|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
Turhia pop-uppeja
|
|
|
JayKay76
Newbie
|
12. helmikuuta 2008 @ 18:39 |
Linkki tähän viestiin
|
Minulla tuli myös viikon vanhaan koneeseeni sama core.cache.dsk, joka aiheutti samoja pop-uppeja. Löysin eräältä tech support foorumilta pulmaan samanlaiset ohjeet kuin tässä ketjussa(SDfix ja Combofix). SDFix ei pyörähtänyt käyntiin ollenkaan, eikä core.cache.dsk tiedostoa löytynyt vikasietotilassa manuaalisesti etsimällä. Combofix ei myöskään suostunut lähtemään käyntiin ennen kuin ajoin sen vikasietotilassa. Silloin tuo core.cache.dsk lähti kuin kuppa Töölöstä. Combofix poisti kuitenkin myös jotain muita tiedostoja ja huolestuin asiasta. Koneeni toimii aivan normaalisti, mutta voisiko joku asiaatunteva ottaa kantaa siihen kannattaako Combofixiä ajaa vikasietotilassa ollenkaan. Laitan tähän oman combofix raporttini ja olisin kiitollinen jos joku osaa sanoa mitä nuo muut sen poistamat tiedostot ovat. Yksi tiedostoista oli joku Norton Antivirus ohjelman rekisterin osa, mutta se oli helposti korjattavissa. Loppujen osalta olen huolissani ja pelkään ikäviä yllätyksiä:
ComboFix 08-02.05.3 - Jukka 2008-02-05 16:35:27.1 - NTFSx86 MINIMAL
Microsoft® Windows Vista? Home Premium 6.0.6000.0.1252.1.1035.18.2474 [GMT 2:00]
Running from: C:\Users\Jukka\Desktop\ComboFix.exe
.
Systeemioikeuksien saaminen epäonnistui
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Windows\system32\koos.exe
C:\Windows\system32\kprof
C:\Windows\system32\poof
C:\PROGRA~2\Microsoft\Network\Downloader\qmgr0.dat
C:\PROGRA~2\Microsoft\Network\Downloader\qmgr1.dat
C:\Windows\system32\drivers\core.cache.dsk
C:\Windows\system32\drivers\ULIAGPKXX.sys
----- BITS: Possible infected sites -----
hxxp://www.download.windowsupdate.com
hxxp://www.download.wõj+|?C? ü¤Ì?v÷+È@?J?:®½?NêGD_©½ºD?QÄ{¶ÀzÎ?Z?®ÞÛO??mOÌ¢?ºª Qç?5ÙG?ó]ëõñ?WU Client Download S-1-5-18 @x ?`lð@\???? 6ÚVwoQZC¬¬D¢HÿóMsC:\Windows\SoftwareDistribution\Download\d45065281eb60e3ce99b1626269da350\bd585ca264188b2a7d90675d2a79365ff30afb30?
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_ULIAGPKXX
-------\ULIAGPKXX
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-01-05 to 2008-02-05 )))))))))))))))))
.
2008-02-04 01:44 . 2008-02-04 01:44 <KANSIO> d-------- C:\Users\All Users\PC Tools
2008-02-04 01:44 . 2008-02-04 01:44 <KANSIO> d-------- C:\Program Files\Common Files\PC Tools
2008-02-04 01:44 . 2008-02-04 01:44 <KANSIO> d-------- C:\PROGRA~2\PC Tools
2008-02-04 01:44 . 2008-02-04 01:44 218,504 --a------ C:\Windows\System32\drivers\pctfw2.sys
2008-02-04 01:12 . 2008-02-04 01:12 <KANSIO> d-------- C:\Users\Jukka\AppData\Roaming\PC Tools
2008-02-04 01:12 . 2008-02-05 16:42 <KANSIO> d-a------ C:\Users\All Users\TEMP
2008-02-04 01:12 . 2008-02-05 16:41 <KANSIO> d-------- C:\Program Files\Spyware Doctor
2008-02-04 01:12 . 2008-02-05 16:42 <KANSIO> d-a------ C:\PROGRA~2\TEMP
2008-02-04 01:12 . 2007-12-10 14:53 81,288 --a------ C:\Windows\System32\drivers\iksyssec.sys
2008-02-04 01:12 . 2007-12-10 14:53 66,952 --a------ C:\Windows\System32\drivers\iksysflt.sys
2008-02-04 01:12 . 2007-12-10 14:53 41,864 --a------ C:\Windows\System32\drivers\ikfilesec.sys
2008-02-04 01:12 . 2007-12-10 14:53 29,576 --a------ C:\Windows\System32\drivers\kcom.sys
2008-02-03 23:52 . 2008-02-03 23:52 <KANSIO> d-------- C:\Users\Jukka\AppData\Roaming\PeerNetworking
2008-02-03 20:58 . 2008-02-04 02:15 <KANSIO> d-------- C:\Users\All Users\Lavasoft
2008-02-03 20:58 . 2008-02-04 02:15 <KANSIO> d-------- C:\PROGRA~2\Lavasoft
2008-02-03 00:20 . 2008-02-03 00:20 <KANSIO> d-------- C:\Users\Jukka\AppData\Roaming\Yahoo!
2008-02-03 00:20 . 2008-02-03 12:27 <KANSIO> d-------- C:\Users\All Users\Yahoo! Companion
2008-02-03 00:20 . 2008-02-03 00:20 <KANSIO> d-------- C:\Program Files\Yahoo!
2008-02-03 00:20 . 2008-02-03 12:27 <KANSIO> d-------- C:\PROGRA~2\Yahoo! Companion
2008-02-03 00:19 . 2008-02-03 00:19 <KANSIO> d-------- C:\Windows\cache
2008-02-02 22:59 . 2008-02-02 22:59 1,060,920 --a------ C:\Windows\System32\drivers\ntfs.sys
2008-02-02 22:59 . 2008-02-02 22:59 211,000 --a------ C:\Windows\System32\drivers\volsnap.sys
2008-02-02 22:59 . 2008-02-02 22:59 154,624 --a------ C:\Windows\System32\drivers\nwifi.sys
2008-02-02 22:59 . 2008-02-02 22:59 109,624 --a------ C:\Windows\System32\drivers\ataport.sys
2008-02-02 22:59 . 2008-02-02 22:59 45,112 --a------ C:\Windows\System32\drivers\pciidex.sys
2008-02-02 22:59 . 2008-02-02 22:59 21,560 --a------ C:\Windows\System32\drivers\atapi.sys
2008-02-02 22:59 . 2008-02-02 22:59 15,928 --a------ C:\Windows\System32\drivers\pciide.sys
2008-02-02 03:19 . 2008-02-02 03:19 <KANSIO> d-------- C:\Users\All Users\ConeXware
2008-02-02 03:19 . 2008-02-02 03:19 <KANSIO> d-------- C:\PROGRA~2\ConeXware
2008-02-02 00:22 . 2008-02-03 13:05 <KANSIO> d-------- C:\Users\Jukka\AppData\Roaming\BSplayer PRO
2008-02-01 23:57 . 2008-02-01 23:57 <KANSIO> d-------- C:\Program Files\Windows Live
2008-02-01 23:57 . 2008-02-02 00:04 <KANSIO> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-02-01 23:56 . 2008-02-01 23:56 <KANSIO> d-------- C:\Users\All Users\WLInstaller
2008-02-01 23:56 . 2008-02-01 23:56 <KANSIO> d-------- C:\PROGRA~2\WLInstaller
2008-02-01 22:01 . 2008-02-01 22:01 <KANSIO> d-------- C:\Users\Jukka\AppData\Roaming\HP
2008-02-01 21:50 . 2008-02-01 21:50 <KANSIO> d-------- C:\Users\All Users\HP Product Assistant
2008-02-01 21:50 . 2008-02-01 21:50 <KANSIO> d-------- C:\PROGRA~2\HP Product Assistant
2008-02-01 21:46 . 2008-02-01 21:46 1,584,128 --a------ C:\Windows\System32\setupapi.dll
2008-02-01 21:43 . 2008-02-01 21:57 147,375 --a------ C:\Windows\hpiins06.dat
2008-02-01 21:43 . 2007-04-23 13:31 0 --------- C:\Windows\hpimdl06.dat
2008-02-01 21:23 . 2008-02-02 00:12 <KANSIO> d-------- C:\Program Files\Webteh
2008-02-01 20:18 . 2008-02-01 20:19 <KANSIO> d-------- C:\Program Files\Microsoft Expression
2008-02-01 20:14 . 2008-02-02 22:54 39 --a------ C:\Windows\vbaddin.ini
2008-02-01 20:13 . 2008-02-03 00:50 162 --a------ C:\Windows\ODBC.INI
2008-02-01 20:11 . 2006-10-26 19:56 32,592 --a------ C:\Windows\System32\msonpmon.dll
2008-02-01 20:08 . 2008-02-01 20:08 <KANSIO> d-------- C:\Windows\PCHEALTH
2008-02-01 20:08 . 2008-02-01 20:08 <KANSIO> d-------- C:\Program Files\Microsoft.NET
2008-02-01 20:06 . 2008-02-01 20:06 <KANSIO> d-------- C:\Program Files\Microsoft Visual Studio 8
2008-02-01 20:05 . 2008-02-03 00:51 <KANSIO> d-------- C:\Users\All Users\Microsoft Help
2008-02-01 20:05 . 2008-02-03 00:51 <KANSIO> d-------- C:\PROGRA~2\Microsoft Help
2008-02-01 20:04 . 2008-02-01 20:04 <KANSIO> dr-h----- C:\MSOCache
2008-02-01 18:58 . 2008-02-01 18:58 <KANSIO> d-------- C:\Program Files\PowerArchiver
2008-02-01 18:11 . 2008-02-01 18:11 <KANSIO> d-------- C:\Program Files\uTorrent
2008-02-01 18:10 . 2008-02-04 16:01 <KANSIO> d-------- C:\Users\Jukka\AppData\Roaming\uTorrent
2008-02-01 15:14 . 2006-11-02 12:23 <KANSIO> dr------- C:\Users\Mcx1\Videos
2008-02-01 15:14 . 2006-11-02 12:23 <KANSIO> d-------- C:\Users\Mcx1\Saved Games
2008-02-01 15:14 . 2006-11-02 12:23 <KANSIO> dr------- C:\Users\Mcx1\Pictures
2008-02-01 15:14 . 2006-11-02 12:23 <KANSIO> dr------- C:\Users\Mcx1\Music
2008-02-01 15:14 . 2006-11-02 12:23 <KANSIO> dr------- C:\Users\Mcx1\Links
2008-02-01 15:14 . 2006-11-02 12:23 <KANSIO> dr------- C:\Users\Mcx1\Downloads
2008-02-01 15:14 . 2008-02-01 15:14 <KANSIO> dr------- C:\Users\Mcx1\Documents
2008-02-01 15:14 . 2008-02-01 15:15 <KANSIO> d--h----- C:\Users\Mcx1\AppData
2008-02-01 15:01 . 2008-01-12 18:32 23,904 --a------ C:\Windows\System32\drivers\COH_Mon.sys
2008-02-01 15:01 . 2008-01-15 09:54 10,537 --a------ C:\Windows\System32\drivers\COH_Mon.cat
2008-02-01 15:01 . 2008-01-15 05:28 706 --a------ C:\Windows\System32\drivers\COH_Mon.inf
2008-02-01 14:57 . 2008-02-01 14:57 2,923,520 --a------ C:\Windows\explorer.exe
2008-02-01 14:56 . 2008-02-01 14:56 8,147,968 --a------ C:\Windows\System32\wmploc.DLL
2008-02-01 14:56 . 2008-02-01 14:56 802,816 --a------ C:\Windows\System32\drivers\tcpip.sys
2008-02-01 14:56 . 2008-02-01 14:56 356,864 --a------ C:\Windows\System32\MediaMetadataHandler.dll
2008-02-01 14:56 . 2008-02-01 14:56 216,760 --a------ C:\Windows\System32\drivers\netio.sys
2008-02-01 14:56 . 2008-02-01 14:56 167,424 --a------ C:\Windows\System32\tcpipcfg.dll
2008-02-01 14:56 . 2008-02-01 14:56 24,064 --a------ C:\Windows\System32\netcfg.exe
2008-02-01 14:56 . 2008-02-01 14:56 22,016 --a------ C:\Windows\System32\netiougc.exe
2008-02-01 14:56 . 2008-02-01 14:56 7,680 --a------ C:\Windows\System32\spwmp.dll
2008-02-01 14:56 . 2008-02-01 14:56 4,096 --a------ C:\Windows\System32\msdxm.ocx
2008-02-01 14:56 . 2008-02-01 14:56 4,096 --a------ C:\Windows\System32\dxmasf.dll
2008-02-01 14:55 . 2008-02-01 14:55 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-01 14:55 . 2008-02-01 14:55 1,686,016 --a------ C:\Windows\System32\gameux.dll
2008-02-01 14:53 . 2008-02-01 14:53 1,327,104 --a------ C:\Windows\System32\quartz.dll
2008-02-01 14:53 . 2008-02-01 14:53 1,244,672 --a------ C:\Windows\System32\mcmde.dll
2008-02-01 14:53 . 2008-02-01 14:53 223,232 --a------ C:\Windows\System32\WMASF.DLL
2008-02-01 14:53 . 2008-02-01 14:53 9,728 --a------ C:\Windows\System32\LAPRXY.DLL
2008-02-01 14:53 . 2008-02-01 14:53 2,048 --a------ C:\Windows\System32\asferror.dll
2008-02-01 14:52 . 2008-02-01 14:52 1,984,512 --a------ C:\Windows\System32\authui.dll
2008-02-01 14:52 . 2008-02-01 14:52 712,192 --a------ C:\Windows\System32\WindowsCodecs.dll
2008-02-01 14:52 . 2008-02-01 14:52 269,824 --a------ C:\Windows\System32\schannel.dll
2008-02-01 14:52 . 2008-02-01 14:52 220,160 --a------ C:\Windows\System32\ntprint.dll
2008-02-01 14:52 . 2008-02-01 14:52 120,320 --a------ C:\Windows\System32\dhcpcsvc6.dll
2008-02-01 14:52 . 2008-02-01 14:52 61,440 --a------ C:\Windows\System32\ntprint.exe
2008-02-01 14:52 . 2008-02-01 14:52 10,240 --a------ C:\Windows\System32\dhcpcmonitor.dll
2008-02-01 14:49 . 2008-02-01 14:49 3,505,848 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-02-01 14:49 . 2008-02-01 14:49 3,472,056 --a------ C:\Windows\System32\ntoskrnl.exe
2008-02-01 14:49 . 2008-02-01 14:49 788,992 --a------ C:\Windows\System32\rpcrt4.dll
2008-02-01 14:49 . 2008-02-01 14:49 750,080 --a------ C:\Windows\System32\qmgr.dll
2008-02-01 14:49 . 2008-02-01 14:49 130,048 --a------ C:\Windows\System32\drivers\srv2.sys
2008-02-01 14:49 . 2008-02-01 14:49 101,888 --a------ C:\Windows\System32\drivers\mrxsmb.sys
2008-02-01 14:49 . 2008-02-01 14:49 84,992 --a------ C:\Windows\System32\drivers\srvnet.sys
2008-02-01 14:49 . 2008-02-01 14:49 58,368 --a------ C:\Windows\System32\drivers\mrxsmb20.sys
2008-02-01 14:49 . 2008-02-01 14:49 2,048 --a------ C:\Windows\System32\tzres.dll
2008-01-27 17:30 . 2008-01-27 17:30 <KANSIO> dr------- C:\Users\Onni\Videos
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-03 23:26 --------- d-----w C:\PROGRA~2\Symantec
2008-02-01 19:51 --------- d-----w C:\Program Files\Common Files\HP
2008-02-01 19:50 --------- d-----w C:\PROGRA~2\HP
2008-02-01 19:45 --------- d-----w C:\Program Files\HP
2008-02-01 18:09 --------- d-----w C:\Program Files\MSBuild
2008-02-01 18:09 --------- d-----w C:\Program Files\Microsoft Works
2008-02-01 13:45 174 --sha-w C:\Program Files\desktop.ini
2008-02-01 13:41 --------- d-----w C:\Program Files\Windows Sidebar
2008-02-01 13:41 --------- d-----w C:\Program Files\Windows Mail
2008-02-01 13:41 --------- d-----w C:\Program Files\Windows Calendar
2008-02-01 12:58 8,192 ----a-w C:\Windows\System32\riched32.dll
2008-02-01 12:58 77,824 ----a-w C:\Windows\System32\rascfg.dll
2008-02-01 12:58 70,144 ----a-w C:\Windows\system32\drivers\pacer.sys
2008-02-01 12:58 694,784 ----a-w C:\Windows\System32\localspl.dll
2008-02-01 12:58 619,008 ----a-w C:\Windows\system32\drivers\dxgkrnl.sys
2008-02-01 12:58 61,952 ----a-w C:\Windows\system32\drivers\wanarp.sys
2008-02-01 12:58 52,736 ----a-w C:\Windows\System32\rasdiag.dll
2008-02-01 12:58 48,640 ----a-w C:\Windows\system32\drivers\ndproxy.sys
2008-02-01 12:58 384,000 ----a-w C:\Windows\System32\netcfgx.dll
2008-02-01 12:58 36,864 ----a-w C:\Windows\System32\cdd.dll
2008-02-01 12:58 33,280 ----a-w C:\Windows\System32\traffic.dll
2008-02-01 12:58 32,768 ----a-w C:\Windows\System32\rasmxs.dll
2008-02-01 12:58 286,208 ----a-w C:\Windows\System32\ipnathlp.dll
2008-02-01 12:58 22,016 ----a-w C:\Windows\System32\rasser.dll
2008-02-01 12:58 20,480 ----a-w C:\Windows\system32\drivers\ndistapi.sys
2008-02-01 12:58 15,360 ----a-w C:\Windows\System32\pacerprf.dll
2008-02-01 12:58 134,656 ----a-w C:\Windows\System32\dps.dll
2008-02-01 12:58 13,824 ----a-w C:\Windows\System32\wshqos.dll
2008-02-01 12:58 13,824 ----a-w C:\Windows\System32\icsunattend.exe
2008-02-01 12:57 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr
2008-02-01 12:57 67,584 ----a-w C:\Windows\System32\wlanhlp.dll
2008-02-01 12:57 542,720 ----a-w C:\Windows\System32\sysmain.dll
2008-02-01 12:57 502,784 ----a-w C:\Windows\System32\wlansvc.dll
2008-02-01 12:57 47,104 ----a-w C:\Windows\System32\wlanapi.dll
2008-02-01 12:57 297,984 ----a-w C:\Windows\System32\wlansec.dll
2008-02-01 12:57 290,816 ----a-w C:\Windows\System32\wlanmsm.dll
2008-02-01 12:57 258,232 ----a-w C:\Windows\system32\drivers\acpi.sys
2008-02-01 12:57 24,064 ----a-w C:\Windows\System32\wtsapi32.dll
2008-02-01 12:57 2,028,544 ----a-w C:\Windows\System32\win32k.sys
2008-02-01 12:55 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-01 12:55 449,024 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-01 12:55 2,143,744 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-01 12:55 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-01 12:51 88,576 ----a-w C:\Windows\System32\avifil32.dll
2008-02-01 12:51 84,480 ----a-w C:\Windows\System32\INETRES.dll
2008-02-01 12:51 82,944 ----a-w C:\Windows\System32\mciavi32.dll
2008-02-01 12:51 8,138,240 ----a-w C:\Windows\System32\ssBranded.scr
2008-02-01 12:51 737,792 ----a-w C:\Windows\System32\inetcomm.dll
2008-02-01 12:51 69,632 ----a-w C:\Windows\System32\sendmail.dll
2008-02-01 12:51 65,024 ----a-w C:\Windows\System32\avicap32.dll
2008-02-01 12:51 31,232 ----a-w C:\Windows\System32\msvidc32.dll
2008-02-01 12:51 123,904 ----a-w C:\Windows\System32\msvfw32.dll
2008-02-01 12:51 12,800 ----a-w C:\Windows\System32\msrle32.dll
2008-02-01 12:51 11,776 ----a-w C:\Windows\System32\sbunattend.exe
2008-02-01 12:50 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-02-01 12:50 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-02-01 12:50 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-01 12:50 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-01-27 10:38 805 ----a-w C:\Windows\system32\drivers\SYMEVENT.INF
2008-01-27 10:38 123,952 ----a-w C:\Windows\system32\drivers\SYMEVENT.SYS
2008-01-27 10:38 10,740 ----a-w C:\Windows\system32\drivers\SYMEVENT.CAT
2008-01-27 10:38 --------- d-----w C:\Program Files\Symantec
2008-01-27 10:38 --------- d-----w C:\Program Files\Norton Internet Security
2008-01-27 10:38 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-01-27 10:27 --------- d-----w C:\Program Files\Google
2008-01-26 18:35 1,836 --sha-r C:\Windows\system32\drivers\103C_HP_CPC_GU638AA-UUW m9062.sc_YC_0Pavi_QCZH742_E74FIv3PrA2_49_INARRA2_SASUSTek Computer INC._V2.00_B5.11_T070716_WUH0_L40B_M3071_J320_7AMD_8Athlon 64 X2 Dual Core_92.6_#080126_N10DE03EF_Z_G10DE0402.MRK
2008-01-26 18:31 --------- d-sh--w C:\PROGRA~2\Työpöytä
2008-01-26 18:31 --------- d-sh--w C:\PROGRA~2\Tiedostot
2008-01-26 18:31 --------- d-sh--w C:\PROGRA~2\Suosikit
2008-01-26 18:31 --------- d-sh--w C:\PROGRA~2\Mallit
2008-01-26 18:31 --------- d-sh--w C:\PROGRA~2\Käynnistä-valikko
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-02-01 14:51 1232896]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 14:35 125440]
"PowerArchiver Tray"="C:\Program Files\PowerArchiver\PASTARTER.EXE" [2008-01-24 19:37 141352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2007-10-03 02:54 1006264]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 17:01 65536]
"KBD"="C:\HP\KBD\KbdStub.EXE" [2006-12-08 18:16 65536]
"OsdMaestro"="C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 13:59 118784]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-07-06 15:15 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-07-06 15:15 8466432]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-07-06 15:15 81920]
"RtHDVCpl"="RtHDVCpl.exe" [2007-07-06 13:06 4669440 C:\Windows\RtHDVCpl.exe]
"HP Health Check Scheduler"="c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-05-24 12:13 71176]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"SunJavaUpdateReg"="C:\Windows\system32\jureg.exe" [2007-04-07 01:56 54936]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 21:34 49152]
"ccApp"="c:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 16:59 115816]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 10:22 517768]
"WPCUMI"="C:\Windows\system32\WpcUmi.exe" [2006-11-02 14:35 176128]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2007-12-10 14:53 1103752]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="%WINDIR%\SMINST\launcher.exe" [ ]
C:\PROGRA~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 21:26:24 210520]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"LogonHoursAction"= 2 (0x2)
"DontDisplayLogonHoursWarnings"= 1 (0x1)
R1 IDSvix86;Symantec Intrusion Prevention Driver;C:\PROGRA~2\Symantec\DEFINI~1\SymcData\idsdefs\20080122.002\IDSvix86.sys [2007-12-04 17:51]
R1 pctfw2;pctfw2;C:\Windows\System32\drivers\pctfw2.sys [2008-02-04 01:44]
R2 Automaattinen LiveUpdate-ajastustoiminto;Automaattinen LiveUpdate-ajastustoiminto;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe" [2007-09-26 12:53]
R2 HPBtnSrv;HP Chasis Button Service;c:\hp\HPEZBTN\HPBtnSrv.exe [2007-05-29 17:19]
R3 HCW85BDA;Hauppauge WinTV 885 Video Capture;C:\Windows\system32\drivers\HCW85BDA.sys [2007-06-11 11:49]
R3 SYMNDISV;SYMNDISV;C:\Windows\system32\Drivers\SYMNDISV.SYS [2007-10-30 19:55]
S3 netr73;USB Wireless 802.11 b/g Adaptor Driver for Vista;C:\Windows\system32\DRIVERS\netr73.sys [2007-04-20 19:21]
S3 UMPass;Microsoft UMPass-ohjain;C:\Windows\system32\DRIVERS\umpass.sys [2006-11-02 10:55]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
*Newly Created Service* - COMHOST
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-05 16:41:51
Windows 6.0.6000 NTFS
detected NTDLL code modification:
ZwClose
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
c:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\conime.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\schtasks.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehRecvr.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\hp\kbd\kbd.exe
.
**************************************************************************
.
Completion time: 2008-02-05 16:44:35 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-05 14:44:29
.
2008-02-02 20:59:28 --- E O F ---
|
|
Hujo
Suspended permanently
|
13. helmikuuta 2008 @ 14:10 |
Linkki tähän viestiin
|
|
JayKay76
Aloita oma viestiketju
Jos tarvetta on
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 13. helmikuuta 2008 @ 14:12
|
Junior Member
1 tuotearvio
|
19. helmikuuta 2008 @ 11:54 |
Linkki tähän viestiin
|
Itsellänikin oli core.cache.dsk ja onnistuin poistamaan sen.
elikkä c:\windows\system32\drivers\ kansiossa on tiedosto core.cache.dsk
mutta siellä on myös toinen tiedosto jolla on aivan sama muokkaus päivämäärä kuin tiedostolla core.cache.dsk (tämän tiedoston nimi on sattumanvarainen itselläni mpioo.sys)
Poistin kummakkin tiedostot windowssin levyllä olevalla korjauskonsolilla...
cd system32
cd drivers
del core.cache.dsk
del mpioo.sys
|
|
