|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
Internet Explorer ei käynnisty
|
|
|
m0pee
Junior Member
|
9. helmikuuta 2009 @ 10:38 |
Linkki tähän viestiin
|
Ongelma on siis se, että IE:tä käynnistäessä tulee joka kerta seuraava vikailmoitus:
Windows cannot find 'C:\Program Files\Internet Explorer\iexplore.exe'. Make sure you typed the name correctly, and try again. To search for a file, click the start button, and then click search
IE7 kuitenkin on koneellani ja tuo iexplore.exe siellä paikassa jossa sen pitääkin olla. Uudelleen asennusta on kokeiltu useasti ja IE6:kin olen kokeillut, aina sama vika. Norton 360 ja SpySweeper 5.5 väittävät että kone on täysin puhdas. Olen lukenut kymmeniä keskusteluja aiheesta, mutta yhdestäkään ei ole ollut apua, mikä siis neuvoksi?
HjT-logi:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:20:22, on 9.2.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINXP\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINXP\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINXP\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINXP\system32\nvsvc32.exe
C:\WINXP\system32\PnkBstrA.exe
C:\WINXP\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\RivaTuner v2.08\RivaTuner.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINXP\system32\RUNDLL32.EXE
C:\WINXP\RTHDCPL.EXE
C:\WINXP\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Last.fm\LastFM.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\WINXP\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: D - {24EBFBFF-F4EF-3B53-9A81-1F4BFD774412} - C:\WINXP\system32\xel89141.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINXP\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] "C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" /logon
O4 - HKLM\..\Run: [CanonMyPrinter] "C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [RivaTuner] "C:\Program Files\RivaTuner v2.08\RivaTuner.exe" /T
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINXP\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINXP\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINXP\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O23 - Service: Automaattinen LiveUpdate-ajastustoiminto (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINXP\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINXP\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
--
End of file - 9248 bytes
E8200 @ 3,2Ghz / XFX 8800 GTS 512mb / Abit IP35-e / 2Gt DDR800 / Antec NeoHE 430W / LG Flatron L194WT-SF 19"
|
|
Hujo
Suspended permanently
|
9. helmikuuta 2009 @ 15:54 |
Linkki tähän viestiin
|
scanjnaa hjt:llä merkkaa paina Fix checked
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINXP\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
============
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi
Voiko tietsikka koskaan toimia?
|
|
m0pee
Junior Member
|
9. helmikuuta 2009 @ 21:51 |
Linkki tähän viestiin
|
Tässäpä logit:
Malwarebytes' Anti-Malware 1.33
Database version: 1741
Windows 5.1.2600 Service Pack 3
9.2.2009 21:44:14
mbam-log-2009-02-09 (21-44-14).txt
Scan type: Full Scan (C:\|)
Objects scanned: 183280
Time elapsed: 1 hour(s), 25 minute(s), 40 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 5
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 4
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{24ebfbff-f4ef-3b53-9a81-1f4bfd774412} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{24ebfbff-f4ef-3b53-9a81-1f4bfd774412} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{41ce350f-f9b3-3a74-8daf-065643b0eb41} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{008dd531-7ff6-3581-8a2b-47c597f5137b} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{24ebfbff-f4ef-3b53-9a81-1f4bfd774412} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINXP\system32\xel89141.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINXP\system32\qnkfqvs.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINXP\system32\el89141.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Program Files\KB54933.exe (Trojan.Agent) -> Quarantined and deleted successfully.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:47:33, on 9.2.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINXP\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINXP\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINXP\Explorer.EXE
C:\WINXP\system32\nvsvc32.exe
C:\WINXP\system32\PnkBstrA.exe
C:\WINXP\system32\svchost.exe
C:\Program Files\RivaTuner v2.08\RivaTuner.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINXP\system32\RUNDLL32.EXE
C:\WINXP\RTHDCPL.EXE
C:\WINXP\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Last.fm\LastFM.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINXP\system32\NOTEPAD.EXE
C:\WINXP\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O4 - HKLM\..\Run: [CanonSolutionMenu] "C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" /logon
O4 - HKLM\..\Run: [CanonMyPrinter] "C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" /logon
O4 - HKLM\..\Run: [RivaTuner] "C:\Program Files\RivaTuner v2.08\RivaTuner.exe" /T
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINXP\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINXP\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINXP\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O23 - Service: Automaattinen LiveUpdate-ajastustoiminto (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINXP\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINXP\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
--
End of file - 9051 bytes
E8200 @ 3,2Ghz / XFX 8800 GTS 512mb / Abit IP35-e / 2Gt DDR800 / Antec NeoHE 430W / LG Flatron L194WT-SF 19"
|
|
Hujo
Suspended permanently
|
9. helmikuuta 2009 @ 23:08 |
Linkki tähän viestiin
|
Lataa JavaRa ja pura se työpöydällesi.
***Sulje kaikki päällä olevat Internet Explorerin ikkunat ennen jatkamista!***
* Tuplaklikkaa JavaRa.exeä käynnistääksesi ohjelma.
* Valitse English pudotusvalikosta valitaksesi kieleksi englannin ja klikkaa Select.
* Klikkaa Remove Older Versions poistaaksesi vanhat Java-versiot koneeltasi.
* Klikkaa Yes kun pyydetään. Kun JavaRa on valmis, se ilmoittaa, että lokitiedosto on luotu. Klikkaa OK.
* Lokitiedosto avautuu. Lähetä sen sisältö seuraavassa viestissäsi.
4. Asenna uusin Java päivitys seuraavasta linkistä..
Lataa täältä uusi java
Rullaa alas kohteeseen Java Runtime Environment (JRE) 6 Update 12
Paina Download
Laita Platform -kohtaan Windows
Ruksaa I agree to the Java SE Runtime Environment 6 License Agreement ja paina Continue
Paina Windows Offline Installationin alapuolella jre-6u4-windows-i586-p.exe
Tallenna tiedosto vaikka työpöydälle ja asenna se.
5. Käynnistä kone uudelleen asennuksen jälkeen.
6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).
7. General-välilehdellä klikkaa Settings. Vedä liukusäädintä (Disk Space) pienemmälle.
(Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).
8. Klikkaa Delete Files -nappia. Varmista että kaikki kaksi valintaa ovat rastitettuja:
* Applications and Applets
* Trace and Log Files
Ja paina OK -nappia
Huomaa: Tämä poistaa kaikki ladatut sovellukset ja appletit VÄLIMUISTISTA.
9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.
10. Välilehti Update: ota ruksi pois kohdasta Check for Updates automatically
Valitse Never check
11. Klikkaa Apply ja OK jättääksesi Java asetusikkunasi.
Voiko tietsikka koskaan toimia?
|
|
m0pee
Junior Member
|
9. helmikuuta 2009 @ 23:35 |
Linkki tähän viestiin
|
JavaRa 1.13 Removal Log.
Report follows after line.
------------------------------------
The JavaRa removal process was started on Mon Feb 09 23:15:55 2009
Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}
Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}
Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610005
Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610005
Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610005
Found and removed: SOFTWARE\Classes\JavaPlugin.160_05
Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_05
Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_05
Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610005
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610005
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610005
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160050}
Found and removed: Software\Classes\JavaPlugin.160_05
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01
Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_05
Found and removed: Software\JavaSoft\Java2D\1.6.0_05
Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_05
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}
Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_05\
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_05\bin\
Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Common Files\Java\Update\Base Images\jre1.6.0.b105\patch-jre1.6.0_05.b13\
------------------------------------
Finished reporting.
E8200 @ 3,2Ghz / XFX 8800 GTS 512mb / Abit IP35-e / 2Gt DDR800 / Antec NeoHE 430W / LG Flatron L194WT-SF 19"
|
|
Hujo
Suspended permanently
|
9. helmikuuta 2009 @ 23:42 |
Linkki tähän viestiin
|
|
Mikäs on koneen toiminta
Voiko tietsikka koskaan toimia?
|
|
m0pee
Junior Member
|
10. helmikuuta 2009 @ 14:25 |
Linkki tähän viestiin
|
|
Sama ongelma edelleen, IE ei käynnisty vaan antaa samaa virheilmoitusta. Kokoilen vielä, auttaisiko uudelleen asennus puhdistuksen jälkeen.
E8200 @ 3,2Ghz / XFX 8800 GTS 512mb / Abit IP35-e / 2Gt DDR800 / Antec NeoHE 430W / LG Flatron L194WT-SF 19"
|
|
Hujo
Suspended permanently
|
10. helmikuuta 2009 @ 14:34 |
Linkki tähän viestiin
|
Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.
Käynnistä koneesi vikasietotilaan:
sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä
Jossakin koneissa hakataan F8:sin sijasta F5:tä
" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
==============
1.Lataa Combofix.exe työpöydällesi yhdestä linkistä:
Combofix1
Combofix2
Älä asenna palautus consolia
2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Voiko tietsikka koskaan toimia?
|
|
m0pee
Junior Member
|
10. helmikuuta 2009 @ 15:28 |
Linkki tähän viestiin
|
SDFix ja ComboFix rullasivat jonkin aikaa ja saivat jotain ilmeisesti aikaankin, sillä IE toimii taas, kiitokset siitä! Tässä logit:
SDFix: Version 1.240
Run by Lauri on ti 10.02.2009 at 14:50
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\Documents and Settings\Lauri\Desktop\sdfix\SDFix
Checking Services :
Restoring Default Security Values
Restoring Default Hosts File
Rebooting
Checking Files :
No Trojan Files Found
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-10 15:07:01
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:59,b0,c4,3c,28,52,bd,e1,7b,f5,4d,76,c3,58,91,7d,63,f9,0a,84,b1,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,18,99,11,46,58,bb,34,15,98,fd,90,eb,9c,7d,58,5f,3e,..
"khjeh"=hex:96,ac,ac,78,8b,7f,50,38,04,ff,a3,64,7a,dc,aa,34,5f,e6,f3,f4,f1,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:7a,16,a4,fa,d0,e2,d0,6e,34,df,c0,cd,56,83,54,ec,01,d9,47,74,ee,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:59,b0,c4,3c,28,52,bd,e1,7b,f5,4d,76,c3,58,91,7d,63,f9,0a,84,b1,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,18,99,11,46,58,bb,34,15,98,fd,90,eb,9c,7d,58,5f,3e,..
"khjeh"=hex:96,ac,ac,78,8b,7f,50,38,04,ff,a3,64,7a,dc,aa,34,5f,e6,f3,f4,f1,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:d3,cc,2f,90,9d,ab,ae,fb,74,65,1c,79,6d,42,8d,24,68,04,12,e8,25,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:59,b0,c4,3c,28,52,bd,e1,7b,f5,4d,76,c3,58,91,7d,63,f9,0a,84,b1,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,18,99,11,46,58,bb,34,15,98,fd,90,eb,9c,7d,58,5f,3e,..
"khjeh"=hex:96,ac,ac,78,8b,7f,50,38,04,ff,a3,64,7a,dc,aa,34,5f,e6,f3,f4,f1,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:7a,16,a4,fa,d0,e2,d0,6e,34,df,c0,cd,56,83,54,ec,01,d9,47,74,ee,..
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"C:\\WINXP\\system32\\PnkBstrA.exe"="C:\\WINXP\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINXP\\system32\\PnkBstrB.exe"="C:\\WINXP\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Steam\\Steam.exe"="C:\\Program Files\\Steam\\Steam.exe:*:Enabled:Steam"
"C:\\Program Files\\Steam\\SteamApps\\cuqumber\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\SteamApps\\cuqumber\\counter-strike source\\hl2.exe:*:Enabled:hl2"
"C:\\WINXP\\system32\\dpvsetup.exe"="C:\\WINXP\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\\WINXP\\system32\\rundll32.exe"="C:\\WINXP\\system32\\rundll32.exe:*:Enabled:Run a DLL as an App"
"C:\\Program Files\\Counter-Strike 1.6\\hl.exe"="C:\\Program Files\\Counter-Strike 1.6\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Sierra\\Half-Life\\hl.exe"="C:\\Sierra\\Half-Life\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\xrEngine.exe"="C:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Clear Sky (CLI)"
"C:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\dedicated\\xrEngine.exe"="C:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\dedicated\\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Clear Sky (SRV)"
"C:\\Program Files\\Juniper\\NetScreen-Remote\\IreIKE.exe"="C:\\Program Files\\Juniper\\NetScreen-Remote\\IreIKE.exe:*:Enabled:IreIke"
"C:\\Program Files\\Juniper\\NetScreen-Remote\\ViewLog.exe"="C:\\Program Files\\Juniper\\NetScreen-Remote\\ViewLog.exe:127.0.0.1/255.255.255.255:Enabled:ViewLog"
"C:\\Program Files\\Juniper\\NetScreen-Remote\\CmonApp.exe"="C:\\Program Files\\Juniper\\NetScreen-Remote\\CmonApp.exe:127.0.0.1/255.255.255.255:Enabled:CMonApp"
"C:\\Program Files\\Juniper\\NetScreen-Remote\\vpn.exe"="C:\\Program Files\\Juniper\\NetScreen-Remote\\vpn.exe:127.0.0.1/255.255.255.255:Enabled:VPN Connection Manager"
"C:\\Program Files\\EA GAMES\\Mirror's Edge\\Binaries\\MirrorsEdge.exe"="C:\\Program Files\\EA GAMES\\Mirror's Edge\\Binaries\\MirrorsEdge.exe:*:Enabled:Mirror's EdgeT"
"C:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"="C:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe:*:Enabled:Left 4 Dead"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\Juniper\\NetScreen-Remote\\IreIKE.exe"="C:\\Program Files\\Juniper\\NetScreen-Remote\\IreIKE.exe:*:Enabled:IreIke"
"C:\\Program Files\\Juniper\\NetScreen-Remote\\ViewLog.exe"="C:\\Program Files\\Juniper\\NetScreen-Remote\\ViewLog.exe:127.0.0.1/255.255.255.255:Enabled:ViewLog"
"C:\\Program Files\\Juniper\\NetScreen-Remote\\CmonApp.exe"="C:\\Program Files\\Juniper\\NetScreen-Remote\\CmonApp.exe:127.0.0.1/255.255.255.255:Enabled:CMonApp"
"C:\\Program Files\\Juniper\\NetScreen-Remote\\vpn.exe"="C:\\Program Files\\Juniper\\NetScreen-Remote\\vpn.exe:127.0.0.1/255.255.255.255:Enabled:VPN Connection Manager"
Remaining Files :
Files with Hidden Attributes :
Mon 14 Apr 2008 1,695,232 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe"
Mon 7 Jul 2008 1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 7 Jul 2008 4,891,472 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon 18 Aug 2008 1,832,272 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Wed 3 May 2006 163,328 ..SHR --- "C:\WINXP\system32\flvDX.dll"
Wed 21 Feb 2007 31,232 ..SHR --- "C:\WINXP\system32\msfDX.dll"
Sun 16 Mar 2008 216,064 ..SHR --- "C:\WINXP\system32\nbDX.dll"
Sun 20 Apr 2008 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 15 Feb 2007 308,832 A..H. --- "C:\Program Files\Canon\MP Navigator EX 1.0\Maint.exe"
Mon 19 Dec 2005 61,440 A..H. --- "C:\Program Files\Canon\MP Navigator EX 1.0\uinstrsc.dll"
Sun 26 Jun 2005 616,448 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygwin1.dll"
Tue 21 Jun 2005 45,568 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygz.dll"
Tue 2 Sep 2008 72,704 ..SHR --- "C:\Program Files\eRightSoft\SUPER\Setup.exe"
Tue 2 Oct 2007 16,384 A.SHR --- "C:\Program Files\eRightSoft\SUPER\_Setup.dll"
Mon 7 Apr 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Fri 18 Jan 2008 400 A..H. --- "C:\Program Files\Common Files\Symantec Shared\COH\COH32LU.reg"
Fri 18 Jan 2008 403 A..H. --- "C:\Program Files\Common Files\Symantec Shared\COH\COHDLU.reg"
Tue 4 Jun 2002 84,992 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\14_43260.dll"
Tue 4 Jun 2002 44,032 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\28_83260.dll"
Tue 10 Dec 2002 73,766 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\atrc3260.dll"
Tue 10 Dec 2002 65,575 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\cook3260.dll"
Sun 9 Jun 2002 36,864 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ddnt3260.dll"
Tue 4 Jun 2002 20,480 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dnet3260.dll"
Tue 10 Dec 2002 102,437 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv13260.dll"
Tue 10 Dec 2002 176,165 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv23260.dll"
Tue 10 Dec 2002 208,935 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv33260.dll"
Tue 10 Dec 2002 217,127 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv43260.dll"
Sun 9 Jun 2002 40,448 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dspr3260.dll"
Sun 4 Nov 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ivvideo.dll"
Tue 10 Apr 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\qtmlClient.dll"
Fri 20 Feb 2004 232,960 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\raac.dll"
Sun 9 Jun 2002 525,824 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnco3260.dll"
Tue 10 Dec 2002 245,805 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnlt3260.dll"
Tue 10 Dec 2002 45,093 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv103260.dll"
Tue 10 Dec 2002 98,341 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv203260.dll"
Tue 10 Dec 2002 94,247 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv303260.dll"
Tue 10 Dec 2002 90,151 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv403260.dll"
Tue 10 Dec 2002 102,439 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\sipr3260.dll"
Sun 9 Jun 2002 49,152 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\tokr3260.dll"
Thu 20 Mar 2008 5,632 ..SHR --- "C:\Program Files\eRightSoft\SUPER\spk\1stRun.exe"
Sun 18 Jan 2009 5,936 ...HR --- "C:\Documents and Settings\Lauri\Application Data\SecuROM\UserData\securom_v7_01.bak"
Finished!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:22:36, on 10.2.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINXP\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINXP\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINXP\system32\nvsvc32.exe
C:\WINXP\system32\PnkBstrA.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\system32\notepad.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINXP\RTHDCPL.EXE
C:\WINXP\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINXP\system32\notepad.exe
C:\WINXP\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O4 - HKLM\..\Run: [CanonSolutionMenu] "C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" /logon
O4 - HKLM\..\Run: [CanonMyPrinter] "C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" /logon
O4 - HKLM\..\Run: [RivaTuner] "C:\Program Files\RivaTuner v2.08\RivaTuner.exe" /T
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINXP\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINXP\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINXP\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O23 - Service: Automaattinen LiveUpdate-ajastustoiminto (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINXP\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINXP\system32\PnkBstrA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
--
End of file - 8073 bytes
ComboFix 09-02-08.02 - Lauri 2009-02-10 15:16:45.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1380 [GMT 2:00]
Running from: c:\documents and settings\Lauri\Desktop\ComboFix.exe
AV: Norton 360 *On-access scanning enabled* (Updated)
FW: Norton 360 *enabled*
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\winxp\Readme.txt
c:\winxp\system32\tmp71.tmp
c:\winxp\system32\tmp72.tmp
.
((((((((((((((((((((((((( Files Created from 2009-01-10 to 2009-02-10 )))))))))))))))))))))))))))))))
.
2009-02-10 14:50 . 2009-02-10 14:50 578,560 --a--c--- c:\winxp\system32\dllcache\user32.dll
2009-02-10 14:48 . 2009-02-10 14:48 <DIR> d-------- c:\winxp\ERUNT
2009-02-10 14:29 . 2009-02-10 14:29 228 --a------ c:\winxp\system32\spupdsvc.inf
2009-02-10 14:28 . 2007-08-13 18:52 66,048 --a------ c:\winxp\ieResetIcons.exe
2009-02-09 23:28 . 2009-02-09 23:28 410,984 --a------ c:\winxp\system32\deploytk.dll
2009-02-09 20:10 . 2009-02-09 20:10 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-09 20:10 . 2009-02-09 20:10 <DIR> d-------- c:\documents and settings\Lauri\Application Data\Malwarebytes
2009-02-09 20:10 . 2009-02-09 20:10 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-09 20:10 . 2009-01-14 16:11 38,496 --a------ c:\winxp\system32\drivers\mbamswissarmy.sys
2009-02-09 20:10 . 2009-01-14 16:11 15,504 --a------ c:\winxp\system32\drivers\mbam.sys
2009-02-09 10:19 . 2009-02-09 10:19 <DIR> d-------- c:\program files\Trend Micro
2009-02-06 13:32 . 2009-02-06 13:33 <DIR> d-------- C:\nss
2009-02-06 11:15 . 2009-02-06 11:15 164 --a------ C:\install.dat
2009-01-18 18:58 . 2007-11-14 15:18 553 --a------ c:\winxp\USetup.iss
2009-01-18 18:57 . 2008-08-05 20:10 1,684,736 --a------ c:\winxp\system32\drivers\Ambfilt.sys
2009-01-18 18:57 . 2006-01-04 15:41 1,389,056 --a------ c:\winxp\system32\drivers\Monfilt.sys
2009-01-18 18:57 . 2008-10-23 17:42 290,816 --a------ c:\winxp\vncutil.exe
2009-01-18 18:57 . 2008-06-24 14:46 104,992 --a------ c:\winxp\RtkAudioService.exe
2009-01-18 18:57 . 2009-01-05 16:16 34,816 --a------ c:\winxp\system32\RtkCoInstXP.dll
2009-01-18 15:57 . 2009-01-18 19:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\Electronic Arts
2009-01-15 21:19 . 2009-01-15 21:19 <DIR> d-------- c:\program files\OpenAL
2009-01-15 21:19 . 2008-04-28 15:53 805,400 -ra------ c:\winxp\system32\tmpBE.tmp
2009-01-15 21:19 . 2008-04-28 15:53 805,400 -ra------ c:\winxp\system32\tmpBD.tmp
2009-01-15 21:19 . 2009-01-15 21:19 444,952 --a------ c:\winxp\system32\wrap_oal.dll
2009-01-15 21:19 . 2009-01-15 21:19 109,080 --a------ c:\winxp\system32\OpenAL32.dll
2009-01-15 21:05 . 2009-01-15 21:32 <DIR> d-------- c:\program files\Codemasters
2009-01-12 17:27 . 2009-01-16 02:54 <DIR> d-------- C:\audiograbber
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-10 13:14 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-02-10 12:37 --------- d-----w c:\documents and settings\All Users\Application Data\2DBoy
2009-02-10 12:36 --------- d-----w c:\program files\Peggle Nights Deluxe
2009-02-10 12:34 --------- d-----w c:\documents and settings\All Users\Application Data\Codemasters
2009-02-09 21:28 --------- d-----w c:\program files\Java
2009-02-09 21:14 --------- d-----w c:\documents and settings\Lauri\Application Data\uTorrent
2009-02-09 09:17 --------- d-----w c:\program files\Steam
2009-01-18 17:03 --------- d-----w c:\program files\Electronic Arts
2009-01-18 16:57 --------- d-----w c:\program files\Realtek
2009-01-18 15:35 --------- d-----w c:\program files\EA GAMES
2009-01-18 13:39 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-01-18 13:39 --------- d-----w c:\program files\AGEIA Technologies
2009-01-16 19:59 --------- d-----w c:\program files\Truck Dismount
2009-01-16 19:59 --------- d-----w c:\program files\Porrasturvat - Stair Dismount
2009-01-15 19:05 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-10 11:02 --------- d-----w c:\documents and settings\Lauri\Application Data\Nokia
2009-01-09 10:22 806 ----a-w c:\winxp\system32\drivers\SYMEVENT.INF
2009-01-09 10:22 60,808 ----a-w c:\winxp\system32\S32EVNT1.DLL
2009-01-09 10:22 124,464 ----a-w c:\winxp\system32\drivers\SYMEVENT.SYS
2009-01-09 10:22 10,635 ----a-w c:\winxp\system32\drivers\SYMEVENT.CAT
2009-01-09 10:22 --------- d-----w c:\program files\Symantec
2009-01-07 12:42 --------- d-----w c:\program files\directx
2009-01-07 12:33 --------- d-----w c:\program files\Commandos II
2009-01-06 17:00 4,968,448 ----a-w c:\winxp\system32\drivers\RtkHDAud.sys
2009-01-05 10:06 --------- d-----w c:\program files\ElastoManiaRegistered
2009-01-02 05:15 --------- d-----w c:\program files\Filzip
2009-01-01 18:45 --------- d-----w c:\documents and settings\Lauri\Application Data\dvdcss
2008-12-30 12:58 18,082,304 ----a-w c:\winxp\RTHDCPL.EXE
2008-12-26 16:06 --------- d-----w c:\documents and settings\All Users\Application Data\ifolor
2008-12-26 15:24 --------- d-----w c:\program files\ifolor
2008-12-26 15:24 --------- d-----w c:\documents and settings\Lauri\Application Data\ifolor
2008-12-11 10:57 333,952 ----a-w c:\winxp\system32\drivers\srv.sys
2008-11-29 20:52 111,928 ----a-w c:\winxp\system32\PnkBstrB.exe
2008-11-29 20:51 5,488,640 ----a-w c:\winxp\system32\xa94468328.exe
2008-11-29 20:51 5,488,640 ----a-w c:\winxp\system32\xa94468000.exe
2008-11-29 20:41 5,488,640 ----a-w c:\winxp\system32\xa93878828.exe
2008-11-29 20:41 5,488,640 ----a-w c:\winxp\system32\xa93878531.exe
2008-11-29 20:41 5,488,640 ----a-w c:\winxp\system32\xa93861843.exe
2008-11-29 20:41 5,488,640 ----a-w c:\winxp\system32\xa93861562.exe
2008-11-29 20:40 5,488,640 ----a-w c:\winxp\system32\xa93806484.exe
2008-11-29 20:40 5,488,640 ----a-w c:\winxp\system32\xa93806203.exe
2008-11-29 20:39 5,488,640 ----a-w c:\winxp\system32\xa93757593.exe
2008-11-29 20:39 5,488,640 ----a-w c:\winxp\system32\xa93757328.exe
2008-11-29 20:34 5,488,640 ----a-w c:\winxp\system32\xa93420390.exe
2008-11-29 20:34 5,488,640 ----a-w c:\winxp\system32\xa93420125.exe
2008-11-29 20:27 5,488,640 ----a-w c:\winxp\system32\xa93016609.exe
2008-11-29 20:27 5,488,640 ----a-w c:\winxp\system32\xa93016343.exe
2008-11-29 20:23 5,488,640 ----a-w c:\winxp\system32\xa92789078.exe
2008-11-29 20:23 5,488,640 ----a-w c:\winxp\system32\xa92787984.exe
2008-11-29 20:23 5,488,640 ----a-w c:\winxp\system32\xa92762484.exe
2008-11-29 20:23 5,488,640 ----a-w c:\winxp\system32\xa92762078.exe
2008-11-29 20:23 176,128 ----a-w c:\winxp\system32\xwr56633.dll
2008-11-29 20:23 176,128 ----a-w c:\winxp\system32\wr56633.dll
2008-11-29 10:54 22,328 ----a-w c:\documents and settings\Lauri\Application Data\PnkBstrK.sys
2008-11-29 10:53 682,280 ----a-w c:\winxp\system32\pbsvc.exe
2008-11-29 10:53 66,872 ----a-w c:\winxp\system32\PnkBstrA.exe
2008-11-10 19:22 2,720 ----a-w c:\winxp\system32\ealregsnapshot1.reg
2008-06-30 10:44 324,976 ----a-w c:\program files\mozilla firefox\components\coFFPlgn.dll
2006-05-03 09:06 163,328 --sh--r c:\winxp\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r c:\winxp\system32\msfDX.dll
2008-03-16 12:30 216,064 --sh--r c:\winxp\system32\nbDX.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded]
@="{4433A54A-1AC8-432F-90FC-85F045CF383C}"
[HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending]
@="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}"
[HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected]
@="{476D0EA3-80F9-48B5-B70B-05E677C9C148}"
[HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\winxp\system32\ctfmon.exe" [2008-04-14 15360]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-03-14 486856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"RivaTuner"="c:\program files\RivaTuner v2.08\RivaTuner.exe" [2008-03-10 2691072]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512]
"NvCplDaemon"="c:\winxp\system32\NvCpl.dll" [2008-09-17 13574144]
"NvMediaCenter"="c:\winxp\system32\NvMcTray.dll" [2008-09-17 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-09 148888]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\winxp\KHALMNPR.Exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\winxp\KHALMNPR.Exe]
"RTHDCPL"="RTHDCPL.EXE" [2008-12-30 c:\winxp\RTHDCPL.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\winxp\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2008-04-14 c:\winxp\system32\advpack.dll]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-03-27 113664]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-11-01 576104]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-08-02 805392]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 01:42 72208 c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"msacm.avis"= ff_acm.acm
"VIDC.DVSD"= pdvcodec.dll
"vidc.VSPX"= vspxvfw.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINXP\\system32\\PnkBstrA.exe"=
"c:\\WINXP\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Steam\\SteamApps\\cuqumber\\counter-strike source\\hl2.exe"=
"c:\\WINXP\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\EA GAMES\\Mirror's Edge\\Binaries\\MirrorsEdge.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-02-18 149352]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-03 99376]
R3 FStarForce;FStarForce;c:\winxp\system32\drivers\FStarForce.sys [2008-10-30 9216]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\winxp\system32\drivers\ASPI32.SYS [2008-08-27 16512]
S3 COH_Mon;COH_Mon;c:\winxp\system32\drivers\COH_Mon.sys [2008-01-12 23888]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - COMHOST
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cddc304c-0397-11dd-b178-00508db7f3cb}]
\Shell\AutoRun\command - F:\setupSNK.exe
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-EA Core - c:\program files\Electronic Arts\EADM\Core.exe
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\documents and settings\Lauri\Application Data\Mozilla\Firefox\Profiles\cxrlyn8r.default\
FF - prefs.js: browser.startup.homepage - hxxps://posti.sakky.fi/horde3/imp/login.php
FF - component: c:\program files\Mozilla Firefox\components\coFFPlgn.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-10 15:17:39
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-448539723-573735546-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:a8,7e,78,49,f9,b0,79,61,57,db,60,5e,4e,58,ce,05,0f,a1,d1,3c,93,03,2b,
fd,55,22,86,95,5b,f7,62,d4,f7,59,de,3f,de,5c,13,2a,c7,20,e7,2b,28,c1,54,ed,\
"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50
[HKEY_USERS\S-1-5-21-448539723-573735546-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:4d,5c,00,c4,dc,92,01,f6,4f,a0,dd,d6,c7,ea,a0,e6,93,10,91,c0,d3,
3e,f9,da,5c,f8,50,0f,ca,e3,fb,aa,93,89,47,1b,34,ff,6e,65,25,61,c3,fa,e4,87,\
"rkeysecu"=hex:cc,31,22,60,21,5f,50,e9,8c,4e,3d,41,70,20,8a,50
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(808)
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll
.
Completion time: 2009-02-10 15:19:03
ComboFix-quarantined-files.txt 2009-02-10 13:18:58
Pre-Run: 59 113 570 304 bytes free
Post-Run: 59,158,970,368 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINXP
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINXP="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
242 --- E O F --- 2009-02-06 19:03:33
E8200 @ 3,2Ghz / XFX 8800 GTS 512mb / Abit IP35-e / 2Gt DDR800 / Antec NeoHE 430W / LG Flatron L194WT-SF 19"
|
|
Hujo
Suspended permanently
|
10. helmikuuta 2009 @ 19:40 |
Linkki tähän viestiin
|
c:\winxp\system32\xa93420390.exe <-- mikäs tämä on
Lähetetääni tiedosto Virustotaliin
virustotal
1 Klikkaa Selaa... nappia
2 Selaa sitten siihen tämä tiedosto: c:\winxp\system32\xa93420390.exe
3 Klikkaa Avaa nappia
4 Klikkaa Send nappia
5 Sivusto scannaa tiedostoa hetken, tallenna sitten tulokset jotka saat vaikka muistioon.
tai jos ei pelitä niin tuonne
jotti
Voiko tietsikka koskaan toimia?
|
|
m0pee
Junior Member
|
10. helmikuuta 2009 @ 21:10 |
Linkki tähän viestiin
|
Taitavat olla Call Of Duty World At Warin tiedostoja, puhtaita ainakin tuon sivuston mukaan. Kyseistä peliä ei tosin enää koneellani ole asennettuna, joten voiko nuo tuolta vaan kylmän viileästi poistaa?
File: xa93420390.exe
Status: OK(Note: file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5: 5f1b427c756d7734934d2cc4e542fed3
Scan taken on 10 Feb 2009 19:00:28 (GMT)
A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
G DATA
Found nothing
Ikarus
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing
E8200 @ 3,2Ghz / XFX 8800 GTS 512mb / Abit IP35-e / 2Gt DDR800 / Antec NeoHE 430W / LG Flatron L194WT-SF 19"
|
|
Hujo
Suspended permanently
|
10. helmikuuta 2009 @ 21:24 |
Linkki tähän viestiin
|
Voiko tietsikka koskaan toimia?
|
|
m0pee
Junior Member
|
10. helmikuuta 2009 @ 23:03 |
Linkki tähän viestiin
|
|
SUPERAntiSpyware löysi ja laittoi kuriin pari uhkaa: Adware.Tracking Cookie ja Trojan.Dropper/MS-Fake. Muuta ei löytynyt.
E8200 @ 3,2Ghz / XFX 8800 GTS 512mb / Abit IP35-e / 2Gt DDR800 / Antec NeoHE 430W / LG Flatron L194WT-SF 19"
|
|
Hujo
Suspended permanently
|
10. helmikuuta 2009 @ 23:17 |
Linkki tähän viestiin
|
|
scannaa uusi combofix loki
Voiko tietsikka koskaan toimia?
|
|
m0pee
Junior Member
|
10. helmikuuta 2009 @ 23:33 |
Linkki tähän viestiin
|
ComboFix 09-02-10.01 - Lauri 2009-02-10 23:23:55.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1418 [GMT 2:00]
Running from: c:\documents and settings\Lauri\My Documents\Downloads\SOFTWARE\ComboFix.exe
AV: Norton 360 *On-access scanning enabled* (Updated)
FW: Norton 360 *enabled*
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2009-01-10 to 2009-02-10 )))))))))))))))))))))))))))))))
.
2009-02-10 22:01 . 2009-02-10 22:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-02-10 22:00 . 2009-02-10 22:00 <DIR> d-------- c:\program files\SUPERAntiSpyware
2009-02-10 22:00 . 2009-02-10 22:00 <DIR> d-------- c:\documents and settings\Lauri\Application Data\SUPERAntiSpyware.com
2009-02-10 15:39 . 2008-10-10 04:52 4,379,984 --a------ c:\winxp\system32\D3DX9_40.dll
2009-02-10 15:39 . 2008-10-10 04:52 2,036,576 --a------ c:\winxp\system32\D3DCompiler_40.dll
2009-02-10 15:39 . 2008-10-27 10:04 514,384 --a------ c:\winxp\system32\XAudio2_3.dll
2009-02-10 15:39 . 2008-10-10 04:52 452,440 --a------ c:\winxp\system32\d3dx10_40.dll
2009-02-10 15:39 . 2008-10-27 10:04 235,856 --a------ c:\winxp\system32\xactengine3_3.dll
2009-02-10 15:39 . 2008-10-27 10:04 70,992 --a------ c:\winxp\system32\XAPOFX1_2.dll
2009-02-10 15:39 . 2008-10-27 10:04 23,376 --a------ c:\winxp\system32\X3DAudio1_5.dll
2009-02-10 14:50 . 2009-02-10 14:50 578,560 --a--c--- c:\winxp\system32\dllcache\user32.dll
2009-02-10 14:48 . 2009-02-10 14:48 <DIR> d-------- c:\winxp\ERUNT
2009-02-10 14:29 . 2009-02-10 14:29 228 --a------ c:\winxp\system32\spupdsvc.inf
2009-02-09 23:28 . 2009-02-09 23:28 410,984 --a------ c:\winxp\system32\deploytk.dll
2009-02-09 20:10 . 2009-02-09 20:10 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-09 20:10 . 2009-02-09 20:10 <DIR> d-------- c:\documents and settings\Lauri\Application Data\Malwarebytes
2009-02-09 20:10 . 2009-02-09 20:10 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-09 20:10 . 2009-01-14 16:11 38,496 --a------ c:\winxp\system32\drivers\mbamswissarmy.sys
2009-02-09 20:10 . 2009-01-14 16:11 15,504 --a------ c:\winxp\system32\drivers\mbam.sys
2009-02-09 10:19 . 2009-02-09 10:19 <DIR> d-------- c:\program files\Trend Micro
2009-02-06 11:15 . 2009-02-06 11:15 164 --a------ C:\install.dat
2009-01-18 18:58 . 2007-11-14 15:18 553 --a------ c:\winxp\USetup.iss
2009-01-18 18:57 . 2008-08-05 20:10 1,684,736 --a------ c:\winxp\system32\drivers\Ambfilt.sys
2009-01-18 18:57 . 2006-01-04 15:41 1,389,056 --a------ c:\winxp\system32\drivers\Monfilt.sys
2009-01-18 18:57 . 2008-10-23 17:42 290,816 --a------ c:\winxp\vncutil.exe
2009-01-18 18:57 . 2008-06-24 14:46 104,992 --a------ c:\winxp\RtkAudioService.exe
2009-01-18 18:57 . 2009-01-05 16:16 34,816 --a------ c:\winxp\system32\RtkCoInstXP.dll
2009-01-18 15:57 . 2009-01-18 19:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\Electronic Arts
2009-01-15 21:19 . 2009-01-15 21:19 <DIR> d-------- c:\program files\OpenAL
2009-01-15 21:19 . 2008-04-28 15:53 805,400 -ra------ c:\winxp\system32\tmpBE.tmp
2009-01-15 21:19 . 2008-04-28 15:53 805,400 -ra------ c:\winxp\system32\tmpBD.tmp
2009-01-15 21:19 . 2009-01-15 21:19 444,952 --a------ c:\winxp\system32\wrap_oal.dll
2009-01-15 21:19 . 2009-01-15 21:19 109,080 --a------ c:\winxp\system32\OpenAL32.dll
2009-01-15 21:05 . 2009-01-15 21:32 <DIR> d-------- c:\program files\Codemasters
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-10 21:25 --------- d-----w c:\documents and settings\Lauri\Application Data\uTorrent
2009-02-10 21:23 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-02-10 20:00 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-02-10 19:54 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-02-10 19:54 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-10 16:34 --------- d-----w c:\program files\Winamp
2009-02-10 16:33 --------- d-----w c:\documents and settings\Lauri\Application Data\Winamp
2009-02-10 13:39 --------- d-----w c:\program files\Electronic Arts
2009-02-10 12:37 --------- d-----w c:\documents and settings\All Users\Application Data\2DBoy
2009-02-10 12:36 --------- d-----w c:\program files\Peggle Nights Deluxe
2009-02-10 12:34 --------- d-----w c:\documents and settings\All Users\Application Data\Codemasters
2009-02-09 21:28 --------- d-----w c:\program files\Java
2009-02-09 09:17 --------- d-----w c:\program files\Steam
2009-01-18 16:57 --------- d-----w c:\program files\Realtek
2009-01-18 15:35 --------- d-----w c:\program files\EA GAMES
2009-01-18 13:39 --------- d-----w c:\program files\AGEIA Technologies
2009-01-16 19:59 --------- d-----w c:\program files\Truck Dismount
2009-01-16 19:59 --------- d-----w c:\program files\Porrasturvat - Stair Dismount
2009-01-15 19:05 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-10 11:02 --------- d-----w c:\documents and settings\Lauri\Application Data\Nokia
2009-01-09 10:22 806 ----a-w c:\winxp\system32\drivers\SYMEVENT.INF
2009-01-09 10:22 60,808 ----a-w c:\winxp\system32\S32EVNT1.DLL
2009-01-09 10:22 124,464 ----a-w c:\winxp\system32\drivers\SYMEVENT.SYS
2009-01-09 10:22 10,635 ----a-w c:\winxp\system32\drivers\SYMEVENT.CAT
2009-01-09 10:22 --------- d-----w c:\program files\Symantec
2009-01-07 12:42 --------- d-----w c:\program files\directx
2009-01-07 12:33 --------- d-----w c:\program files\Commandos II
2009-01-06 17:00 4,968,448 ----a-w c:\winxp\system32\drivers\RtkHDAud.sys
2009-01-05 10:06 --------- d-----w c:\program files\ElastoManiaRegistered
2009-01-02 05:15 --------- d-----w c:\program files\Filzip
2009-01-01 18:45 --------- d-----w c:\documents and settings\Lauri\Application Data\dvdcss
2008-12-30 12:58 18,082,304 ----a-w c:\winxp\RTHDCPL.EXE
2008-12-26 16:06 --------- d-----w c:\documents and settings\All Users\Application Data\ifolor
2008-12-26 15:24 --------- d-----w c:\program files\ifolor
2008-12-26 15:24 --------- d-----w c:\documents and settings\Lauri\Application Data\ifolor
2008-12-11 10:57 333,952 ----a-w c:\winxp\system32\drivers\srv.sys
2008-11-29 20:52 111,928 ----a-w c:\winxp\system32\PnkBstrB.exe
2008-11-29 20:51 5,488,640 ----a-w c:\winxp\system32\xa94468328.exe
2008-11-29 20:51 5,488,640 ----a-w c:\winxp\system32\xa94468000.exe
2008-11-29 20:41 5,488,640 ----a-w c:\winxp\system32\xa93878828.exe
2008-11-29 20:41 5,488,640 ----a-w c:\winxp\system32\xa93878531.exe
2008-11-29 20:41 5,488,640 ----a-w c:\winxp\system32\xa93861843.exe
2008-11-29 20:41 5,488,640 ----a-w c:\winxp\system32\xa93861562.exe
2008-11-29 20:40 5,488,640 ----a-w c:\winxp\system32\xa93806484.exe
2008-11-29 20:40 5,488,640 ----a-w c:\winxp\system32\xa93806203.exe
2008-11-29 20:39 5,488,640 ----a-w c:\winxp\system32\xa93757593.exe
2008-11-29 20:39 5,488,640 ----a-w c:\winxp\system32\xa93757328.exe
2008-11-29 20:34 5,488,640 ----a-w c:\winxp\system32\xa93420390.exe
2008-11-29 20:34 5,488,640 ----a-w c:\winxp\system32\xa93420125.exe
2008-11-29 20:27 5,488,640 ----a-w c:\winxp\system32\xa93016609.exe
2008-11-29 20:27 5,488,640 ----a-w c:\winxp\system32\xa93016343.exe
2008-11-29 20:23 5,488,640 ----a-w c:\winxp\system32\xa92789078.exe
2008-11-29 20:23 5,488,640 ----a-w c:\winxp\system32\xa92787984.exe
2008-11-29 20:23 5,488,640 ----a-w c:\winxp\system32\xa92762484.exe
2008-11-29 20:23 5,488,640 ----a-w c:\winxp\system32\xa92762078.exe
2008-11-29 10:54 22,328 ----a-w c:\documents and settings\Lauri\Application Data\PnkBstrK.sys
2008-11-29 10:53 682,280 ----a-w c:\winxp\system32\pbsvc.exe
2008-11-29 10:53 66,872 ----a-w c:\winxp\system32\PnkBstrA.exe
2008-11-10 19:22 2,720 ----a-w c:\winxp\system32\ealregsnapshot1.reg
2008-06-30 10:44 324,976 ----a-w c:\program files\mozilla firefox\components\coFFPlgn.dll
2006-05-03 09:06 163,328 --sh--r c:\winxp\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r c:\winxp\system32\msfDX.dll
2008-03-16 12:30 216,064 --sh--r c:\winxp\system32\nbDX.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-02-10_15.18.22,57 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-01-18 15:35:34 53,248 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
+ 2009-02-10 13:38:44 53,248 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
- 2009-01-18 15:35:34 12,800 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
+ 2009-02-10 13:38:44 12,800 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
- 2009-01-18 15:35:35 473,600 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
+ 2009-02-10 13:38:45 473,600 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
- 2009-01-18 15:35:29 2,676,224 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-02-10 13:38:39 2,676,224 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-01-18 15:35:30 2,846,720 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-02-10 13:38:41 2,846,720 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-01-18 15:35:31 563,712 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-02-10 13:38:41 563,712 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-01-18 15:35:32 567,296 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-02-10 13:38:42 567,296 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-01-18 15:35:32 576,000 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-02-10 13:38:42 576,000 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-01-18 15:35:32 577,024 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-02-10 13:38:42 577,024 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-01-18 15:35:33 577,536 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-02-10 13:38:43 577,536 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-01-18 15:35:33 577,536 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-02-10 13:38:43 577,536 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-01-18 15:35:33 578,560 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-02-10 13:38:43 578,560 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-01-18 15:35:35 578,560 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2009-02-10 13:38:45 578,560 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2009-01-18 15:35:35 145,920 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
+ 2009-02-10 13:38:45 145,920 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
- 2009-01-18 15:35:35 159,232 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
+ 2009-02-10 13:38:45 159,232 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
- 2009-01-18 15:35:36 364,544 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
+ 2009-02-10 13:38:46 364,544 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
- 2009-01-18 15:35:36 178,176 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
+ 2009-02-10 13:38:46 178,176 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
- 2009-01-18 15:35:34 223,232 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
+ 2009-02-10 13:38:44 223,232 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
+ 2009-02-10 13:47:46 295,606 ----a-r c:\winxp\Installer\{9A996B6A-846E-4A89-B9C4-17546B7BE49F}\Burnout.exe
+ 2009-02-10 20:00:36 18,944 ----a-r c:\winxp\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
+ 2009-02-10 20:00:36 65,024 ----a-r c:\winxp\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
+ 2006-10-24 01:01:44 780,800 ----a-w c:\winxp\Resources\Themes\Zune\Shell\NormalColor\shellstyle.dll
+ 2009-02-10 20:34:37 16,384 ----atw c:\winxp\Temp\Perflib_Perfdata_618.dat
+ 2009-02-10 20:34:34 16,384 ----atw c:\winxp\Temp\Perflib_Perfdata_66c.dat
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded]
@="{4433A54A-1AC8-432F-90FC-85F045CF383C}"
[HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending]
@="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}"
[HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected]
@="{476D0EA3-80F9-48B5-B70B-05E677C9C148}"
[HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\winxp\system32\ctfmon.exe" [2008-04-14 15360]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-03-14 486856]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-01-15 1830128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"RivaTuner"="c:\program files\RivaTuner v2.08\RivaTuner.exe" [2008-03-10 2691072]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512]
"NvCplDaemon"="c:\winxp\system32\NvCpl.dll" [2008-09-17 13574144]
"NvMediaCenter"="c:\winxp\system32\NvMcTray.dll" [2008-09-17 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-09 148888]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\winxp\KHALMNPR.Exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\winxp\KHALMNPR.Exe]
"RTHDCPL"="RTHDCPL.EXE" [2008-12-30 c:\winxp\RTHDCPL.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\winxp\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2008-04-14 c:\winxp\system32\advpack.dll]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-03-27 113664]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-11-01 576104]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-08-02 805392]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 01:42 72208 c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"msacm.avis"= ff_acm.acm
"VIDC.DVSD"= pdvcodec.dll
"vidc.VSPX"= vspxvfw.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINXP\\system32\\PnkBstrA.exe"=
"c:\\WINXP\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Steam\\SteamApps\\cuqumber\\counter-strike source\\hl2.exe"=
"c:\\WINXP\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\EA GAMES\\Mirror's Edge\\Binaries\\MirrorsEdge.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutLauncher.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutConfigTool.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutParadise.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-02-18 149352]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-03 99376]
R3 FStarForce;FStarForce;c:\winxp\system32\drivers\FStarForce.sys [2008-10-30 9216]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\winxp\system32\drivers\ASPI32.SYS [2008-08-27 16512]
S3 COH_Mon;COH_Mon;c:\winxp\system32\drivers\COH_Mon.sys [2008-01-12 23888]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - COMHOST
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cddc304c-0397-11dd-b178-00508db7f3cb}]
\Shell\AutoRun\command - F:\setupSNK.exe
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\documents and settings\Lauri\Application Data\Mozilla\Firefox\Profiles\cxrlyn8r.default\
FF - prefs.js: browser.startup.homepage - hxxps://posti.sakky.fi/horde3/imp/login.php
FF - component: c:\program files\Mozilla Firefox\components\coFFPlgn.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-10 23:26:32
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-448539723-573735546-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:a8,7e,78,49,f9,b0,79,61,57,db,60,5e,4e,58,ce,05,0f,a1,d1,3c,93,03,2b,
fd,55,22,86,95,5b,f7,62,d4,f7,59,de,3f,de,5c,13,2a,c7,20,e7,2b,28,c1,54,ed,\
"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50
[HKEY_USERS\S-1-5-21-448539723-573735546-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:4d,5c,00,c4,dc,92,01,f6,4f,a0,dd,d6,c7,ea,a0,e6,93,10,91,c0,d3,
3e,f9,da,5c,f8,50,0f,ca,e3,fb,aa,93,89,47,1b,34,ff,6e,65,25,61,c3,fa,e4,87,\
"rkeysecu"=hex:cc,31,22,60,21,5f,50,e9,8c,4e,3d,41,70,20,8a,50
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(804)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll
.
Completion time: 2009-02-10 23:27:38
ComboFix-quarantined-files.txt 2009-02-10 21:27:36
ComboFix2.txt 2009-02-10 13:19:04
Pre-Run: 62 086 492 160 bytes free
Post-Run: 62,065,475,584 bytes free
296 --- E O F --- 2009-02-06 19:03:33
E8200 @ 3,2Ghz / XFX 8800 GTS 512mb / Abit IP35-e / 2Gt DDR800 / Antec NeoHE 430W / LG Flatron L194WT-SF 19"
|
|
Hujo
Suspended permanently
|
10. helmikuuta 2009 @ 23:47 |
Linkki tähän viestiin
|
Nyt tuon alla olevan lainauksen sisällön Kopioit / liität Tyhjään muistioon
käynnistä nappi >apuohjelmat > muistio
Lainaus:
File::
c:\winxp\system32\xa94468328.exe
c:\winxp\system32\xa94468000.exe
c:\winxp\system32\xa93878828.exe
c:\winxp\system32\xa93878531.exe
c:\winxp\system32\xa93861843.exe
c:\winxp\system32\xa93861562.exe
c:\winxp\system32\xa93806484.exe
c:\winxp\system32\xa93806203.exe
c:\winxp\system32\xa93757593.exe
c:\winxp\system32\xa93757328.exe
c:\winxp\system32\xa93420390.exe
c:\winxp\system32\xa93420125.exe
c:\winxp\system32\xa93016609.exe
c:\winxp\system32\xa93016343.exe
c:\winxp\system32\xa92789078.exe
c:\winxp\system32\xa92787984.exe
c:\winxp\system32\xa92762484.exe
c:\winxp\system32\xa92762078.exe
Tallenna se nimellä CFScript.txt työpöydälle
Sitten raahaa CFScript ComboFix.exeen kuten alla.
combofix työstää tulee sininen taulu paina numeroa 1 ja enter
Laita tuleva loki tänne.
Sammutat ja käynnistät koneen
Voiko tietsikka koskaan toimia?
|
|
m0pee
Junior Member
|
11. helmikuuta 2009 @ 08:24 |
Linkki tähän viestiin
|
ComboFix 09-02-10.02 - Lauri 2009-02-11 8:20:47.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1383 [GMT 2:00]
Running from: c:\documents and settings\Lauri\My Documents\Downloads\SOFTWARE\ComboFix.exe
Command switches used :: c:\documents and settings\Lauri\My Documents\Downloads\SOFTWARE\CFScript.txt
AV: Norton 360 *On-access scanning disabled* (Updated)
FW: Norton 360 *disabled*
* Created a new restore point
FILE ::
c:\winxp\system32\xa92762078.exe
c:\winxp\system32\xa92762484.exe
c:\winxp\system32\xa92787984.exe
c:\winxp\system32\xa92789078.exe
c:\winxp\system32\xa93016343.exe
c:\winxp\system32\xa93016609.exe
c:\winxp\system32\xa93420125.exe
c:\winxp\system32\xa93420390.exe
c:\winxp\system32\xa93757328.exe
c:\winxp\system32\xa93757593.exe
c:\winxp\system32\xa93806203.exe
c:\winxp\system32\xa93806484.exe
c:\winxp\system32\xa93861562.exe
c:\winxp\system32\xa93861843.exe
c:\winxp\system32\xa93878531.exe
c:\winxp\system32\xa93878828.exe
c:\winxp\system32\xa94468000.exe
c:\winxp\system32\xa94468328.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\winxp\system32\xa92762078.exe
c:\winxp\system32\xa92762484.exe
c:\winxp\system32\xa92787984.exe
c:\winxp\system32\xa92789078.exe
c:\winxp\system32\xa93016343.exe
c:\winxp\system32\xa93016609.exe
c:\winxp\system32\xa93420125.exe
c:\winxp\system32\xa93420390.exe
c:\winxp\system32\xa93757328.exe
c:\winxp\system32\xa93757593.exe
c:\winxp\system32\xa93806203.exe
c:\winxp\system32\xa93806484.exe
c:\winxp\system32\xa93861562.exe
c:\winxp\system32\xa93861843.exe
c:\winxp\system32\xa93878531.exe
c:\winxp\system32\xa93878828.exe
c:\winxp\system32\xa94468000.exe
c:\winxp\system32\xa94468328.exe
.
((((((((((((((((((((((((( Files Created from 2009-01-11 to 2009-02-11 )))))))))))))))))))))))))))))))
.
2009-02-10 22:01 . 2009-02-10 22:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-02-10 22:00 . 2009-02-10 22:00 <DIR> d-------- c:\program files\SUPERAntiSpyware
2009-02-10 22:00 . 2009-02-10 22:00 <DIR> d-------- c:\documents and settings\Lauri\Application Data\SUPERAntiSpyware.com
2009-02-10 15:39 . 2008-10-10 04:52 4,379,984 --a------ c:\winxp\system32\D3DX9_40.dll
2009-02-10 15:39 . 2008-10-10 04:52 2,036,576 --a------ c:\winxp\system32\D3DCompiler_40.dll
2009-02-10 15:39 . 2008-10-27 10:04 514,384 --a------ c:\winxp\system32\XAudio2_3.dll
2009-02-10 15:39 . 2008-10-10 04:52 452,440 --a------ c:\winxp\system32\d3dx10_40.dll
2009-02-10 15:39 . 2008-10-27 10:04 235,856 --a------ c:\winxp\system32\xactengine3_3.dll
2009-02-10 15:39 . 2008-10-27 10:04 70,992 --a------ c:\winxp\system32\XAPOFX1_2.dll
2009-02-10 15:39 . 2008-10-27 10:04 23,376 --a------ c:\winxp\system32\X3DAudio1_5.dll
2009-02-10 14:50 . 2009-02-10 14:50 578,560 --a--c--- c:\winxp\system32\dllcache\user32.dll
2009-02-10 14:48 . 2009-02-10 14:48 <DIR> d-------- c:\winxp\ERUNT
2009-02-10 14:29 . 2009-02-10 14:29 228 --a------ c:\winxp\system32\spupdsvc.inf
2009-02-09 23:28 . 2009-02-09 23:28 410,984 --a------ c:\winxp\system32\deploytk.dll
2009-02-09 20:10 . 2009-02-09 20:10 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-09 20:10 . 2009-02-09 20:10 <DIR> d-------- c:\documents and settings\Lauri\Application Data\Malwarebytes
2009-02-09 20:10 . 2009-02-09 20:10 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-09 20:10 . 2009-01-14 16:11 38,496 --a------ c:\winxp\system32\drivers\mbamswissarmy.sys
2009-02-09 20:10 . 2009-01-14 16:11 15,504 --a------ c:\winxp\system32\drivers\mbam.sys
2009-02-09 10:19 . 2009-02-09 10:19 <DIR> d-------- c:\program files\Trend Micro
2009-02-06 11:15 . 2009-02-06 11:15 164 --a------ C:\install.dat
2009-01-18 18:58 . 2007-11-14 15:18 553 --a------ c:\winxp\USetup.iss
2009-01-18 18:57 . 2008-08-05 20:10 1,684,736 --a------ c:\winxp\system32\drivers\Ambfilt.sys
2009-01-18 18:57 . 2006-01-04 15:41 1,389,056 --a------ c:\winxp\system32\drivers\Monfilt.sys
2009-01-18 18:57 . 2008-10-23 17:42 290,816 --a------ c:\winxp\vncutil.exe
2009-01-18 18:57 . 2008-06-24 14:46 104,992 --a------ c:\winxp\RtkAudioService.exe
2009-01-18 18:57 . 2009-01-05 16:16 34,816 --a------ c:\winxp\system32\RtkCoInstXP.dll
2009-01-18 15:57 . 2009-01-18 19:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\Electronic Arts
2009-01-15 21:19 . 2009-01-15 21:19 <DIR> d-------- c:\program files\OpenAL
2009-01-15 21:19 . 2008-04-28 15:53 805,400 -ra------ c:\winxp\system32\tmpBE.tmp
2009-01-15 21:19 . 2008-04-28 15:53 805,400 -ra------ c:\winxp\system32\tmpBD.tmp
2009-01-15 21:19 . 2009-01-15 21:19 444,952 --a------ c:\winxp\system32\wrap_oal.dll
2009-01-15 21:19 . 2009-01-15 21:19 109,080 --a------ c:\winxp\system32\OpenAL32.dll
2009-01-15 21:05 . 2009-01-15 21:32 <DIR> d-------- c:\program files\Codemasters
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-11 06:20 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-02-11 06:18 --------- d-----w c:\documents and settings\Lauri\Application Data\uTorrent
2009-02-10 20:00 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-02-10 19:54 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-02-10 19:54 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-10 16:34 --------- d-----w c:\program files\Winamp
2009-02-10 16:33 --------- d-----w c:\documents and settings\Lauri\Application Data\Winamp
2009-02-10 13:39 --------- d-----w c:\program files\Electronic Arts
2009-02-10 12:37 --------- d-----w c:\documents and settings\All Users\Application Data\2DBoy
2009-02-10 12:36 --------- d-----w c:\program files\Peggle Nights Deluxe
2009-02-10 12:34 --------- d-----w c:\documents and settings\All Users\Application Data\Codemasters
2009-02-09 21:28 --------- d-----w c:\program files\Java
2009-02-09 09:17 --------- d-----w c:\program files\Steam
2009-01-18 16:57 --------- d-----w c:\program files\Realtek
2009-01-18 15:35 --------- d-----w c:\program files\EA GAMES
2009-01-18 13:39 --------- d-----w c:\program files\AGEIA Technologies
2009-01-16 19:59 --------- d-----w c:\program files\Truck Dismount
2009-01-16 19:59 --------- d-----w c:\program files\Porrasturvat - Stair Dismount
2009-01-15 19:05 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-10 11:02 --------- d-----w c:\documents and settings\Lauri\Application Data\Nokia
2009-01-09 10:22 806 ----a-w c:\winxp\system32\drivers\SYMEVENT.INF
2009-01-09 10:22 60,808 ----a-w c:\winxp\system32\S32EVNT1.DLL
2009-01-09 10:22 124,464 ----a-w c:\winxp\system32\drivers\SYMEVENT.SYS
2009-01-09 10:22 10,635 ----a-w c:\winxp\system32\drivers\SYMEVENT.CAT
2009-01-09 10:22 --------- d-----w c:\program files\Symantec
2009-01-07 12:42 --------- d-----w c:\program files\directx
2009-01-07 12:33 --------- d-----w c:\program files\Commandos II
2009-01-06 17:00 4,968,448 ----a-w c:\winxp\system32\drivers\RtkHDAud.sys
2009-01-05 10:06 --------- d-----w c:\program files\ElastoManiaRegistered
2009-01-02 05:15 --------- d-----w c:\program files\Filzip
2009-01-01 18:45 --------- d-----w c:\documents and settings\Lauri\Application Data\dvdcss
2008-12-30 12:58 18,082,304 ----a-w c:\winxp\RTHDCPL.EXE
2008-12-26 16:06 --------- d-----w c:\documents and settings\All Users\Application Data\ifolor
2008-12-26 15:24 --------- d-----w c:\program files\ifolor
2008-12-26 15:24 --------- d-----w c:\documents and settings\Lauri\Application Data\ifolor
2008-12-11 10:57 333,952 ----a-w c:\winxp\system32\drivers\srv.sys
2008-11-29 20:52 111,928 ----a-w c:\winxp\system32\PnkBstrB.exe
2008-11-29 10:54 22,328 ----a-w c:\documents and settings\Lauri\Application Data\PnkBstrK.sys
2008-11-29 10:53 682,280 ----a-w c:\winxp\system32\pbsvc.exe
2008-11-29 10:53 66,872 ----a-w c:\winxp\system32\PnkBstrA.exe
2008-06-30 10:44 324,976 ----a-w c:\program files\mozilla firefox\components\coFFPlgn.dll
2006-05-03 09:06 163,328 --sh--r c:\winxp\system32\flvDX.dll
2007-02-21 10:47 31,232 --sh--r c:\winxp\system32\msfDX.dll
2008-03-16 12:30 216,064 --sh--r c:\winxp\system32\nbDX.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded]
@="{4433A54A-1AC8-432F-90FC-85F045CF383C}"
[HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending]
@="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}"
[HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected]
@="{476D0EA3-80F9-48B5-B70B-05E677C9C148}"
[HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}]
2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\winxp\system32\ctfmon.exe" [2008-04-14 15360]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-03-14 486856]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-01-15 1830128]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
"RivaTuner"="c:\program files\RivaTuner v2.08\RivaTuner.exe" [2008-03-10 2691072]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
"osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512]
"NvCplDaemon"="c:\winxp\system32\NvCpl.dll" [2008-09-17 13574144]
"NvMediaCenter"="c:\winxp\system32\NvMcTray.dll" [2008-09-17 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-09 148888]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\winxp\KHALMNPR.Exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\winxp\KHALMNPR.Exe]
"RTHDCPL"="RTHDCPL.EXE" [2008-12-30 c:\winxp\RTHDCPL.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\winxp\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_3"="advpack.dll" [2008-04-14 c:\winxp\system32\advpack.dll]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-03-27 113664]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-11-01 576104]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-08-02 805392]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 01:42 72208 c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"msacm.avis"= ff_acm.acm
"VIDC.DVSD"= pdvcodec.dll
"vidc.VSPX"= vspxvfw.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\WINXP\\system32\\PnkBstrA.exe"=
"c:\\WINXP\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Steam\\SteamApps\\cuqumber\\counter-strike source\\hl2.exe"=
"c:\\WINXP\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\EA GAMES\\Mirror's Edge\\Binaries\\MirrorsEdge.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutLauncher.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutConfigTool.exe"=
"c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutParadise.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-02-18 149352]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-03 99376]
R3 FStarForce;FStarForce;c:\winxp\system32\drivers\FStarForce.sys [2008-10-30 9216]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\winxp\system32\drivers\ASPI32.SYS [2008-08-27 16512]
S3 COH_Mon;COH_Mon;c:\winxp\system32\drivers\COH_Mon.sys [2008-01-12 23888]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - COMHOST
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cddc304c-0397-11dd-b178-00508db7f3cb}]
\Shell\AutoRun\command - F:\setupSNK.exe
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\documents and settings\Lauri\Application Data\Mozilla\Firefox\Profiles\cxrlyn8r.default\
FF - prefs.js: browser.startup.homepage - hxxps://posti.sakky.fi/horde3/imp/login.php
FF - component: c:\program files\Mozilla Firefox\components\coFFPlgn.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-11 08:21:29
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-448539723-573735546-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:a8,7e,78,49,f9,b0,79,61,57,db,60,5e,4e,58,ce,05,0f,a1,d1,3c,93,03,2b,
fd,55,22,86,95,5b,f7,62,d4,f7,59,de,3f,de,5c,13,2a,c7,20,e7,2b,28,c1,54,ed,\
"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50
[HKEY_USERS\S-1-5-21-448539723-573735546-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:4d,5c,00,c4,dc,92,01,f6,4f,a0,dd,d6,c7,ea,a0,e6,93,10,91,c0,d3,
3e,f9,da,5c,f8,50,0f,ca,e3,fb,aa,93,89,47,1b,34,ff,6e,65,25,61,c3,fa,e4,87,\
"rkeysecu"=hex:cc,31,22,60,21,5f,50,e9,8c,4e,3d,41,70,20,8a,50
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(804)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
c:\program files\common files\logitech\bluetooth\LBTServ.dll
.
Completion time: 2009-02-11 8:22:37
ComboFix-quarantined-files.txt 2009-02-11 06:22:35
ComboFix2.txt 2009-02-10 21:27:39
ComboFix3.txt 2009-02-10 13:19:04
Pre-Run: 62 065 885 184 bytes free
Post-Run: 61,945,597,952 bytes free
272 --- E O F --- 2009-02-06 19:03:33
E8200 @ 3,2Ghz / XFX 8800 GTS 512mb / Abit IP35-e / 2Gt DDR800 / Antec NeoHE 430W / LG Flatron L194WT-SF 19"
|
|
Hujo
Suspended permanently
|
11. helmikuuta 2009 @ 08:49 |
Linkki tähän viestiin
|
Kirjoita suorita luukkuun
ComboFix /u
Klikkaa ok
============
Lataa Tästä Ccleaner
CCleaner v 2.14.750.- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
Asennuksen jälkeen aukaise CCleaneri.
Valitse vasemmalta pystyrivistä Options.
Valitse viereisestä pystyrivistä Settings.
Language kohtaan valitse Suomi.
Puhdistaja
Valitse vasemmalta pystyrivistä Puhdistaja.
Paina alhaalta Tutki.
Nyt CCleaneri tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
Kun tutkiminen on valmis, paina Aja CCleaner.
Nyt CCleaneri poistaa löydetyt tempit, cookiessit jne.
Rekisterin virheiden korjaus
Valitse vasemmalta pystyrivistä Rekisteri.
Paina alhaalta Etsi rekisterin virheitä.
Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
Saat vielä varmistus kysymyksen, paina Ok.
Kun virheet on korjattu, paina Sulje.
Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.
Voiko tietsikka koskaan toimia?
|
|
m0pee
Junior Member
|
11. helmikuuta 2009 @ 14:45 |
Linkki tähän viestiin
|
|
Nämä tehty, vieläkö on jotain?
E8200 @ 3,2Ghz / XFX 8800 GTS 512mb / Abit IP35-e / 2Gt DDR800 / Antec NeoHE 430W / LG Flatron L194WT-SF 19"
|
|
Hujo
Suspended permanently
|
11. helmikuuta 2009 @ 17:14 |
Linkki tähän viestiin
|
Voiko tietsikka koskaan toimia?
|
|
m0pee
Junior Member
|
11. helmikuuta 2009 @ 22:23 |
Linkki tähän viestiin
|
pari matoa vielä löytyi:
File C:\Documents and Settings\Lauri\Application Data\SecuROM\UserData\???????????p????????? infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\Lauri\Application Data\SecuROM\UserData\???????????p????????? infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
E8200 @ 3,2Ghz / XFX 8800 GTS 512mb / Abit IP35-e / 2Gt DDR800 / Antec NeoHE 430W / LG Flatron L194WT-SF 19"
|
|
Hujo
Suspended permanently
|
12. helmikuuta 2009 @ 00:25 |
Linkki tähän viestiin
|
|
nooh eiköhän sillä taas pari päivää pärjää.
Voiko tietsikka koskaan toimia?
|
|
Mainos
|
|
|
|
m0pee
Junior Member
|
12. helmikuuta 2009 @ 08:46 |
Linkki tähän viestiin
|
|
pärjäilee varmaan, kiitokset vaan avusta!
E8200 @ 3,2Ghz / XFX 8800 GTS 512mb / Abit IP35-e / 2Gt DDR800 / Antec NeoHE 430W / LG Flatron L194WT-SF 19"
|
|
