES\AVIRA\ANTIVIR PERSONALEDITION CLASSIC\SCHED.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRAM FILES\SYMANTEC\LIVEUPDATE\ALUSCHEDULERSVC.EXE
C:\WINDOWS\SYSTEM32\NVSVC32.EXE
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\GUARDGUI.EXE
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
.
**************************************************************************
.
Valmistumisajankohta: 2008-10-02 23:30:56 - kone käynnistettiin uudelleen
ComboFix-quarantined-files.txt 2008-10-02 20:30:52
ComboFix2.txt 2008-10-02 18:12:10
Ennen ajoa: 33˙034˙371˙072 tavua vapaana
Ajon jälkeen: 33,014,677,504 tavua vapaana
275 --- E O F --- 2008-09-10 18:32:32
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:31:43, on 3.10.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\sm56hlpr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\ASUS\Asus ChkMail\ChkMail.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdakl.exe] C:\WINDOWS\system32\kdakl.exe
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exe
O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ppmate] C:\Program Files\PPMate\ppmate.exe -autoplay
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [updateMgr] c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ASUS ChkMail.lnk = C:\Program Files\ASUS\Asus ChkMail\ChkMail.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
--
End of file - 6515 bytes
Innerspace-traveller
|
|
heilahdus
Newbie
|
3. lokakuuta 2008 @ 03:55 |
Linkki tähän viestiin
|
Menipäs se mbam:kin loppuun asti.. jätin sen tarkista aina heuristiset kohteet -kohdan tyhjäksi kylläkin.. Samaan aikaan päällä ollut AvirGuard kyllä aukoi useamman "pop-upin" kuin noita saastuneita ilmaantui, mut sitä mukaa kun sitä deny accessia näpyttelin niin homma kuitenkin pyöri eteenpäin. Loki tallennettu ja liitettynä alle sekä tartunnan saaneet poistettu, jatkoksi vielä uusi HJT-loki.
Malwarebytes' Anti-Malware 1.28
Tietokantaversio: 1226
Windows 5.1.2600 Service Pack 2
3.10.2008 3:48:50
mbam-log-2008-10-03 (03-48-50).txt
Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
Tarkistetut kohteet: 58571
Kulunut aika: 18 minute(s), 38 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 1
Saastuneita tiedostoja: 15
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
C:\resycled (Trojan.DNSChanger) -> Quarantined and deleted successfully.
Saastuneita tiedostoja:
C:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP77\A0326780.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP78\A0330780.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP79\A0358791.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP80\A0362832.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP80\A0362834.DLL (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP80\A0362839.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP80\A0362840.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP80\A0362842.DLL (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP80\A0362849.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\fdfwum.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\irnutn.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\ncpbfklw.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\nlthhogp.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\rfxgwi.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\xipwbnxn.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:54:06, on 3.10.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\sm56hlpr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ASUS\Asus ChkMail\ChkMail.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdakl.exe] C:\WINDOWS\system32\kdakl.exe
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exe
O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ppmate] C:\Program Files\PPMate\ppmate.exe -autoplay
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [updateMgr] c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ASUS ChkMail.lnk = C:\Program Files\ASUS\Asus ChkMail\ChkMail.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
--
End of file - 6410 bytes
Innerspace-traveller
|
Senior Member
4 tuotearviota
|
3. lokakuuta 2008 @ 11:42 |
Linkki tähän viestiin
|
Jooh eipä näemmä tunnistanut Malwarebytesi tuota kdakl.exe örkkiä eli poistetaan Combolla sekin.
1. Lataa Combofix.exe työpöydällesi jommastakummasta linkistä:
Combofix.exe
Combofix.exe
Avaa Muistio ja kopioi/liitä Lainaus: laatikon sisältö sinne:
Lainaus:
File::
C:\WINDOWS\system32\kdakl.exe
C:\WINDOWS\system32\ptfhhlvi.ini
C:\WINDOWS\system32\vhtyefat.ini
C:\WINDOWS\system32\csipifmd.ini
Tallenna nimellä CFScript (itse asiassa combofix tunnistaa tuon vaikka tiedostopääte ei olisi
edes .txt).
Sitten raahaa ja pudota CFScript ComboFix.exeen kuten alla.(Älä klikkaa)
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne.
Sammuta selain ja muut ohjelmat Fixin ajaksi. (ei virustorjuntaa)
Käynnistä HijackThis:ja Scan ja ruksaa seuraavat punaisella listatut tiedostot sekä poista ne.(fix Chekked)
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdakl.exe] C:\WINDOWS\system32\kdakl.exe
Tyhjennä roskakori ja käynnistä koneesi uudelleen.
Postita tänne seuraavat lokit:
* Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
* (C:\ComboFix.txt) raportti
*
Skannaa koneesi Kaspersky Online Skannerilla
* Lue läpi vaatimukset ja yksityisyyssäännökset ja klikkaa Accept.
* Skannerin ja virustietokannan lataus alkaa. Sinulta kysytään sallitko Kasperskyltä tulevan ohjelman asentamisen. Klikkaa Aja/Run.
* Kun lataus on valmis, klikkaa Settings.
* Varmistu, että seuraavat kohdat on valittu. Jos ne eivät ole, valitse ne ja klikkaa Save:
Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Mail databases
* Klikkaa Oma Tietokone, My Computer Scan-kohdan alapuolelta.
* Kun tarkistus on valmis, tulokset näytetään. Klikkaa View Scan Report.
* Näet listan saastuneista kohteista. Klikkaa Save Report As....
* Tallenna tiedosto työpöydällesi. Muuta Tiedostotyyppi/Files of type muotoon Tekstitiedosto/Text file(.txt) ennen kuin klikkaat Save.
* Kopioi ja liitä tiedoston sisältö seuraavaan vastaukseesi uuden HijackThis-lokin kera
|
|
heilahdus
Newbie
|
3. lokakuuta 2008 @ 12:42 |
Linkki tähän viestiin
|
Tässä tuoreet lokit, HJT ei enää löytänyt
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdakl.exe] C:\WINDOWS\system32\kdakl.exe -riviä, todennäköisesti siksi, että ajoin yöllä CCleanerillä rekisterin putsauksen..? Äsken ZoneAlarm alkoi itsekseen skannailemaan ja ennen kuin olin ehtinyt skipata ajon toistaiseksi, oli se jo pari tartuntaa löytänyt..
ComboFix 08-10-01.05 - Antti 2008-10-03 12:18:31.5 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.617 [GMT 3:00]
Sijainti: C:\Documents and Settings\Antti\Ty?p?yt?\ComboFix.exe
Käytetyt komentorivivalitsimet :: C:\Documents and Settings\Antti\Ty?p?yt?\CFScript.txt
* Uusi palautuspiste luotu
VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !!
FILE ::
C:\WINDOWS\system32\csipifmd.ini
C:\WINDOWS\system32\kdakl.exe
C:\WINDOWS\system32\ptfhhlvi.ini
C:\WINDOWS\system32\vhtyefat.ini
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\csipifmd.ini
C:\WINDOWS\system32\drivers\str.sys
C:\WINDOWS\system32\ptfhhlvi.ini
C:\WINDOWS\system32\vhtyefat.ini
C:\WINDOWS\Temp\log.txt
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-09-03 to 2008-10-03 )))))))))))))))))
.
2008-10-03 04:09 . 2008-10-03 04:09 <KANSIO> d-------- C:\Program Files\CCleaner
2008-10-03 02:23 . 2008-10-03 02:23 <KANSIO> d-------- C:\Documents and Settings\Antti\Application Data\Malwarebytes
2008-10-03 01:28 . 2008-10-03 01:28 <KANSIO> d-------- C:\Documents and Settings\Antti\Application Data\MailFrontier
2008-10-03 01:25 . 2008-10-03 12:11 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-10-03 01:25 . 2008-10-03 12:11 32 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-10-03 01:21 . 2008-10-03 01:21 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-10-03 01:05 . 2008-10-03 01:05 <KANSIO> d-------- C:\WINDOWS\Internet Logs
2008-10-03 01:05 . 2008-10-03 01:05 <KANSIO> d-------- C:\Program Files\Zone Labs
2008-10-03 00:37 . 2008-10-03 00:37 <KANSIO> d-------- C:\Documents and Settings\LocalService\Application Data\AdobeUM
2008-10-02 23:52 . 2008-10-02 23:52 <KANSIO> d-------- C:\Documents and Settings\Turbiina\Application Data\Malwarebytes
2008-10-02 17:46 . 2008-10-02 17:46 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-10-02 17:46 . 2008-10-02 17:46 <KANSIO> d-------- C:\Documents and Settings\Yleinen\Application Data\Malwarebytes
2008-10-02 17:46 . 2008-10-02 17:46 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-02 17:46 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-02 17:46 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-02 16:44 . 2008-10-02 16:44 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-02 05:49 . 2008-10-02 05:49 <KANSIO> d-------- C:\Documents and Settings\Yleinen\Application Data\vlc
2008-09-30 17:29 . 2008-09-30 17:29 <KANSIO> d--hs---- C:\FOUND.075
2008-09-30 15:37 . 2008-09-30 15:37 <KANSIO> d--hs---- C:\FOUND.074
2008-09-30 15:28 . 2008-09-30 15:28 <KANSIO> d--hs---- C:\FOUND.073
2008-09-29 16:35 . 2008-09-29 16:35 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-09-28 20:21 . 2008-09-28 20:21 <KANSIO> d-------- C:\Program Files\Avira
2008-09-28 20:21 . 2008-09-28 20:21 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-09-28 19:27 . 2008-09-28 19:27 <KANSIO> d-------- C:\Documents and Settings\Turbiina\DoctorWeb
2008-09-28 02:24 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys
2008-09-28 02:24 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\dllcache\usbser.sys
2008-09-28 02:24 . 2008-09-28 02:24 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-09-28 02:23 . 2008-09-28 02:24 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-09-28 01:11 . 2008-09-28 19:14 2 --a------ C:\-1664818141
2008-09-28 01:06 . 2008-09-28 01:06 36 --a------ C:\WINDOWS\DaemonPlugin.INI
2008-09-28 00:54 . 2008-09-28 00:54 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite
2008-09-28 00:50 . 2008-09-28 00:50 <KANSIO> d-------- C:\Documents and Settings\Antti\Application Data\DAEMON Tools
2008-09-28 00:50 . 2008-09-28 00:50 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-09-17 07:26 . 2008-09-17 07:26 <KANSIO> d-------- C:\Documents and Settings\Antti\Application Data\TERMINAL Studio
2008-09-17 07:18 . 2007-12-13 10:45 9,273,344 --a------ C:\WINDOWS\system32\Magic Forest 3D Screensaver.scr
2008-09-17 07:16 . 2007-12-12 15:24 14,925,824 --a------ C:\WINDOWS\system32\Egypt 3D Screensaver.scr
2008-09-17 07:12 . 2007-12-13 12:32 19,968,000 --a------ C:\WINDOWS\system32\Egyptian Pyramids 3D Screensaver.scr
2008-09-17 07:10 . 2007-12-12 15:48 4,915,200 --a------ C:\WINDOWS\system32\Living Cell 3D Screensaver.scr
2008-09-17 07:09 . 2007-12-12 16:19 3,694,592 --a------ C:\WINDOWS\system32\Sun 3D Screensaver.scr
2008-09-17 07:08 . 2008-08-28 11:27 10,362,880 --a------ C:\WINDOWS\system32\3D Waterfall Screensaver.scr
2008-09-13 21:16 . 2008-09-13 21:16 <KANSIO> d-------- C:\Program Files\Common Files\PCSuite
2008-09-13 21:16 . 2008-09-13 21:16 <KANSIO> d-------- C:\Program Files\Common Files\Nokia
2008-09-13 21:15 . 2008-09-13 21:15 <KANSIO> d-------- C:\Program Files\PC Connectivity Solution
2008-09-13 21:15 . 2008-05-07 07:38 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys
2008-09-13 21:15 . 2008-06-06 09:24 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys
2008-09-13 21:14 . 2008-09-13 21:14 <KANSIO> d-------- C:\Program Files\Nokia
2008-09-13 21:14 . 2008-05-07 07:39 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-09-13 21:14 . 2008-05-07 07:38 659,968 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-09-13 21:14 . 2008-05-07 07:38 20,864 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys
2008-09-13 21:14 . 2008-05-07 07:38 17,536 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys
2008-09-13 18:20 . 2008-09-13 18:20 268 --ah----- C:\sqmdata17.sqm
2008-09-13 18:20 . 2008-09-13 18:20 244 --ah----- C:\sqmnoopt17.sqm
2008-09-13 01:59 . 2008-09-13 01:59 268 --ah----- C:\sqmdata16.sqm
2008-09-13 01:59 . 2008-09-13 01:59 244 --ah----- C:\sqmnoopt16.sqm
2008-09-12 21:59 . 2008-09-12 21:59 268 --ah----- C:\sqmdata15.sqm
2008-09-12 21:59 . 2008-09-12 21:59 244 --ah----- C:\sqmnoopt15.sqm
2008-09-12 12:01 . 2008-09-12 12:01 268 --ah----- C:\sqmdata14.sqm
2008-09-12 12:01 . 2008-09-12 12:01 244 --ah----- C:\sqmnoopt14.sqm
2008-09-11 23:50 . 2008-09-11 23:50 268 --ah----- C:\sqmdata13.sqm
2008-09-11 23:50 . 2008-09-11 23:50 244 --ah----- C:\sqmnoopt13.sqm
2008-09-11 15:08 . 2008-09-11 15:08 268 --ah----- C:\sqmdata12.sqm
2008-09-11 15:08 . 2008-09-11 15:08 244 --ah----- C:\sqmnoopt12.sqm
2008-09-11 10:31 . 2008-09-11 10:31 268 --ah----- C:\sqmdata11.sqm
2008-09-11 10:31 . 2008-09-11 10:31 244 --ah----- C:\sqmnoopt11.sqm
2008-09-10 12:29 . 2008-09-10 12:29 268 --ah----- C:\sqmdata10.sqm
2008-09-10 12:29 . 2008-09-10 12:29 244 --ah----- C:\sqmnoopt10.sqm
2008-09-10 11:25 . 2008-09-10 11:25 <KANSIO> d--hs---- C:\FOUND.072
2008-09-10 11:16 . 2008-09-10 11:16 <KANSIO> d--hs---- C:\FOUND.071
2008-09-10 10:03 . 2008-09-10 10:03 <KANSIO> d--hs---- C:\FOUND.070
2008-09-10 09:55 . 2008-09-10 09:55 <KANSIO> d--hs---- C:\FOUND.069
2008-09-10 09:45 . 2008-09-10 09:45 <KANSIO> d--hs---- C:\FOUND.068
2008-09-10 09:27 . 2008-09-10 09:27 <KANSIO> d--hs---- C:\FOUND.067
2008-09-10 09:02 . 2008-09-10 09:02 <KANSIO> d--hs---- C:\FOUND.066
2008-09-10 07:50 . 2008-09-10 07:50 <KANSIO> d--hs---- C:\FOUND.065
2008-09-10 07:32 . 2008-09-10 07:32 <KANSIO> d--hs---- C:\FOUND.064
2008-09-10 05:44 . 2008-09-10 05:44 <KANSIO> d--hs---- C:\FOUND.063
2008-09-10 05:35 . 2008-09-10 05:35 <KANSIO> d--hs---- C:\FOUND.062
2008-09-10 05:17 . 2008-09-10 05:17 <KANSIO> d--hs---- C:\FOUND.061
2008-09-10 04:59 . 2008-09-10 04:59 <KANSIO> d--hs---- C:\FOUND.060
2008-09-10 03:38 . 2008-09-10 03:38 <KANSIO> d--hs---- C:\FOUND.059
2008-09-10 03:29 . 2008-09-10 03:29 <KANSIO> d--hs---- C:\FOUND.058
2008-09-10 03:11 . 2008-09-10 03:11 <KANSIO> d--hs---- C:\FOUND.057
2008-09-10 02:26 . 2008-09-10 02:26 <KANSIO> d--hs---- C:\FOUND.056
2008-09-10 01:59 . 2008-09-10 01:59 <KANSIO> d--hs---- C:\FOUND.055
2008-09-09 22:59 . 2008-09-09 22:59 <KANSIO> d--hs---- C:\FOUND.054
2008-09-09 22:50 . 2008-09-09 22:50 <KANSIO> d--hs---- C:\FOUND.053
2008-09-09 22:32 . 2008-09-09 22:32 <KANSIO> d--hs---- C:\FOUND.052
2008-09-08 02:49 . 2008-09-08 02:49 268 --ah----- C:\sqmdata09.sqm
2008-09-08 02:49 . 2008-09-08 02:49 244 --ah----- C:\sqmnoopt09.sqm
2008-09-07 05:41 . 2008-09-07 05:41 <KANSIO> d-------- C:\Documents and Settings\Antti\Application Data\Winamp
2008-09-04 12:57 . 2008-09-04 12:57 <KANSIO> d--hs---- C:\FOUND.051
2008-09-04 12:30 . 2008-09-04 12:30 <KANSIO> d--hs---- C:\FOUND.050
2008-09-04 12:21 . 2008-09-04 12:21 <KANSIO> d--hs---- C:\FOUND.049
2008-09-04 11:27 . 2008-09-04 11:27 <KANSIO> d--hs---- C:\FOUND.048
2008-09-04 09:48 . 2008-09-04 09:48 <KANSIO> d--hs---- C:\FOUND.047
2008-09-04 09:30 . 2008-09-04 09:30 <KANSIO> d--hs---- C:\FOUND.046
2008-09-03 20:48 . 2008-09-03 20:48 <KANSIO> d--hs---- C:\FOUND.045
2008-09-03 20:39 . 2008-09-03 20:39 <KANSIO> d--hs---- C:\FOUND.044
2008-09-03 20:03 . 2008-09-03 20:03 <KANSIO> d--hs---- C:\FOUND.043
2008-09-03 19:27 . 2008-09-03 19:27 <KANSIO> d--hs---- C:\FOUND.042
2008-09-03 19:09 . 2008-09-03 19:09 <KANSIO> d--hs---- C:\FOUND.041
2008-09-03 16:22 . 2008-09-03 16:22 <KANSIO> d--hs---- C:\FOUND.040
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-02 02:49 --------- d-----w C:\Documents and Settings\Yleinen\Application Data\vlc
2008-08-31 12:43 --------- d-----w C:\Program Files\Winamp Remote
2008-08-29 11:29 --------- d-----w C:\Documents and Settings\Turbiina\Application Data\Nokia Multimedia Player
2008-08-24 14:19 --------- d-----w C:\Program Files\PPMate
2008-08-24 12:49 --------- d-----w C:\Program Files\sopcast
2008-08-24 12:43 --------- d-----w C:\Documents and Settings\Antti\Application Data\PPMate
2008-08-16 14:16 --------- d-----w C:\Documents and Settings\Turbiina\Application Data\vlc
2008-08-15 11:02 --------- d-----w C:\Program Files\Astro Gemini Software
2008-08-15 11:02 --------- d-----w C:\Documents and Settings\Antti\Application Data\Astro Gemini Software
2008-08-15 10:04 --------- d-----w C:\Program Files\Google
2008-08-15 03:00 396,512 ----a-w C:\WINDOWS\system32\scrsv.scr
2008-08-14 15:26 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-14 14:10 --------- d-----w C:\Documents and Settings\Antti\Application Data\AdobeUM
2008-08-13 06:16 --------- d-----w C:\Documents and Settings\Antti\Application Data\vlc
2008-08-12 17:27 --------- d-----w C:\WINDOWS\system32\config\systemprofile\Application Data\PC Suite
2008-08-11 09:14 14,663,680 ----a-w C:\WINDOWS\system32\Solar System 3D Screensaver.scr
2008-08-05 10:10 --------- d-----w C:\Documents and Settings\Turbiina\Application Data\BitTorrent
2008-08-04 23:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll
2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll
2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll
2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll
2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll
2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
2008-07-18 19:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 19:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-18 18:39 586,752 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-07-09 06:05 75,248 ----a-w C:\WINDOWS\zllsputility.exe
2008-07-09 06:05 1,086,952 ----a-w C:\WINDOWS\system32\zpeng24.dll
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:31 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll
.
((((((((((((((((((((((((((((( snapshot@2008-10-02_21.07.11.31 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-07-19 12:10:28 127,768 ----a-w C:\WINDOWS\system32\drivers\klif.sys
+ 2007-09-06 13:13:58 796,048 ----a-w C:\WINDOWS\system32\libeay32_0.9.6l.dll
+ 2004-04-27 01:40:52 11,264 ----a-w C:\WINDOWS\system32\SpOrder.dll
+ 2008-07-09 06:05:10 83,432 ----a-w C:\WINDOWS\system32\vsdata.dll
+ 2008-07-09 06:05:22 394,952 ----a-w C:\WINDOWS\system32\vsdatant.sys
+ 2008-07-09 06:05:10 157,160 ----a-w C:\WINDOWS\system32\vsinit.dll
+ 2008-07-09 06:05:10 103,912 ----a-w C:\WINDOWS\system32\vsmonapi.dll
+ 2008-07-09 06:05:10 275,944 ----a-w C:\WINDOWS\system32\vspubapi.dll
+ 2008-07-09 06:05:10 71,144 ----a-w C:\WINDOWS\system32\vsregexp.dll
+ 2008-07-09 06:05:12 472,552 ----a-w C:\WINDOWS\system32\vsutil.dll
+ 2008-07-09 06:05:12 46,568 ----a-w C:\WINDOWS\system32\vswmi.dll
+ 2008-07-09 06:05:12 99,816 ----a-w C:\WINDOWS\system32\vsxml.dll
+ 2008-07-09 06:05:12 83,432 ----a-w C:\WINDOWS\system32\zlcomm.dll
+ 2008-07-09 06:05:12 71,144 ----a-w C:\WINDOWS\system32\zlcommdb.dll
+ 2008-10-02 23:03:26 4,212 ---h--w C:\WINDOWS\system32\zllictbl.dat
+ 2008-07-09 06:05:06 370,208 ----a-w C:\WINDOWS\system32\ZoneLabs\av.dll
+ 2007-05-30 21:03:30 65,248 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\aphish.dat
+ 2006-06-30 11:47:36 21,568 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\avcmhk4.dll
+ 2007-05-30 21:03:30 1,628 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\pdmkl.dat
+ 2007-05-30 21:03:16 77,824 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\CKAHComm.dll
+ 2007-05-30 21:03:16 110,592 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\CKAHrule.dll
+ 2007-05-30 21:03:16 331,776 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\CKAHUM.dll
+ 2007-05-30 21:03:16 38,400 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\FSSync.dll
+ 2006-09-19 20:12:14 208,960 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\inv.dll
+ 2007-12-03 11:53:58 282,624 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\kave.dll
+ 2006-12-19 15:13:52 1,093,632 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\libeay32.dll
+ 2007-05-30 21:03:20 548,864 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\msvcp80.dll
+ 2007-05-30 21:03:20 626,688 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\msvcr80.dll
+ 2007-05-30 21:03:18 184,320 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\prloader.dll
+ 2007-05-30 21:03:22 90,112 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\prremote.dll
+ 2007-12-03 11:53:58 139,264 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe
+ 2006-12-19 15:13:52 200,704 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\ssleay32.dll
+ 2008-07-09 06:05:06 99,816 ----a-w C:\WINDOWS\system32\ZoneLabs\camupd.dll
+ 2004-01-30 09:35:08 813,568 ----a-w C:\WINDOWS\system32\ZoneLabs\dbghelp.dll
+ 2008-07-09 06:05:08 128,480 ----a-w C:\WINDOWS\system32\ZoneLabs\fbl.dll
+ 2008-07-09 06:05:08 38,376 ----a-w C:\WINDOWS\system32\ZoneLabs\featuremap.dll
+ 2008-07-09 06:05:08 321,016 ----a-w C:\WINDOWS\system32\ZoneLabs\imsecure.dll
+ 2008-07-09 06:05:24 288,144 ----a-w C:\WINDOWS\system32\ZoneLabs\lib\ConfigWizard.zip.dll
+ 2008-10-02 23:25:16 152,976 ----a-w C:\WINDOWS\system32\ZoneLabs\lib\licenseui.zip.dll
+ 2008-07-09 06:05:24 26,000 ----a-w C:\WINDOWS\system32\ZoneLabs\lib\zlsvc.zip.dll
+ 2008-07-09 06:05:24 1,361,296 ----a-w C:\WINDOWS\system32\ZoneLabs\lib\zpy.zip.dll
+ 2008-07-09 06:05:24 71,056 ----a-w C:\WINDOWS\system32\ZoneLabs\lib\zui.zip.dll
+ 2008-07-09 06:06:26 30,184 ----a-w C:\WINDOWS\system32\ZoneLabs\plugins\rpc_server\rpc_server.dll
+ 2008-07-09 06:06:26 30,216 ----a-w C:\WINDOWS\system32\ZoneLabs\plugins\vsmon_plugin\vsmon_plugin.dll
+ 2008-02-27 00:10:26 714,208 ----a-w C:\WINDOWS\system32\ZoneLabs\qrbase.dll
+ 2008-02-27 00:10:28 792,032 ----a-w C:\WINDOWS\system32\ZoneLabs\qrsrecl.dll
+ 2008-07-09 06:05:08 173,544 ----a-w C:\WINDOWS\system32\ZoneLabs\scheduler.dll
+ 2008-10-03 09:00:48 10,089,926 ----a-w C:\WINDOWS\system32\ZoneLabs\spyware.dat
+ 2008-10-03 09:00:36 9,900,691 ----a-w C:\WINDOWS\system32\ZoneLabs\spyware0.dat
+ 2008-02-27 00:10:32 1,504,736 ----a-w C:\WINDOWS\system32\ZoneLabs\srescan.dll
+ 2008-02-27 00:10:44 51,176 ----a-w C:\WINDOWS\system32\ZoneLabs\srescan.sys
+ 2008-07-09 06:05:10 456,168 ----a-w C:\WINDOWS\system32\ZoneLabs\ssleay32.dll
+ 2008-07-09 06:06:26 214,528 ----a-w C:\WINDOWS\system32\ZoneLabs\streamapi\httpblocker\httpblocker.dll
+ 2008-07-09 06:06:30 3,266,040 ----a-w C:\WINDOWS\system32\ZoneLabs\streamapi\imslsp\imslsp.dll
+ 2006-09-04 17:59:14 503,875 ----a-w C:\WINDOWS\system32\ZoneLabs\upd_core.dll
+ 2007-10-11 13:50:32 832,984 ----a-w C:\WINDOWS\system32\ZoneLabs\updating.dll
+ 2008-07-09 06:05:18 144,936 ----a-w C:\WINDOWS\system32\ZoneLabs\updclient.exe
+ 2007-01-11 14:31:06 286,787 ----a-w C:\WINDOWS\system32\ZoneLabs\updtrsdk.dll
+ 2008-07-09 06:05:10 108,008 ----a-w C:\WINDOWS\system32\ZoneLabs\vsavpro.dll
+ 2008-07-09 06:05:10 83,432 ----a-w C:\WINDOWS\system32\ZoneLabs\vsdb.dll
+ 2008-07-09 06:05:18 75,304 ----a-w C:\WINDOWS\system32\ZoneLabs\vsmon.exe
+ 2008-07-09 06:05:10 2,029,032 ----a-w C:\WINDOWS\system32\ZoneLabs\vsmondll.dll
+ 2008-07-09 06:05:12 1,361,384 ----a-w C:\WINDOWS\system32\ZoneLabs\vsruledb.dll
+ 2008-07-09 06:05:12 239,080 ----a-w C:\WINDOWS\system32\ZoneLabs\vsvault.dll
+ 2008-01-21 05:34:36 7,603,688 ----a-w C:\WINDOWS\system32\ZoneLabs\zlasdbup.dat
+ 2008-07-09 06:05:12 177,640 ----a-w C:\WINDOWS\system32\ZoneLabs\zlparser.dll
+ 2008-07-09 06:05:12 79,344 ----a-w C:\WINDOWS\system32\ZoneLabs\zlquarantine.dll
+ 2008-07-09 06:05:14 382,440 ----a-w C:\WINDOWS\system32\ZoneLabs\zlsre.dll
+ 2008-07-09 06:05:14 120,296 ----a-w C:\WINDOWS\system32\ZoneLabs\zlupdate.dll
.
-- Snapshot nollattu tähän hetkeen --
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-08-11 1124352]
"updateMgr"="c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" [2008-06-17 1249280]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-04-17 110592]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-27 7573504]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-04-27 86016]
"ASUS Live Update"="C:\Program Files\ASUS\ASUS Live Update\ALU.exe" [2006-02-21 180224]
"Wireless Console 2"="C:\Program Files\Wireless Console 2\wcourier.exe" [2005-10-17 987136]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-10-21 761945]
"RemoteControl"="C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe" [2004-11-02 32768]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
"Power_Gear"="C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe" [2006-03-06 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"ppmate"="C:\Program Files\PPMate\ppmate.exe" [2006-11-03 1527879]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"nwiz"="nwiz.exe" [2006-04-27 C:\WINDOWS\system32\nwiz.exe]
"SMSERIAL"="sm56hlpr.exe" [2006-01-19 C:\WINDOWS\sm56hlpr.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-12-19 C:\WINDOWS\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.asv2"= asusasv2.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\MSNMSGR.EXE"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"D:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Messenger\\MSMSGS.EXE"=
"C:\\Program Files\\PPMate\\ppmate.exe"=
"C:\\WINDOWS\\system32\\winver.exe"=
R3 ASNDIS5;ASNDIS5 Protocol Driver;C:\WINDOWS\system32\ASNDIS5.SYS [2002-09-09 16269]
R3 SynMini;USB2.0 1.3M Web Cam;C:\WINDOWS\system32\Drivers\SynMini.sys [2005-10-03 720470]
R3 SynScan;USB2.0 1.3M Web Cam Still Image;C:\WINDOWS\system32\Drivers\SynScan.sys [2005-10-03 8278]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-03 12:23:50
Windows 5.1.2600 Service Pack 2 FAT NTAPI
tarkistaa piilotettuja prosesseja ...
tarkistaa piilotettuja käynnistysarvoja ...
tarkistaa piilotettuja tiedostoja ...
tarkistus on valmis
piilotetut tiedostot: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\krgfgofrjdfdi]
"ImagePath"="\??\C:\WINDOWS\system32\drivers\arjyqcm.sys"
--
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\oesrwzgvn]
"ImagePath"="\??\C:\WINDOWS\system32\drivers\mrbtgbrr.sys"
--
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\tckjr]
"ImagePath"="\??\C:\WINDOWS\system32\drivers\rajiu.sys"
.
Valmistumisajankohta: 2008-10-03 12:29:54
ComboFix-quarantined-files.txt 2008-10-03 09:29:48
ComboFix3.txt 2008-10-02 18:12:10
ComboFix2.txt 2008-10-02 20:31:00
Ennen ajoa: 33˙302˙806˙528 tavua vapaana
Ajon jälkeen: 33,351,270,400 tavua vapaana
320 --- E O F --- 2008-09-10 18:32:32
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:36:41, on 3.10.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\sm56hlpr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ASUS\Asus ChkMail\ChkMail.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exe
O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ppmate] C:\Program Files\PPMate\ppmate.exe -autoplay
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [updateMgr] c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ASUS ChkMail.lnk = C:\Program Files\ASUS\Asus ChkMail\ChkMail.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
--
End of file - 6296 bytes
Innerspace-traveller
|
Senior Member
4 tuotearviota
|
3. lokakuuta 2008 @ 12:49 |
Linkki tähän viestiin
|
Asia selvä jatketaan sitten Kaspersky Online skannerilla.
Skannaa koneesi Kaspersky Online Skannerilla
* Lue läpi vaatimukset ja yksityisyyssäännökset ja klikkaa Accept.
* Skannerin ja virustietokannan lataus alkaa. Sinulta kysytään sallitko Kasperskyltä tulevan ohjelman asentamisen. Klikkaa Aja/Run.
* Kun lataus on valmis, klikkaa Settings.
* Varmistu, että seuraavat kohdat on valittu. Jos ne eivät ole, valitse ne ja klikkaa Save:
Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Mail databases
* Klikkaa Oma Tietokone, My Computer Scan-kohdan alapuolelta.
* Kun tarkistus on valmis, tulokset näytetään. Klikkaa View Scan Report.
* Näet listan saastuneista kohteista. Klikkaa Save Report As....
* Tallenna tiedosto työpöydällesi. Muuta Tiedostotyyppi/Files of type muotoon Tekstitiedosto/Text file(.txt) ennen kuin klikkaat Save.
* Kopioi ja liitä tiedoston sisältö seuraavaan vastaukseesi uuden HijackThis-lokin kera
|
|
Mainos
|
|
|
|
heilahdus
Newbie
|
3. lokakuuta 2008 @ 20:01 |
Linkki tähän viestiin
|
Tällaiselta näytti...
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Friday, October 3, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Friday, October 03, 2008 08:37:51
Records in database: 1285439
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
C:\
D:\
E:\
F:\
Scan statistics:
Files scanned: 41707
Threat name: 7
Infected objects: 18
Suspicious objects: 0
Duration of the scan: 06:25:45
File name / Threat name / Threats count
C:\Documents and Settings\Antti\Työpöytä\flashplayer10_install_activex_070208.exe Infected: Trojan-Dropper.Win32.Agent.xjn 1
C:\Documents and Settings\Yleinen\Työpöytä\ComboFix.rar Infected: Virus.Win32.Parite.b 1
C:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP74\A0326676.inf Infected: Worm.Win32.AutoRun.nuu 1
C:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP76\A0326709.inf Infected: Worm.Win32.AutoRun.nuu 1
C:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP77\A0326743.inf Infected: Worm.Win32.AutoRun.nuu 1
C:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP77\A0327788.inf Infected: Worm.Win32.AutoRun.nuu 1
C:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP79\A0357786.DLL Infected: not-a-virus:AdWare.Win32.Virtumonde.alvi 1
C:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP80\A0360843.inf Infected: Worm.Win32.AutoRun.nuu 1
C:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP80\A0362836.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.alrx 1
C:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP81\A0364631.DLL Infected: not-a-virus:AdWare.Win32.Virtumonde.alvi 1
C:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP81\A0364921.exe Infected: not-a-virus:AdWare.Win32.FakeInstaller.a 1
C:\QooBox\Quarantine\C\autorun.inf.vir Infected: Worm.Win32.AutoRun.nuu 1
C:\QooBox\Quarantine\C\WINDOWS\system32\jbeyfixg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.alrx 1
D:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP74\A0326678.inf Infected: Worm.Win32.AutoRun.onp 1
D:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP76\A0326712.inf Infected: Worm.Win32.AutoRun.onp 1
D:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP77\A0326745.inf Infected: Worm.Win32.AutoRun.onp 1
D:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP77\A0327789.inf Infected: Worm.Win32.AutoRun.onp 1
D:\System Volume Information\_restore{702FA488-1F11-494B-A82E-120773567941}\RP80\A0360847.inf Infected: Worm.Win32.AutoRun.onp 1
The selected area was scanned.
ja...
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:56:49, on 3.10.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZONELABS\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\sm56hlpr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe
C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ASUS\Asus ChkMail\ChkMail.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exe
O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTeK\ASUSDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ppmate] C:\Program Files\PPMate\ppmate.exe -autoplay
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [updateMgr] c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ASUS ChkMail.lnk = C:\Program Files\ASUS\Asus ChkMail\ChkMail.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZONELABS\vsmon.exe
--
End of file - 6263 bytes
Innerspace-traveller
|
|
