|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
hjt logi kone juonii nyt jotain...
|
|
Member
7 tuotearviota
|
15. joulukuuta 2008 @ 01:05 |
Linkki tähän viestiin
|
tämmöst tänään:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:02:29, on 15.12.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mobile Partner\Mobile Partner.exe
C:\Program Files\Codebox\BitMeter\BitMeter2.exe
C:\Program Files\ASUS\AASP\1.00.61\aaCenter.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [e061620d] rundll32.exe "C:\WINDOWS\system32\vgqflfvh.dll",b
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Launch PC Probe II] "C:\Program Files\ASUS\PC Probe II\Probe2.exe" 1
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Mobile Partner] "C:\Program Files\Mobile Partner\Mobile Partner.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [26891134784176934480240881683163] C:\Program Files\A360\av360.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Paikallinen palve')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Bitmeter2.lnk = C:\Program Files\Codebox\BitMeter\BitMeter2.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{59F2E575-0ADF-454F-9E7D-5C93FE1865DA}: NameServer = 217.78.192.22 217.78.192.78
O17 - HKLM\System\CS1\Services\Tcpip\..\{59F2E575-0ADF-454F-9E7D-5C93FE1865DA}: NameServer = 217.78.192.22 217.78.192.78
O20 - AppInit_DLLs: jqvmup.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 5679 bytes
|
|
Hujo
Suspended permanently
|
15. joulukuuta 2008 @ 16:41 |
Linkki tähän viestiin
|
Poista koneelta lisää poista sovelutuksesta
Antivirus 360
Poista kansio vikasiedossa
C:\Program Files\A360
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi
===============
1.Lataa Combofix.exe työpöydällesi yhdestä linkistä:
Combofix1
Combofix2
2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 15. joulukuuta 2008 @ 16:51
|
Member
7 tuotearviota
|
15. joulukuuta 2008 @ 18:10 |
Linkki tähän viestiin
|
täs on tää anti malware logi:
Malwarebytes' Anti-Malware 1.31
Tietokantaversio: 1456
Windows 5.1.2600 Service Pack 2
15.12.2008 17:50:54
mbam-log-2008-12-15 (17-50-54).txt
Tarkistustyyppi: Täysi tarkistus (C:\|)
Tarkistetut kohteet: 63384
Kulunut aika: 5 minute(s), 41 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 4
Saastuneita rekisteriavaimia: 15
Saastuneita rekisteriarvoja: 2
Saastuneita rekisterikohteita: 3
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 9
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
C:\WINDOWS\system32\nnnkIaBU.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\vgqflfvh.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\kspbbaju.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\bvesyh.dll (Trojan.Vundo.H) -> Delete on reboot.
Saastuneita rekisteriavaimia:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{44360a6a-61df-4caf-aabb-d5148f2e9b1d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{44360a6a-61df-4caf-aabb-d5148f2e9b1d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e5fd7d3e-eec1-4656-95d0-686b60211e4a} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{e5fd7d3e-eec1-4656-95d0-686b60211e4a} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{e5fd7d3e-eec1-4656-95d0-686b60211e4a} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{44360a6a-61df-4caf-aabb-d5148f2e9b1d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
Saastuneita rekisteriarvoja:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e061620d (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
Saastuneita rekisterikohteita:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\nnnkiabu -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\regfile\shell\open\command\ (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\nnnkiabu -> Delete on reboot.
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
C:\WINDOWS\system32\bvesyh.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\nnnkIaBU.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\UBaIknnn.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\UBaIknnn.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vgqflfvh.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\hvflfqgv.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kspbbaju.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Documents and Settings\Yuri\Local Settings\Temporary Internet Files\Content.IE5\4LQ9M9P6\index[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\syssetub.dll (Trojan.Agent) -> Quarantined and deleted successfully.
tässä on combofix logi:
ComboFix 08-12-14.05 - Yuri 2008-12-15 18:03:59.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.3327.2820 [GMT 2:00]
Sijainti: c:\documents and settings\Yuri\Työpöytä\ComboFix.exe
* Uusi palautuspiste luotu
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\dlepfmea.dll
c:\windows\system32\jqvmup.dll
c:\windows\system32\jugcoh.dll
c:\windows\system32\mwofoi.dll
c:\windows\system32\mxmvfc.dll
c:\windows\system32\pguvmixh.dll
c:\windows\system32\soqxadri.dll
c:\windows\system32\wnjsvbqy.dll
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-11-15 to 2008-12-15 )))))))))))))))))
.
2008-12-15 17:42 . 2008-12-15 17:42 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-15 17:42 . 2008-12-15 17:42 <KANSIO> d-------- c:\documents and settings\Yuri\Application Data\Malwarebytes
2008-12-15 17:42 . 2008-12-15 17:42 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-15 17:42 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-15 17:42 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-15 01:02 . 2008-12-15 01:02 <KANSIO> d-------- c:\program files\Trend Micro
2008-12-14 21:55 . 2008-12-14 21:56 <KANSIO> d-------- c:\windows\system32\NtmsData
2008-12-14 18:25 . 2008-12-14 18:25 1,048,576 --a------ C:\BIOS1(NYKYINEN)
2008-12-14 16:04 . 2007-08-24 19:45 101,120 -ra------ c:\windows\system32\drivers\ewusbmdm.sys
2008-12-14 16:04 . 2007-08-24 19:45 24,448 -ra------ c:\windows\system32\drivers\ewdcsc.sys
2008-12-13 17:20 . 2008-12-13 17:20 <KANSIO> d-------- c:\program files\VstPlugins
2008-12-13 17:20 . 2002-07-08 00:14 1,294,336 --a------ c:\windows\system32\vorbis.acm
2008-12-13 17:20 . 2006-06-20 10:56 225,280 --a------ c:\windows\system32\rewire.dll
2008-12-13 17:19 . 2008-12-13 17:20 <KANSIO> d-------- c:\program files\Image-Line
2008-12-11 17:23 . 2008-12-11 17:23 <KANSIO> d-------- c:\program files\CCleaner
2008-12-11 15:34 . 2008-05-09 19:09 <KANSIO> d-------- c:\program files\ASUSUpdt
2008-12-10 22:44 . 2008-12-11 15:35 <KANSIO> d-------- c:\program files\ASUS
2008-12-10 22:44 . 2006-01-10 16:50 24,576 --a------ c:\windows\system32\AsIO.dll
2008-12-10 22:44 . 2007-12-17 17:14 12,400 --a------ c:\windows\system32\drivers\AsIO.sys
2008-12-10 22:44 . 2008-01-04 13:34 11,832 --a------ c:\windows\system32\drivers\AsInsHelp64.sys
2008-12-10 22:44 . 2008-01-04 13:34 10,216 --a------ c:\windows\system32\drivers\AsInsHelp32.sys
2008-12-10 22:43 . 2008-12-10 22:43 <KANSIO> d-------- c:\program files\probe II
2008-12-10 22:43 . 2004-08-13 10:56 5,810 --a------ c:\windows\system32\drivers\ASACPI.sys
2008-12-10 13:49 . 2008-12-10 13:49 <KANSIO> d-------- c:\program files\uTorrent
2008-12-05 22:28 . 2008-12-05 22:28 107,888 --a------ c:\windows\system32\CmdLineExt.dll
2008-12-05 20:44 . 2008-12-05 20:47 <KANSIO> d-------- c:\program files\SystemRequirementsLab
2008-12-05 20:43 . 2008-12-05 20:44 <KANSIO> d-------- c:\documents and settings\Yuri\Application Data\SystemRequirementsLab
2008-12-05 20:42 . 2008-12-05 20:42 <KANSIO> d-------- c:\windows\Sun
2008-12-05 20:08 . 2008-12-15 17:42 <KANSIO> d-------- c:\documents and settings\Yuri\Application Data\foobar2000
2008-12-05 19:32 . 2008-12-14 17:39 <KANSIO> d-------- c:\documents and settings\Yuri\Application Data\FrostWire
2008-12-05 19:31 . 2008-12-05 19:31 <KANSIO> d-------- c:\program files\Java
2008-12-05 19:31 . 2008-12-05 19:31 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-05 19:31 . 2008-12-05 19:31 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-12-05 18:49 . 2008-12-05 18:49 <KANSIO> d-------- c:\program files\foobar2000
2008-12-05 18:36 . 2008-12-05 19:32 <KANSIO> d-------- c:\program files\FrostWire
2008-12-05 18:24 . 2008-12-05 18:24 <KANSIO> d-------- c:\program files\Bethesda Softworks
2008-12-05 18:24 . 2008-12-05 18:24 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Fallout3
2008-12-05 18:22 . 2008-12-05 18:22 <KANSIO> d-------- c:\program files\MSBuild
2008-12-05 18:20 . 2008-12-05 18:20 <KANSIO> d-------- c:\windows\system32\XPSViewer
2008-12-05 18:20 . 2008-12-05 18:20 <KANSIO> d-------- c:\program files\Reference Assemblies
2008-12-05 18:19 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll
2008-12-05 18:18 . 2007-03-12 16:42 3,495,784 --a------ c:\windows\system32\d3dx9_33.dll
2008-12-05 18:18 . 2007-03-12 16:42 1,123,696 --a------ c:\windows\system32\D3DCompiler_33.dll
2008-12-05 18:18 . 2007-03-15 16:57 443,752 --a------ c:\windows\system32\d3dx10_33.dll
2008-12-05 18:18 . 2007-04-04 18:53 81,768 --a------ c:\windows\system32\xinput1_3.dll
2008-12-05 18:18 . 2006-10-16 16:10 23,856 --a------ c:\windows\system32\spupdsvc.exe
2008-12-05 18:17 . 2008-12-05 18:17 <KANSIO> d-------- c:\windows\system32\xlive
2008-12-05 17:41 . 2008-12-05 17:41 <KANSIO> d-------- c:\windows\system32\Lang
2008-12-05 17:41 . 2008-12-05 17:41 940,794 --a------ c:\windows\system32\LoopyMusic.wav
2008-12-05 17:41 . 2008-12-05 17:41 146,650 --a------ c:\windows\system32\BuzzingBee.wav
2008-12-05 17:38 . 2008-12-05 17:39 <KANSIO> d-------- c:\windows\system32\RTCOM
2008-12-05 17:38 . 2008-12-05 17:38 <KANSIO> d-------- c:\program files\Realtek
2008-12-05 17:38 . 2008-12-11 15:35 <KANSIO> d--h----- c:\program files\InstallShield Installation Information
2008-12-05 17:35 . 2008-12-15 14:56 <KANSIO> d-------- c:\program files\SpeedFan
2008-12-05 17:35 . 2008-12-05 17:35 <KANSIO> d-------- c:\program files\Codebox
2008-12-05 17:35 . 2008-12-05 17:45 <KANSIO> d-------- c:\documents and settings\Yuri\Application Data\Bitmeter2
2008-12-05 17:35 . 2008-12-15 18:04 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Bitmeter2
2008-12-05 17:35 . 2008-07-07 17:05 <KANSIO> d-------- C:\Audio
2008-12-05 17:35 . 2008-12-05 17:35 45 --a------ c:\windows\system32\initdebug.nfo
2008-12-05 16:52 . 2008-12-05 16:52 <KANSIO> d-------- c:\program files\GPUZ
2008-12-05 16:52 . 2008-12-05 16:55 <KANSIO> d-------- c:\program files\CPUZ
2008-12-05 14:20 . 2008-12-05 14:20 <KANSIO> d-------- c:\program files\Alwil Software
2008-12-04 23:17 . 2008-12-10 22:05 <KANSIO> d-------- C:\muu paska
2008-12-04 23:15 . 2008-12-04 23:15 0 --a------ c:\windows\nsreg.dat
2008-12-04 23:14 . 2008-12-15 17:16 <KANSIO> d-------- c:\documents and settings\Yuri\Application Data\uTorrent
2008-12-04 22:48 . 2008-12-13 11:35 <KANSIO> d-------- C:\torrentit
2008-12-04 22:11 . 2008-12-14 19:01 <KANSIO> d-------- C:\lataukset
2008-12-04 22:06 . 2001-08-17 23:59 3,072 --a------ c:\windows\system32\drivers\audstub.sys
2008-12-04 22:05 . 2004-09-14 18:12 74,240 --a------ c:\windows\system32\usbui.dll
2008-12-04 22:05 . 2004-09-14 18:06 57,216 --a------ c:\windows\system32\drivers\redbook.sys
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-14 14:04 --------- d-----w c:\program files\Mobile Partner
2008-12-14 13:51 --------- d-----w c:\program files\Common Files\Adobe
2008-12-13 15:20 --------- d-----w c:\program files\VstPlugins
2008-12-10 20:44 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-05 15:38 315,392 ----a-w c:\windows\HideWin.exe
2008-12-04 19:51 --------- d-----w c:\documents and settings\Yuri\Application Data\InterTrust
2008-12-04 18:12 --------- d-----w c:\program files\microsoft frontpage
2008-12-04 18:11 --------- d-----w c:\program files\Windows Journal Viewer
2008-12-04 18:11 --------- d-----w c:\program files\HighMAT CD Writing Wizard
2006-11-11 15:30 145,920 ----a-w c:\windows\inf\hdaudio.sys
.
------- Sigcheck -------
2006-10-29 13:23 360576 bb4d3a8e6f7eb1d370bc4ad27ab23368 c:\windows\system32\drivers\tcpip.sys
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-09-14 15360]
"Mobile Partner"="c:\program files\Mobile Partner\Mobile Partner.exe" [2008-01-29 110592]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-09-14 1667584]
"Core Temp"="c:\documents and settings\Yuri\Työpöytä\Core Temp.exe" [2008-08-22 277008]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-11-06 7774208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-11-06 81920]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-05 136600]
"Launch PC Probe II"="c:\program files\ASUS\PC Probe II\Probe2.exe" [2008-04-07 2137088]
"nwiz"="nwiz.exe" [2006-11-06 c:\windows\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2008-05-16 c:\windows\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-09-14 15360]
c:\documents and settings\All Users\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
Bitmeter2.lnk - c:\program files\Codebox\BitMeter\BitMeter2.exe [2008-11-01 1462272]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMConfigurePrograms"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=bvesyh.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\lataukset\\utorrent.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-12-05 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-12-05 20560]
R3 ALSysIO;ALSysIO;\??\c:\docume~1\Yuri\LOCALS~1\Temp\ALSysIO.sys []
S0 ulsata2;ulsata2;c:\windows\system32\drivers\ulsata2.sys [2006-10-29 125952]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0349a545-c23b-11dd-ac14-faf1f474c3d7}]
\Shell\AutoRun\command - E:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20d168b6-c6ee-11dd-ac31-fd936385e759}]
\Shell\AutoRun\command - E:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20d168b7-c6ee-11dd-ac31-fd936385e759}]
\Shell\AutoRun\command - E:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{90f38fcb-c788-11dd-ac32-d0d8adaab74d}]
\Shell\AutoRun\command - E:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{90f38fcc-c788-11dd-ac32-d0d8adaab74d}]
\Shell\AutoRun\command - E:\AutoRun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bce2b2b2-c23d-11dd-ac17-e5d07b3761df}]
\Shell\AutoRun\command - E:\AutoRun.exe
*Newly Created Service* - PROCEXP90
.
- - - - POISTETUT JÄMÄRIVIT - - - -
HKU-Default-RunOnce-nltide3 - rundll32 advpack.dll
Notify-yayvTMde - yayvTMde.dll
.
------- Täydentävä tarkistus -------
.
uStart Page = about:blank
uInternet Connection Wizard,ShellNext = iexplore
TCP: {59F2E575-0ADF-454F-9E7D-5C93FE1865DA} = 217.78.192.22 217.78.192.78
FF - ProfilePath - c:\documents and settings\Yuri\Application Data\Mozilla\Firefox\Profiles\ims2ewyh.default\
FF - prefs.js: browser.startup.homepage - about:blank
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-15 18:04:35
Windows 5.1.2600 Service Pack 2 NTFS
tarkistaa piilotettuja prosesseja ...
tarkistaa piilotettuja käynnistysarvoja ...
tarkistaa piilotettuja tiedostoja ...
tarkistus on valmis
piilotetut tiedostot: 0
**************************************************************************
.
Valmistumisajankohta: 2008-12-15 18:04:55
ComboFix-quarantined-files.txt 2008-12-15 16:04:49
Ennen ajoa: 144 271 683 584 tavua vapaana
Ajon jälkeen: 144,270,733,312 tavua vapaana
WindowsXP-KB310994-SP2-Pro-BootDisk-FIN.EXE
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
197
ja sit vielä uus hjt logi:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:05:37, on 15.12.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Yuri\Työpöytä\Core Temp.exe
C:\Program Files\Codebox\BitMeter\BitMeter2.exe
C:\Program Files\ASUS\AASP\1.00.61\aaCenter.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Launch PC Probe II] "C:\Program Files\ASUS\PC Probe II\Probe2.exe" 1
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Mobile Partner] "C:\Program Files\Mobile Partner\Mobile Partner.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Core Temp] "C:\Documents and Settings\Yuri\Työpöytä\Core Temp.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Bitmeter2.lnk = C:\Program Files\Codebox\BitMeter\BitMeter2.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O20 - AppInit_DLLs: bvesyh.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 4273 bytes
|
|
Hujo
Suspended permanently
|
15. joulukuuta 2008 @ 22:41 |
Linkki tähän viestiin
|
|
scannaa hjt:llä merkkaa paina Fix checked
O4 - HKCU\..\Run: [Core Temp] "C:\Documents and Settings\Yuri\Työpöytä\Core Temp.exe"
O20 - AppInit_DLLs: bvesyh.dll
============
Laita firefoxsiin aloitus sivu
myös laita ie selaimeen aloitus sivu
============
Malwarebytes' Anti-Malware päivitä ja uusi täysi scannaus
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 15. joulukuuta 2008 @ 22:43
|
|
Mainos
|
|
|
Member
7 tuotearviota
|
15. joulukuuta 2008 @ 23:16 |
Linkki tähän viestiin
|
|
joo nyt toimii ei antimalware updaten jälkeen löytäny enää mitään. kiitti avusta tosi paljon
|
|
