|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
HJT-logi onko vikaa?
|
|
|
norsuu
Suspended due to non-functional email address
|
7. helmikuuta 2008 @ 15:42 |
Linkki tähän viestiin
|
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:28:24, on 7.2.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\TuneUp Utilities 2008\Integrator.exe
C:\Program Files\CCleaner\CCleaner.exe
C:\Documents and Settings\Matti\Työpöytä\HiJackThis_v2.0.2.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15034/CTPID.cab
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
--
End of file - 8898 bytes
|
|
norsuu
Suspended due to non-functional email address
|
8. helmikuuta 2008 @ 19:08 |
Linkki tähän viestiin
|
|
Niin voisiko joku tarkistaa onko tuossa mitään vikaa?
|
|
Hujo
Suspended permanently
|
10. helmikuuta 2008 @ 10:37 |
Linkki tähän viestiin
|
1.Lataa combofix.exe työpöydällesi jommastakummasta linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Voiko tietsikka koskaan toimia?
|
|
norsuu
Suspended due to non-functional email address
|
11. helmikuuta 2008 @ 18:50 |
Linkki tähän viestiin
|
ComboFix 08-02-11.2 - Matti 2008-02-11 18:45:31.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.1482 [GMT 2:00]
Running from: C:\Documents and Settings\Matti\Työpöytä\ComboFix(2).exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-01-11 to 2008-02-11 )))))))))))))))))
.
2008-02-10 19:35 . 2008-02-10 19:36 <KANSIO> d-------- C:\Program Files\HijackThis
2008-02-08 15:54 . 2008-02-08 15:54 0 --a------ C:\WINDOWS\Irremote.ini
2008-02-08 13:52 . 2008-02-08 15:51 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-02-07 16:29 . 2008-02-07 16:29 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\teamspeak2
2008-02-07 15:48 . 2008-02-07 15:48 <KANSIO> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-07 15:48 . 2008-02-07 16:01 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-07 15:38 . 2008-02-07 15:38 <KANSIO> d-------- C:\Program Files\MSXML 4.0
2008-02-07 00:15 . 2008-02-07 00:19 <KANSIO> d-------- C:\Program Files\TuneUp Utilities 2008
2008-02-07 00:15 . 2008-02-07 00:15 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\TuneUp Software
2008-02-07 00:15 . 2008-02-07 00:15 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-02-07 00:15 . 2008-02-07 00:18 306,432 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-02-07 00:15 . 2007-12-20 10:41 29,440 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-02-07 00:00 . 2008-02-07 00:00 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-02-06 22:51 . 2008-02-06 23:59 <KANSIO> d-------- C:\Program Files\Adobe
2008-02-06 22:50 . 2008-02-06 22:50 <KANSIO> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-02-06 22:26 . 2008-02-06 22:26 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\Nero
2008-02-06 22:20 . 2008-02-06 22:20 <KANSIO> d-------- C:\Program Files\Nero
2008-02-06 22:20 . 2008-02-08 15:55 <KANSIO> d-------- C:\Program Files\Common Files\Nero
2008-02-06 22:20 . 2008-02-08 15:55 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-02-06 22:09 . 2008-02-06 23:39 <KANSIO> d-------- C:\Program Files\Bonjour
2008-02-06 22:06 . 2006-03-31 12:40 2,388,176 --a------ C:\WINDOWS\system32\d3dx9_30.dll
2008-02-06 22:06 . 2005-12-05 18:09 2,323,664 --a------ C:\WINDOWS\system32\d3dx9_28.dll
2008-02-06 20:23 . 2008-02-06 23:33 <KANSIO> d-------- C:\Program Files\Common Files\Adobe
2008-02-06 19:02 . 2008-02-06 19:02 <KANSIO> d-------- C:\Program Files\AdVantage
2008-02-06 19:01 . 2008-02-06 19:19 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite
2008-02-06 18:44 . 2008-02-06 18:44 <KANSIO> d-------- C:\Program Files\BSplayerPro
2008-02-06 18:44 . 2008-02-06 19:23 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\BSplayer PRO
2008-02-05 15:01 . 2004-09-14 16:12 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-02-04 22:21 . 2008-02-04 22:23 <KANSIO> d-------- C:\Program Files\Winamp
2008-02-04 22:21 . 2008-02-04 22:29 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\Winamp
2008-02-04 00:02 . 2008-02-04 00:02 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-02-04 00:01 . 2008-02-04 00:01 <KANSIO> dr-h----- C:\Documents and Settings\Matti\Application Data\SecuROM
2008-02-04 00:00 . 2008-02-04 00:00 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-02-04 00:00 . 2008-02-04 00:00 22,328 --a------ C:\Documents and Settings\Matti\Application Data\PnkBstrK.sys
2008-02-03 23:51 . 2008-02-04 15:09 <KANSIO> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-03 23:51 . 2008-02-03 23:51 <KANSIO> d-------- C:\Program Files\Electronic Arts
2008-02-03 23:49 . 2008-02-03 23:49 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\DAEMON Tools
2008-02-03 22:07 . 2008-02-03 22:07 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-01-31 23:19 . 2008-02-10 20:03 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\NoNameScript
2008-01-31 17:08 . 2008-01-31 17:09 <KANSIO> d-------- C:\Program Files\NVIDIA nTune Performance Application
2008-01-31 14:39 . 2008-01-31 14:41 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\fretsonfire
2008-01-31 14:38 . 2008-01-31 14:40 <KANSIO> d-------- C:\Program Files\Frets on Fire
2008-01-31 14:07 . 2008-01-02 10:21 17,642,616 --a------ C:\WINDOWS\system32\MRT.exe
2008-01-31 14:02 . 2008-01-31 14:02 <KANSIO> d-------- C:\Program Files\uTorrent
2008-01-31 14:02 . 2008-02-11 07:49 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\uTorrent
2008-01-29 06:42 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-01-29 06:42 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-01-29 06:42 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-01-29 00:29 . 2008-01-29 00:29 268 --ah----- C:\sqmdata00.sqm
2008-01-29 00:29 . 2008-01-29 00:29 244 --ah----- C:\sqmnoopt00.sqm
2008-01-28 22:38 . 2008-01-29 00:29 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\X-Chat 2
2008-01-28 22:35 . 2008-02-10 18:49 <KANSIO> d-------- C:\Program Files\mIRC
2008-01-28 22:30 . 2008-01-31 22:36 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\mIRC
2008-01-28 22:24 . 2008-01-28 22:24 <KANSIO> d-------- C:\WINDOWS\Sun
2008-01-28 22:24 . 2007-09-24 23:31 139,264 --a------ C:\WINDOWS\system32\javaws.exe
2008-01-28 22:24 . 2007-09-24 22:30 135,168 --a------ C:\WINDOWS\system32\javaw.exe
2008-01-28 22:24 . 2007-09-24 22:30 135,168 --a------ C:\WINDOWS\system32\java.exe
2008-01-28 22:24 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-01-28 22:23 . 2008-01-28 22:24 <KANSIO> d-------- C:\Program Files\Java
2008-01-28 22:22 . 2008-01-28 22:22 <KANSIO> d-------- C:\Program Files\Common Files\Java
2008-01-28 15:43 . 2008-01-28 15:44 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\Ventrilo
2008-01-28 13:43 . 2007-07-09 15:11 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-01-28 13:36 . 2008-01-29 00:29 <KANSIO> d-------- C:\Documents and Settings\Matti\Contacts
2008-01-28 13:15 . 2008-01-28 13:35 <KANSIO> d-------- C:\Program Files\Windows Live
2008-01-28 13:15 . 2008-01-28 13:35 <KANSIO> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-28 13:15 . 2008-01-28 13:32 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-01-28 13:05 . 2008-01-28 13:05 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\Logitech
2008-01-28 13:05 . 2008-01-28 13:05 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-01-28 13:04 . 2007-11-15 10:06 301,656 --a------ C:\WINDOWS\system32\BtCoreIf.dll
2008-01-28 13:04 . 2007-11-15 10:07 170,512 --a------ C:\WINDOWS\system32\kemutb.dll
2008-01-28 13:04 . 2007-11-15 10:07 141,840 --a------ C:\WINDOWS\system32\KemUtil.dll
2008-01-28 13:04 . 2007-11-15 10:07 117,264 --a------ C:\WINDOWS\system32\KemWnd.dll
2008-01-28 13:04 . 2007-11-15 10:07 76,304 --a------ C:\WINDOWS\system32\KemXML.dll
2008-01-28 13:04 . 2008-01-28 13:04 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-01-28 13:04 . 2008-01-28 13:04 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-01-28 13:03 . 2008-01-28 13:13 <KANSIO> d-------- C:\Program Files\Logitech
2008-01-28 13:03 . 2008-01-28 13:04 <KANSIO> d-------- C:\Program Files\Common Files\Logishrd
2008-01-28 13:03 . 2008-01-28 13:03 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\InstallShield
2008-01-28 13:03 . 2008-01-28 13:13 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Logitech
2008-01-28 13:02 . 2008-01-29 08:00 <KANSIO> d--h----- C:\WINDOWS\$hf_mig$
2008-01-28 06:56 . 2008-01-28 06:56 <KANSIO> d-------- C:\Program Files\Lavalys
2008-01-28 06:55 . 2008-02-11 18:38 <KANSIO> d-------- C:\Program Files\Steam
2008-01-28 06:55 . 2008-01-28 06:55 <KANSIO> d-------- C:\Program Files\CCleaner
2008-01-28 06:53 . 2008-01-28 06:53 <KANSIO> d-------- C:\Program Files\VentriloMIX
2008-01-28 06:53 . 2008-01-28 06:53 <KANSIO> d-------- C:\Program Files\Ventrilo
2008-01-28 06:53 . 2008-02-07 00:15 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-28 06:53 . 2008-01-28 06:53 <KANSIO> d-------- C:\Fraps
2008-01-28 06:46 . 2008-01-28 06:46 1,158 --a------ C:\WINDOWS\mozver.dat
2008-01-28 06:45 . 2008-02-11 18:38 <KANSIO> d-------- C:\Program Files\Mozilla Firefox
2008-01-28 06:45 . 2008-01-28 06:45 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\Talkback
2008-01-28 06:45 . 2008-01-28 06:45 0 --a------ C:\WINDOWS\nsreg.dat
2008-01-28 06:37 . 2008-02-11 18:36 64,900 --a------ C:\WINDOWS\system32\DVCState-{00000001-00000000-0000000A-00001102-00000005-00311102}.rfx
2008-01-28 06:37 . 2008-02-11 18:36 54,524 --a------ C:\WINDOWS\system32\BMXStateBkp-{00000001-00000000-0000000A-00001102-00000005-00311102}.rfx
2008-01-28 06:37 . 2008-02-11 18:36 54,524 --a------ C:\WINDOWS\system32\BMXState-{00000001-00000000-0000000A-00001102-00000005-00311102}.rfx
2008-01-28 06:37 . 2003-06-12 23:25 7,062 --a------ C:\WINDOWS\system32\audiopid.vxd
2008-01-28 06:37 . 2008-02-11 18:36 1,080 --a------ C:\WINDOWS\system32\settingsbkup.sfm
2008-01-28 06:37 . 2008-02-11 18:36 1,080 --a------ C:\WINDOWS\system32\settings.sfm
2008-01-28 06:36 . 2000-05-22 10:58 647,872 --------- C:\WINDOWS\system32\Mscomct2.ocx
2008-01-28 06:36 . 1999-10-10 19:00 41,984 --------- C:\WINDOWS\Ctregrun.exe
2008-01-28 06:35 . 2000-05-11 01:00 90,112 --------- C:\WINDOWS\Updreg.EXE
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-11 16:37 2,145,386,496 --sha-w C:\pagefile.sys
2008-02-04 20:23 --------- d-----w C:\Program Files\Windows Media Player
2008-02-03 22:00 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-02-03 21:59 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-02-03 21:59 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-01-28 14:42 --------- d-----w C:\Program Files\Outlook Express
2008-01-28 14:42 --------- d-----w C:\Program Files\Common Files\System
2008-01-28 14:39 --------- d-----w C:\Program Files\Internet Explorer
2008-01-28 04:34 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-01-28 04:34 409,600 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-01-28 03:52 8,972 ----a-w C:\WINDOWS\PCHEALTH\HELPCTR\Config\Cntstore.bin
2008-01-28 03:51 --------- d-----w C:\Program Files\NetMeeting
2008-01-28 03:50 47,564 --sha-r C:\NTDETECT.COM
2008-01-28 01:11 0 --sha-r C:\MSDOS.SYS
2008-01-28 01:11 0 --sha-r C:\IO.SYS
2008-01-28 01:11 0 ----a-w C:\CONFIG.SYS
2008-01-28 01:11 0 ----a-w C:\AUTOEXEC.BAT
2008-01-28 01:11 --------- d-----w C:\Program Files\xerox
2008-01-28 01:11 --------- d-----w C:\Program Files\microsoft frontpage
2008-01-28 01:09 --------- d-----w C:\Program Files\Common Files\Services
2008-01-28 01:08 --------- d-----w C:\Program Files\MSN
2008-01-28 01:08 --------- d-----w C:\Program Files\ComPlus Applications
2007-12-05 00:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2007-12-04 23:41 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-12-04 23:41 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-12-04 23:41 8,523,776 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-12-04 23:41 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-12-04 23:41 6,901,760 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-12-04 23:41 6,549,504 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-12-04 23:41 5,773,568 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-12-04 23:41 5,611,520 ----a-w C:\WINDOWS\system32\nvdispsr.dll
2007-12-04 23:41 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-12-04 23:41 458,752 ----a-w C:\WINDOWS\system32\nvmccssr.dll
2007-12-04 23:41 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-12-04 23:41 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-12-04 23:41 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-12-04 23:41 385,024 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-12-04 23:41 35,328 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-12-04 23:41 35,328 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-12-04 23:41 335,872 ----a-w C:\WINDOWS\system32\nvwrses.dll
2007-12-04 23:41 335,872 ----a-w C:\WINDOWS\system32\nvwrsel.dll
2007-12-04 23:41 327,680 ----a-w C:\WINDOWS\system32\nvwrsfr.dll
2007-12-04 23:41 327,680 ----a-w C:\WINDOWS\system32\nvwrsesm.dll
2007-12-04 23:41 327,680 ----a-w C:\WINDOWS\system32\nvrshe.dll
2007-12-04 23:41 327,680 ----a-w C:\WINDOWS\system32\nvrsar.dll
2007-12-04 23:41 323,584 ----a-w C:\WINDOWS\system32\nvwrspt.dll
2007-12-04 23:41 323,584 ----a-w C:\WINDOWS\system32\nvwrsit.dll
2007-12-04 23:41 319,488 ----a-w C:\WINDOWS\system32\nvwrsptb.dll
2007-12-04 23:41 319,488 ----a-w C:\WINDOWS\system32\nvwrsnl.dll
2007-12-04 23:41 315,392 ----a-w C:\WINDOWS\system32\nvwrsru.dll
2007-12-04 23:41 315,392 ----a-w C:\WINDOWS\system32\nvwrshu.dll
2007-12-04 23:41 311,296 ----a-w C:\WINDOWS\system32\nvwrsde.dll
2007-12-04 23:41 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-12-04 23:41 303,104 ----a-w C:\WINDOWS\system32\nvwrstr.dll
2007-12-04 23:41 303,104 ----a-w C:\WINDOWS\system32\nvwrssl.dll
2007-12-04 23:41 303,104 ----a-w C:\WINDOWS\system32\nvwrsfi.dll
2007-12-04 23:41 3,715,072 ----a-w C:\WINDOWS\system32\nvvitvsr.dll
2007-12-04 23:41 3,710,976 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-12-04 23:41 3,420,160 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-12-04 23:41 3,334,144 ----a-w C:\WINDOWS\system32\nvgamesr.dll
2007-12-04 23:41 299,008 ----a-w C:\WINDOWS\system32\nvwrssk.dll
2007-12-04 23:41 299,008 ----a-w C:\WINDOWS\system32\nvwrsno.dll
2007-12-04 23:41 294,912 ----a-w C:\WINDOWS\system32\nvwrssv.dll
2007-12-04 23:41 294,912 ----a-w C:\WINDOWS\system32\nvwrspl.dll
2007-12-04 23:41 294,912 ----a-w C:\WINDOWS\system32\nvwrsda.dll
2007-12-04 23:41 290,816 ----a-w C:\WINDOWS\system32\nvwrsth.dll
2007-12-04 23:41 286,720 ----a-w C:\WINDOWS\system32\nvwrseng.dll
2007-12-04 23:41 286,720 ----a-w C:\WINDOWS\system32\nvwrscs.dll
2007-12-04 23:41 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-12-04 23:41 282,624 ----a-w C:\WINDOWS\system32\nvwrsar.dll
2007-12-04 23:41 282,624 ----a-w C:\WINDOWS\system32\nvrsfr.dll
2007-12-04 23:41 282,624 ----a-w C:\WINDOWS\system32\nvrses.dll
2007-12-04 23:41 282,624 ----a-w C:\WINDOWS\system32\nvrsel.dll
2007-12-04 23:41 278,528 ----a-w C:\WINDOWS\system32\nvwrshe.dll
2007-12-04 23:41 278,528 ----a-w C:\WINDOWS\system32\nvrsit.dll
2007-12-04 23:41 278,528 ----a-w C:\WINDOWS\system32\nvrsde.dll
2007-12-04 23:41 274,432 ----a-w C:\WINDOWS\system32\nvrspt.dll
2007-12-04 23:41 274,432 ----a-w C:\WINDOWS\system32\nvrsnl.dll
2007-12-04 23:41 274,432 ----a-w C:\WINDOWS\system32\nvrsesm.dll
2007-12-04 23:41 270,336 ----a-w C:\WINDOWS\system32\nvrsru.dll
2007-12-04 23:41 266,240 ----a-w C:\WINDOWS\system32\nvrsptb.dll
2007-12-04 23:41 266,240 ----a-w C:\WINDOWS\system32\nvrsja.dll
2007-12-04 23:41 258,048 ----a-w C:\WINDOWS\system32\nvrstr.dll
2007-12-04 23:41 258,048 ----a-w C:\WINDOWS\system32\nvrssl.dll
2007-12-04 23:41 258,048 ----a-w C:\WINDOWS\system32\nvrssk.dll
2007-12-04 23:41 258,048 ----a-w C:\WINDOWS\system32\nvrsko.dll
2007-12-04 23:41 258,048 ----a-w C:\WINDOWS\system32\nvrshu.dll
2007-12-04 23:41 253,952 ----a-w C:\WINDOWS\system32\nvrsth.dll
2007-12-04 23:41 253,952 ----a-w C:\WINDOWS\system32\nvrssv.dll
2007-12-04 23:41 253,952 ----a-w C:\WINDOWS\system32\nvrspl.dll
2007-12-04 23:41 253,952 ----a-w C:\WINDOWS\system32\nvrsno.dll
2007-12-04 23:41 253,952 ----a-w C:\WINDOWS\system32\nvrsda.dll
2007-12-04 23:41 249,856 ----a-w C:\WINDOWS\system32\nvrsfi.dll
2007-12-04 23:41 249,856 ----a-w C:\WINDOWS\system32\nvrscs.dll
2007-12-04 23:41 245,760 ----a-w C:\WINDOWS\system32\nvrseng.dll
2007-12-04 23:41 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll
2007-12-04 23:41 225,280 ----a-w C:\WINDOWS\system32\nvrszhc.dll
2007-12-04 23:41 212,992 ----a-w C:\WINDOWS\system32\nvwrsja.dll
2007-12-04 23:41 2,854,912 ----a-w C:\WINDOWS\system32\nvmoblsr.dll
2007-12-04 23:41 2,519,040 ----a-w C:\WINDOWS\system32\nvwssr.dll
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 19:25 81920]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.exe" [2007-05-25 15:12 183208]
"F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 15:11 740208]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
"VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-07-13 14:11 122880]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 18:07 49152]
"CTHelper"="CTHELPER.EXE" [2006-05-24 06:20 17920 C:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-05-24 06:20 18944 C:\WINDOWS\system32\CTXFIHLP.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 03:10 55824 C:\WINDOWS\KHALMNPR.Exe]
"Launch LCDMon"="C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-12-13 17:43 2051096]
"Launch LGDCore"="C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-12-13 17:57 2095640]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-14 16:12 15360]
C:\Documents and Settings\All Users\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-01-28 13:03:58 784912]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll 2007-11-15 10:10 72208 c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
--a------ 2008-01-28 06:55 1266936 C:\Program Files\Steam\Steam.exe
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-01-28 06:19]
R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2007-05-25 15:12]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-09-14 16:12]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 15:08]
R3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2006-05-24 05:40]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-02-07 00:18]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 15:09]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 15:09]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-02-08 15:17:11 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-11 18:47:02
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
|
|
Hujo
Suspended permanently
|
11. helmikuuta 2008 @ 19:09 |
Linkki tähän viestiin
|
Lataa VundoFix.exe työpöydällesi.
Tupla-klikkaa VundoFix.exe ajaaksesi sen.
Klikkaa Scan for Vundo valintaa.
Kun skannaus on valmis, klikkaa Remove Vundo valintaa.
Sinulta kysytään haluatko poistaa filut - klikkaa YES.
Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.
Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.
=================
Tarkista koneesi F-Securen online skannerilla
http://support.f-secure.fi/fin/home/ols.shtml
Huom, skanneri toimii vain Internet Explorer selaimella
* Lue sivun ohjeet huolella läpi
* Klikkaa Start scanning
* Mikäli saat Internet Explorer -suojausvaroituksen, klikkaa Asenna
* Klikkaa Accept
* Klikkaa Custom Scan
* Säädä asetukset seuraavasti
o "Virus Scan Option" kohdasta valitse Scan whole system
o "Other Scan Option" kohdasta valitse Scan All Files
o Valitse Scan whole system for rootkits
o Valitse Scan whole system for spyware
o Laita ruksi kohtaan Scan inside archives
o Varmista että Use advanced heuristics on valittuna
* Klikkaa Start
* Skannaus käynnistyy kun tarvittavat tiedostot/päivitykset on ladattu
* Odota kärsivällisesti
* Kun sakannaus on suoritettu, klikkaa Automatic cleaning
* Klikkaa Show Report
* Raportti aukeaa selaimessa, kopioi teksti kokonaan
* Liitä kopioitu teksti esim. muistioon tai Wordiin ja tallenna työpöydälle
* Voit sulkea skannerin
* Lähetä raportti viestiketjuusi
anna toimia rauhassa jos hiplaa aiheuttaa koneen jumiutumisen
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 11. helmikuuta 2008 @ 19:28
|
|
norsuu
Suspended due to non-functional email address
|
11. helmikuuta 2008 @ 20:10 |
Linkki tähän viestiin
|
Vundofix ei löytänyt mitään, ja mulla on itellä f-secure 2008. tarkistin koneen eilen sillä ja se ei löytänyt mitään.
|
|
Mainos
|
|
|
|
Hujo
Suspended permanently
|
11. helmikuuta 2008 @ 20:15 |
Linkki tähän viestiin
|
lataa startuplite
tallena tiedosto työpöydälle. Tuplalikkaa StartUpLitenn.exe:ä
sitten voi valita mitä jätät käynnistyviin ja paina sitten continue.
===========
Lataa: RegSeeker.zip työpöydälle:
Pura zip C:\RegSeeker\ kansioon. Sieltä käynnistät RegSeeker.exe ohjelman.
Oikeasa yläkulmassa on Languages.... linkki, josta valitset Suomenkielen.
Vasemmasta alakulmasta ruksit Luo vrmuuskopio ja sitten linkki Puhdista rekisteri
Ruksit kaikkiin muihin kohtiin paitsi "Käyttökelvottomat.." sitten "OK" (odotat hetken).
Ruutuun ilmestyy lista epäkelvoista rekisterimerkinnöistä, jotka alapalkista Valitse kohdasta
klikkaat Valitse kaikki jolloin valitut saavat keltaisen pohjavärin.
Alapalkin Toiminnot linkistä klikkaat Poista valitut kohteet
Ponnahdusikkunaan "Kaikki valitut kohteet poistetaan ? vastaat "OK".
Seuraavaan Ponnahdusikkunaan "Varmuuskopiot" vastaat "OK".
Klikaa vasemmalta Lopeta RegSeeker ja käynnistä koneesi uudelleen.
==============
Lataa OTMoveIt
OTMoveIt ja tallenna se työpöydällesi.
Tuplaklikkaa OTMoveIt.exe.
Klikkaa CleanUp!.
Valitse Yes kun kysytään "Begin cleanup Process?".
Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse.
HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.
Voiko tietsikka koskaan toimia?
|
|
