|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
HJT-logi, vielä jotain vikana?
|
|
|
Randati
Newbie
|
21. maaliskuuta 2008 @ 17:57 |
Linkki tähän viestiin
|
Muun muassa Vundo on konetta vaivannut ja monia tarkistuksia ajettu. Onkohan tässä vielä jotain vikana?
Lainaus:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:53:14, on 21.3.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Razer\Habu\razerhid.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\Program Files\Mindjet\MindManager 6\MMReminderService.exe
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Razer\Habu\razerofa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe
C:\Program Files\Solways Task Scheduler\tasksched.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {6D2493C0-3712-4688-A201-B29D6F5F54A4} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: CmjBrowserHelperObject Object - {AC41D38F-B56D-40AD-94E0-B493D130C959} - C:\Program Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Habu] C:\Program Files\Razer\Habu\razerhid.exe
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [MMReminderService] C:\Program Files\Mindjet\MindManager 6\MMReminderService.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe"
O4 - HKCU\..\Run: [Solway's Task Scheduler] C:\Program Files\Solways Task Scheduler\tasksched.exe
O4 - Startup: A-Link ADSL Diagnostic Tools.LNK = ?
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: Send to Mindjet MindManager - {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - C:\Program Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O21 - SSODL: SrvMon - {8c9dda9e-4940-4638-940d-79c5876c45fb} - C:\WINDOWS\Installer\{8c9dda9e-4940-4638-940d-79c5876c45fb}\SrvMon.dll (file missing)
O21 - SSODL: zip - {123d4b36-2aa9-414f-ae86-34236fa82b33} - C:\WINDOWS\Installer\{123d4b36-2aa9-414f-ae86-34236fa82b33}\zip.dll (file missing)
O21 - SSODL: ServiceSys - {ced6196e-50c9-4159-93ae-a3146e93439e} - C:\WINDOWS\Installer\{ced6196e-50c9-4159-93ae-a3146e93439e}\ServiceSys.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\ISO Recorder\ImapiHelper.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
--
End of file - 9104 bytes
|
|
Hujo
Suspended permanently
|
21. maaliskuuta 2008 @ 18:12 |
Linkki tähän viestiin
|
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
========
Lataa TÄSTÄ VundoFix.exe työpöydällesi.
Tupla-klikkaa VundoFix.exe ajaaksesi sen.
Klikkaa Scan for Vundo valintaa.
Kun skannaus on valmis, klikkaa Remove Vundo valintaa.
Sinulta kysytään haluatko poistaa filut - klikkaa YES.
Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.
Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.
=========
Lataa SmitfraudFix (c) S!Ri
Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:
Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita ponnahtava rapport ? muistion sisältö viestiketjuusi.
Löytyy myös C:\rapport.txt
Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat
(AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja.
A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä,
silloin ne saattavat varoittaa käyttäjää.
=============
Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.
Käynnistä koneesi vikasietotilaan:
sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä
Jossakin koneissa hakataan F8:sin sijasta F5:tä
" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 21. maaliskuuta 2008 @ 18:24
|
|
Randati
Newbie
|
21. maaliskuuta 2008 @ 19:02 |
Linkki tähän viestiin
|
Kaikki paitsi SDFixin olin jo ajanut, mutta ajoin silti uudestaan. Tässä ne nyt ovat.
ComboFix
Lainaus:
ComboFix 08-03-20.5 - eki 2008-03-21 18:13:46.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.180 [GMT 2:00]
Running from: C:\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-02-21 to 2008-03-21 )))))))))))))))))))))))))))))))
.
2008-03-21 17:22 . 2008-03-21 17:22 <DIR> d-------- C:\Program Files\CCleaner
2008-03-21 17:07 . 2008-03-21 17:07 1,599,082 --a------ C:\ComboFix.exe
2008-03-21 16:39 . 2008-03-21 16:39 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-21 16:24 . 2008-03-21 16:24 <DIR> d-------- C:\VundoFix Backups
2008-03-21 01:21 . 2008-03-21 01:21 <DIR> d-------- C:\Program Files\Safari
2008-03-19 17:07 . 2008-03-19 17:07 <DIR> d-------- C:\Mp3 Output
2008-03-19 17:07 . 2007-03-01 04:18 4,762,112 --a------ C:\WINDOWS\system32\NCMedia.dll
2008-03-19 17:07 . 2007-02-25 15:36 383,238 --a------ C:\WINDOWS\system32\libmp3lame-0.dll
2008-03-17 13:24 . 2008-03-21 01:22 <DIR> d-------- C:\Documents and Settings\Antti\Application Data\Apple Computer
2008-03-16 01:31 . 2008-03-16 01:32 <DIR> d-------- C:\Documents and Settings\eki\Application Data\Notepad++
2008-03-15 19:17 . 2008-03-15 19:17 <DIR> d-------- C:\Documents and Settings\eki\DoctorWeb
2008-03-14 23:47 . 2008-03-14 23:47 <DIR> d-------- C:\Documents and Settings\Antti\.thumbnails
2008-03-14 22:44 . 2008-03-20 18:29 <DIR> d-------- C:\Documents and Settings\Antti\Application Data\gtk-2.0
2008-03-14 22:28 . 2008-03-20 18:58 <DIR> d-------- C:\Documents and Settings\Antti\.gimp-2.4
2008-03-12 19:22 . 2008-03-15 19:24 1,330,945 ---hs---- C:\WINDOWS\system32\uhvqppna.ini
2008-03-12 15:31 . 2008-03-12 15:40 <DIR> d-------- C:\Documents and Settings\Antti\Contacts
2008-03-11 19:21 . 2008-03-12 19:22 1,302,582 ---hs---- C:\WINDOWS\system32\oqoluwhk.ini
2008-03-11 16:14 . 2008-03-11 16:16 25 --a------ C:\Documents and Settings\Antti\PP.bat
2008-03-10 19:16 . 2008-03-11 18:57 1,412,828 ---hs---- C:\WINDOWS\system32\sjpynmcb.ini
2008-03-10 16:44 . 2008-03-10 16:44 <DIR> d-------- C:\Documents and Settings\Antti\Application Data\F-Secure
2008-03-09 19:13 . 2008-03-10 19:14 1,318,163 ---hs---- C:\WINDOWS\system32\kypwrpjx.ini
2008-03-08 19:15 . 2008-03-09 18:07 1,307,861 ---hs---- C:\WINDOWS\system32\ustmagdj.ini
2008-03-08 18:57 . 2008-03-08 20:22 <DIR> d-------- C:\Documents and Settings\Antti\Application Data\Notepad++
2008-03-08 18:41 . 2008-03-20 22:57 <DIR> d-------- C:\Documents and Settings\Antti\Application Data\codeblocks
2008-03-08 17:33 . 2008-03-08 17:33 <DIR> d-------- C:\Documents and Settings\Antti\Application Data\mIRC
2008-03-08 17:26 . 2008-03-08 17:26 <DIR> d-------- C:\Documents and Settings\Antti\Application Data\ATI
2008-03-06 22:57 . 2008-03-06 22:57 268 --ah----- C:\sqmdata00.sqm
2008-03-06 22:57 . 2008-03-06 22:57 244 --ah----- C:\sqmnoopt00.sqm
2008-03-06 19:11 . 2008-03-08 00:31 1,308,641 ---hs---- C:\WINDOWS\system32\ogmyhiwx.ini
2008-03-06 17:42 . 2008-03-06 19:10 1,307,337 ---hs---- C:\WINDOWS\system32\ysiworix.ini
2008-03-06 15:59 . 2008-03-06 17:41 1,307,037 ---hs---- C:\WINDOWS\system32\xnhjqjtg.ini
2008-03-05 15:54 . 2008-03-05 21:43 1,307,854 ---hs---- C:\WINDOWS\system32\dxovmrlm.ini
2008-03-04 17:35 . 2008-03-04 17:42 1,301,952 ---hs---- C:\WINDOWS\system32\kxbelcud.ini
2008-03-04 16:27 . 2008-03-04 17:24 1,301,652 ---hs---- C:\WINDOWS\system32\lcuwvurh.ini
2008-03-02 21:42 . 2008-03-03 21:43 1,368,677 ---hs---- C:\WINDOWS\system32\caqqwrhh.ini
2008-02-29 21:39 . 2008-03-01 18:19 2,495,344 ---hs---- C:\WINDOWS\system32\qgmxrlui.ini
2008-02-28 21:42 . 2008-02-29 15:14 2,433,703 ---hs---- C:\WINDOWS\system32\mfurdulj.ini
2008-02-28 21:35 . 2008-02-28 21:42 0 --a------ C:\WINDOWS\system32\tmpjclgs.tmp
2008-02-27 21:42 . 2008-02-28 21:35 2,336,147 ---hs---- C:\WINDOWS\system32\tmpjclgs.ini
2008-02-26 21:35 . 2008-02-26 21:35 2,252,629 ---hs---- C:\WINDOWS\system32\trlscypk.tmp
2008-02-26 21:34 . 2008-02-26 21:34 2,252,629 ---hs---- C:\WINDOWS\system32\trlscypk.ini
2008-02-26 21:22 . 2008-02-26 21:34 2,252,629 ---hs---- C:\WINDOWS\system32\dadtdqdl.ini
2008-02-26 17:32 . 2008-02-26 17:32 <DIR> d-------- C:\Program Files\iPod
2008-02-25 21:30 . 2008-02-26 21:22 2,266,106 ---hs---- C:\WINDOWS\system32\yybufabp.ini
2008-02-25 17:41 . 2008-02-25 17:41 <DIR> d-------- C:\Program Files\DivX
2008-02-25 15:57 . 2004-08-04 00:56 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-02-25 15:57 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-02-25 15:57 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
2008-02-25 15:57 . 2001-08-17 22:36 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-02-24 21:29 . 2008-02-25 21:00 2,154,090 ---hs---- C:\WINDOWS\system32\xlcswsxq.ini
2008-02-23 20:49 . 2008-02-24 21:29 2,159,249 ---hs---- C:\WINDOWS\system32\nttkgvps.ini
2008-02-23 20:32 . 2008-02-23 20:32 <DIR> d-------- C:\Documents and Settings\eki\Application Data\ATI
2008-02-23 20:28 . 2006-05-03 11:57 520,192 --------- C:\WINDOWS\system32\ati2sgag.exe
2008-02-23 20:27 . 2008-02-23 20:29 <DIR> d-------- C:\Program Files\ATI Technologies
2008-02-23 20:26 . 2008-02-23 20:27 <DIR> d-------- C:\Program Files\ATI
2008-02-23 16:42 . 2008-02-23 20:48 2,202,049 ---hs---- C:\WINDOWS\system32\qljmrcup.ini
2008-02-22 16:47 . 2008-02-22 16:47 4,096 --a------ C:\WINDOWS\d3dx.dat
2008-02-22 16:39 . 2008-02-23 15:20 2,277,060 ---hs---- C:\WINDOWS\system32\lghfbrqy.ini
2008-02-22 15:41 . 2008-02-22 16:38 2,185,757 ---hs---- C:\WINDOWS\system32\rqhyecty.ini
2008-02-22 00:47 . 2008-03-21 17:15 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-22 00:47 . 2008-02-22 00:47 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-22 00:45 . 2008-02-22 00:45 <DIR> d-------- C:\Program Files\QuickTime
2008-02-21 04:05 . 2008-02-21 04:05 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2008-02-21 04:05 . 2008-02-21 04:05 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-21 15:05 3,282 ----a-w C:\WINDOWS\system32\tmp.reg
2008-03-18 13:06 --------- d-----w C:\Program Files\F-Secure Internet Security
2008-03-17 16:16 51,072 ----a-w C:\WINDOWS\system32\drivers\fsdfw.sys
2008-03-17 16:16 30,016 ----a-w C:\WINDOWS\system32\drivers\fsndis5.sys
2008-03-15 15:16 82,432 ----a-w C:\WINDOWS\system32\IEDFix.exe
2008-03-14 07:09 86,528 ----a-w C:\WINDOWS\system32\VACFix.exe
2008-03-08 14:42 --------- d-----w C:\Program Files\Paint.NET
2008-03-08 14:21 --------- d-----w C:\Program Files\Java
2008-03-06 14:44 413,696 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-03-06 14:44 110,592 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-02-26 19:55 --------- d-----w C:\Documents and Settings\eki\Application Data\OpenOffice.org2
2008-02-26 15:32 --------- d-----w C:\Program Files\iTunes
2008-02-23 18:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-23 18:28 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-02-20 13:34 6,208 ----a-w C:\WINDOWS\system32\jfbhaivx.dll
2008-02-20 13:13 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-20 10:35 --------- d-----w C:\Documents and Settings\eki\Application Data\Subversion
2008-02-18 11:08 --------- d-----w C:\Program Files\totalcmd
2008-02-17 10:38 --------- d-----w C:\Program Files\FreeMind
2008-02-17 10:18 --------- d-----w C:\Program Files\Mindjet
2008-02-15 20:02 91,712 ----a-w C:\WINDOWS\system32\ssgndqyb.dll
2008-02-15 17:28 --------- d-----w C:\Documents and Settings\eki\Application Data\F-Secure
2008-02-15 17:21 91,712 ----a-w C:\WINDOWS\system32\wshbufae.dll
2008-02-15 17:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\F-Secure
2008-02-15 17:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\fssg
2008-02-12 19:24 --------- d-----w C:\Program Files\Solways Task Scheduler
2008-02-12 19:24 --------- d-----w C:\Documents and Settings\eki\Application Data\SolwaySoftware
2008-02-12 19:04 30 ----a-w C:\del_pos_tmp.bat
2008-02-11 19:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-02-11 19:08 74 ---ha-w C:\aaw7boot.cmd
2008-02-11 18:35 --------- d-----w C:\Documents and Settings\eki\Application Data\EasySpywareCleaner.com
2008-02-11 18:00 --------- d-----w C:\Program Files\MSXML 4.0
2008-02-11 17:52 --------- d-----w C:\Program Files\SysCleaner
2008-02-10 16:05 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-02-10 10:25 --------- d-----w C:\Program Files\Tracker Software
2008-02-10 10:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Mindjet
2008-02-10 09:52 --------- d-----w C:\Documents and Settings\eki\Application Data\Panasonic
2008-02-09 18:23 --------- d-----w C:\Program Files\Crimson Editor
2008-02-09 18:19 --------- d-----w C:\Documents and Settings\eki\Application Data\PSpad
2008-02-09 18:18 --------- d-----w C:\Program Files\PSPad editor
2008-02-09 15:18 --------- d-----w C:\Program Files\AviSynth 2.5
2008-02-08 22:00 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-02-08 18:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\NCH Software
2008-02-08 18:33 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-01 18:07 --------- d-----w C:\Documents and Settings\eki\Application Data\OD2
2008-01-29 16:13 --------- d-----w C:\Program Files\Sibelius Software
2008-01-29 15:40 --------- d-----w C:\Program Files\OpenAL
2008-01-26 17:32 --------- d-----w C:\Program Files\Reference Assemblies
2008-01-26 17:32 --------- d-----w C:\Program Files\MSBuild
2008-01-26 17:28 --------- d-----w C:\Program Files\MSXML 6.0
2008-01-14 12:52 81,920 ----a-w C:\WINDOWS\system32\frapsvid.dll
2008-01-10 17:44 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2008-01-01 12:48 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2007-12-30 14:09 321,536 ----a-w C:\WINDOWS\system32\SDL.dll
2007-12-28 21:43 21,840 ----a-w C:\WINDOWS\system32\SIntfNT.dll
2007-12-28 21:43 17,212 ----a-w C:\WINDOWS\system32\SIntf32.dll
2007-12-28 21:43 12,067 ----a-w C:\WINDOWS\system32\SIntf16.dll
2007-12-26 08:35 166,485 ----a-w C:\WINDOWS\Video Cleaner Uninstaller.exe
2007-12-24 11:49 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D2493C0-3712-4688-A201-B29D6F5F54A4}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:56 15360]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 18:23 102400]
"pdfSaver3"="C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe" [2004-09-05 17:20 380928]
"Solway's Task Scheduler"="C:\Program Files\Solways Task Scheduler\tasksched.exe" [2007-12-10 06:19 59904]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 19:06 88363 C:\WINDOWS\AGRSMMSG.exe]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 23:47 57344 C:\WINDOWS\ALCXMNTR.EXE]
"Habu"="C:\Program Files\Razer\Habu\razerhid.exe" [2007-05-11 11:58 176128]
"EPSON Stylus CX3600 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.exe" [2004-03-04 05:00 98304]
"MMReminderService"="C:\Program Files\Mindjet\MindManager 6\MMReminderService.exe" [2006-12-14 00:16 31232]
"pdfSaver3"="" []
"F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.exe" [2007-05-25 15:12 183208]
"F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 15:11 740208]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 16:41 45056]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
LUMIX Simple Viewer.lnk - C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2008-01-01 18:43:12 57344]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 12:01:04 83360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"SrvMon"= {8c9dda9e-4940-4638-940d-79c5876c45fb} - C:\WINDOWS\Installer\{8c9dda9e-4940-4638-940d-79c5876c45fb}\SrvMon.dll [ ]
"zip"= {123d4b36-2aa9-414f-ae86-34236fa82b33} - C:\WINDOWS\Installer\{123d4b36-2aa9-414f-ae86-34236fa82b33}\zip.dll [ ]
"ServiceSys"= {ced6196e-50c9-4159-93ae-a3146e93439e} - C:\WINDOWS\Installer\{ced6196e-50c9-4159-93ae-a3146e93439e}\ServiceSys.dll [ ]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, wowfx.dll, xlibgfl254.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^A-Link ADSL Diagnostic Tools.LNK]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\A-Link ADSL Diagnostic Tools.LNK
backup=C:\WINDOWS\pss\A-Link ADSL Diagnostic Tools.LNKCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Documents and Settings\\Antti\\My Documents\\Ohjelmat\\mIRC\\mirc.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-03-17 18:16]
R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2008-02-15 19:36]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 15:08]
R3 HabuFltr;Habu Mouse;C:\WINDOWS\system32\drivers\habu.sys [2006-10-23 12:09]
S3 uisp;Freescale USB JW32 driver;C:\WINDOWS\system32\Drivers\usbicp.sys [2005-12-21 11:23]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 15:09]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 15:09]
.
Contents of the 'Scheduled Tasks' folder
"2008-03-20 21:27:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-08 14:30:40 C:\WINDOWS\Tasks\del_pos_tmp.job"
- C:\del_pos_tmp.bat
"2008-03-08 14:30:26 C:\WINDOWS\Tasks\del_pos_tmp2.job"
- C:\del_pos_tmp.bat
"2008-03-21 16:00:00 C:\WINDOWS\Tasks\SysSchedule1.job"
- C:\DOCUME~1\Antti\LOCALS~1\Temp\TMP11B.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-21 18:15:39
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-03-21 18:16:10
ComboFix-quarantined-files.txt 2008-03-21 16:16:02
ComboFix2.txt 2008-03-21 15:19:57
.
2008-03-13 14:11:59 --- E O F ---
VundoFix (Sisältää myös vanhoja tuloksia)
Lainaus:
VundoFix V6.7.8
Checking Java version...
Scan started at 18:18:28 15.2.2008
Listing files found while scanning....
C:\WINDOWS\system32\aqawdfih.dll
C:\WINDOWS\system32\dkkkjotu.dll
C:\WINDOWS\system32\ixcokite.dll
C:\WINDOWS\system32\jkkjjhg.dll
C:\WINDOWS\system32\jurhfjtp.dll
C:\windows\system32\jurhfjtp.dllbox
C:\WINDOWS\system32\opnllkl.dll
C:\WINDOWS\system32\winjjq32.dll
Beginning removal...
Attempting to delete C:\WINDOWS\system32\aqawdfih.dll
C:\WINDOWS\system32\aqawdfih.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\dkkkjotu.dll
C:\WINDOWS\system32\dkkkjotu.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\ixcokite.dll
C:\WINDOWS\system32\ixcokite.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\jkkjjhg.dll
C:\WINDOWS\system32\jkkjjhg.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\jurhfjtp.dll
C:\WINDOWS\system32\jurhfjtp.dll Has been deleted!
Attempting to delete C:\windows\system32\jurhfjtp.dllbox
C:\windows\system32\jurhfjtp.dllbox Has been deleted!
Attempting to delete C:\WINDOWS\system32\opnllkl.dll
C:\WINDOWS\system32\opnllkl.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\winjjq32.dll
C:\WINDOWS\system32\winjjq32.dll Has been deleted!
Performing Repairs to the registry.
Done!
Beginning removal...
Attempting to delete C:\WINDOWS\system32\opnllkl.dll
C:\WINDOWS\system32\opnllkl.dll Could not be deleted.
Performing Repairs to the registry.
Done!
Beginning removal...
VundoFix V6.7.8
Checking Java version...
Scan started at 15:08:12 21.3.2008
Listing files found while scanning....
C:\WINDOWS\system32\aakdcvay.dll
C:\WINDOWS\system32\acbrjqtm.dll
C:\WINDOWS\system32\bmktwcof.ini
C:\WINDOWS\system32\divirqor.dll
C:\WINDOWS\system32\dlhxwcdj.dll
C:\WINDOWS\system32\dqhbvigx.dll
C:\WINDOWS\system32\focwtkmb.dll
C:\WINDOWS\system32\hruvwucl.dll
C:\WINDOWS\system32\jdcwxhld.ini
C:\WINDOWS\system32\mtqjrbca.ini
Beginning removal...
Attempting to delete C:\WINDOWS\system32\aakdcvay.dll
C:\WINDOWS\system32\aakdcvay.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\acbrjqtm.dll
C:\WINDOWS\system32\acbrjqtm.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\bmktwcof.ini
C:\WINDOWS\system32\bmktwcof.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\divirqor.dll
C:\WINDOWS\system32\divirqor.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\dlhxwcdj.dll
C:\WINDOWS\system32\dlhxwcdj.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\dqhbvigx.dll
C:\WINDOWS\system32\dqhbvigx.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\focwtkmb.dll
C:\WINDOWS\system32\focwtkmb.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\hruvwucl.dll
C:\WINDOWS\system32\hruvwucl.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\jdcwxhld.ini
C:\WINDOWS\system32\jdcwxhld.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\mtqjrbca.ini
C:\WINDOWS\system32\mtqjrbca.ini Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V7.0.3
Scan started at 16:24:26 21.3.2008
Listing files found while scanning....
C:\WINDOWS\system32\opnllkl.dll
Beginning removal...
Performing Repairs to the registry.
Done!
VundoFix V7.0.3
Scan started at 18:17:24 21.3.2008
Listing files found while scanning....
No infected files were found.
Beginning removal...
SmitFraudFix
Lainaus:
SmitFraudFix v2.305
Scan done at 18:30:34,96, pe 21.03.2008
Run from C:\Documents and Settings\eki\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Razer\Habu\razerhid.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\Program Files\Mindjet\MindManager 6\MMReminderService.exe
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Razer\Habu\razerofa.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe
C:\Program Files\Solways Task Scheduler\tasksched.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\cmd.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\eki
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\eki\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\eki\FAVORI~1
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"=""
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Rustock
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: VIA Rhine II Fast Ethernet Adapter
DNS Server Search Order: 10.0.0.2
HKLM\SYSTEM\CCS\Services\Tcpip\..\{F2C759B8-7C08-4F25-8E3E-9477F8C59BC8}: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CS1\Services\Tcpip\..\{F2C759B8-7C08-4F25-8E3E-9477F8C59BC8}: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CS3\Services\Tcpip\..\{F2C759B8-7C08-4F25-8E3E-9477F8C59BC8}: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.2
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=10.0.0.2
»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
SDFix
Lainaus:
SDFix: Version 1.159
Run by eki on pe 21.03.2008 at 18:41
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\DOCUME~1\eki\Desktop\SDFix
Checking Services :
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Resetting SecurityProviders Value
Resetting AppInit_DLLs value
Rebooting
Checking Files :
Trojan Files Found:
C:\WINDOWS\system32\wowfx.dll - Deleted
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-21 18:48:27
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000053
"TracesSuccessful"=dword:0000001c
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Documents and Settings\\Antti\\My Documents\\Ohjelmat\\mIRC\\mirc.exe"="C:\\Documents and Settings\\Antti\\My Documents\\Ohjelmat\\mIRC\\mirc.exe:*:Enabled:mIRC"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Documents and Settings\\eki\\Application Data\\mcrupdate.exe"="C:\\Documents and Settings\\eki\\Application Data\\mcrupdate.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\Documents and Settings\\Antti\\Application Data\\mcrupdate.exe"="C:\\Documents and Settings\\Antti\\Application Data\\mcrupdate.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\Documents and Settings\\Antti\\Application Data\\sysdefender.exe"="C:\\Documents and Settings\\Antti\\Application Data\\sysdefender.exe:*:Enabled:@xpsp2res.dll,-22019"
Remaining Files :
File Backups: - C:\DOCUME~1\eki\Desktop\SDFix\backups\backups.zip
Files with Hidden Attributes :
Thu 6 Dec 2007 625,664 ..SH. --- "C:\Program Files\Internet Explorer\iexplore.exe"
Wed 13 Oct 2004 1,694,208 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe"
Wed 4 Aug 2004 60,416 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe"
Wed 4 Aug 2004 4,639 A.SH. --- "C:\Program Files\Windows Media Player\mplayer2.exe"
Wed 18 Oct 2006 64,000 A.SH. --- "C:\Program Files\Windows Media Player\wmplayer.exe"
Tue 26 Feb 2008 2,252,629 ..SH. --- "C:\WINDOWS\system32\trlscypk.tmp"
Fri 12 Jan 2007 89,088 A..H. --- "C:\RECYCLER\S-1-5-21-3521587415-610904634-287714899-1010\De11\~WRL0636.tmp"
Fri 8 Feb 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Wed 26 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c87932aedce288373d0b6a6c23f00c8a\download\BIT67.tmp"
Wed 26 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fa49f6893c7a59670b5a3784bf50f6b9\download\BIT80.tmp"
Finished!
HijackThis
Lainaus:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:55:03, on 21.3.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\WINDOWS\System32\snmp.exe
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Razer\Habu\razerhid.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE
C:\Program Files\Mindjet\MindManager 6\MMReminderService.exe
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Razer\Habu\razerofa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe
C:\Program Files\Solways Task Scheduler\tasksched.exe
C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {6D2493C0-3712-4688-A201-B29D6F5F54A4} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: CmjBrowserHelperObject Object - {AC41D38F-B56D-40AD-94E0-B493D130C959} - C:\Program Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [Habu] C:\Program Files\Razer\Habu\razerhid.exe
O4 - HKLM\..\Run: [EPSON Stylus CX3600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9BE.EXE /P26 "EPSON Stylus CX3600 Series" /O6 "USB001" /M "Stylus CX3600"
O4 - HKLM\..\Run: [MMReminderService] C:\Program Files\Mindjet\MindManager 6\MMReminderService.exe
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [pdfSaver3] "C:\Program Files\Tracker Software\PDF-XChange 3\pdfSaver\pdfSaver3.exe"
O4 - HKCU\..\Run: [Solway's Task Scheduler] C:\Program Files\Solways Task Scheduler\tasksched.exe
O4 - Startup: A-Link ADSL Diagnostic Tools.LNK = ?
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: Send to Mindjet MindManager - {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - C:\Program Files\Mindjet\MindManager 6\Mm6InternetExplorer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O21 - SSODL: SrvMon - {8c9dda9e-4940-4638-940d-79c5876c45fb} - C:\WINDOWS\Installer\{8c9dda9e-4940-4638-940d-79c5876c45fb}\SrvMon.dll (file missing)
O21 - SSODL: zip - {123d4b36-2aa9-414f-ae86-34236fa82b33} - C:\WINDOWS\Installer\{123d4b36-2aa9-414f-ae86-34236fa82b33}\zip.dll (file missing)
O21 - SSODL: ServiceSys - {ced6196e-50c9-4159-93ae-a3146e93439e} - C:\WINDOWS\Installer\{ced6196e-50c9-4159-93ae-a3146e93439e}\ServiceSys.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\ISO Recorder\ImapiHelper.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
--
End of file - 9222 bytes
Vikasietotilassa oli myös käyttäjä Adminstrator, jota ei tavallisesti ole. Kuuluuko sen olla siellä?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 21. maaliskuuta 2008 @ 19:06
|
|
Hujo
Suspended permanently
|
21. maaliskuuta 2008 @ 19:11 |
Linkki tähän viestiin
|
sitten
scannaa hjt:llä merkkaa paina Fix checked
O2 - BHO: (no name) - {6D2493C0-3712-4688-A201-B29D6F5F54A4} - (no file)
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O21 - SSODL: SrvMon - {8c9dda9e-4940-4638-940d-79c5876c45fb} - C:\WINDOWS\Installer\{8c9dda9e-4940-4638-940d-79c5876c45fb}\SrvMon.dll (file missing)
O21 - SSODL: zip - {123d4b36-2aa9-414f-ae86-34236fa82b33} - C:\WINDOWS\Installer\{123d4b36-2aa9-414f-ae86-34236fa82b33}\zip.dll (file missing)
O21 - SSODL: ServiceSys - {ced6196e-50c9-4159-93ae-a3146e93439e} - C:\WINDOWS\Installer\{ced6196e-50c9-4159-93ae-a3146e93439e}\ServiceSys.dll (file missing)
==============
sitten ajetaan vielä
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.
Voiko tietsikka koskaan toimia?
|
|
Randati
Newbie
|
21. maaliskuuta 2008 @ 19:42 |
Linkki tähän viestiin
|
Näin:
Lainaus:
Malwarebytes' Anti-Malware 1.09
Database version: 518
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 135837
Time elapsed: 20 minute(s), 31 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 35
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 13
Files Infected: 5
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{07a25120-a92b-4baa-a514-eed6667d6d83} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{15e0b9d1-6869-4b44-b64d-f60a350e725c} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1b01b4f2-4cc1-4154-ab18-20a0bc553d24} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1bc793ee-2447-4034-858a-de65d6d2bec9} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1f5cf3c9-f384-4bce-b9a1-c5a00c6f2872} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{26ab4ac4-23d3-4004-b9d8-bff54166503c} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{36d8eec8-86fe-41ab-917d-b1db221347fc} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4689349f-0b3a-4698-a404-2e81c9b05acc} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4f3145e3-67de-4654-9eaf-d72133fe65e7} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{59da55f2-d42c-492e-8cee-897717d47877} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6fe6d492-28b1-4a8d-88e9-22e1e3530da0} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{8c4e45a4-fdbc-4de0-8d1f-4ec38d4f3023} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{8ed41818-1cb1-4d9e-8a21-4f7edf9b59c3} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{957de9d3-6ca7-4e7e-aa1d-3d13eb7cf99b} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{ad33aad5-f364-430f-8e2d-ce034150afdf} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{ae539347-f840-4c45-83d2-6e9225a3ec62} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{c7eb7da1-0b05-40d5-b73a-4b5ea77e7d67} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cb32d487-2bdb-49ed-8b75-8ebfe6b0990b} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cc789624-c0d2-469b-a34b-fc32117194e9} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cda873d3-a380-4b32-b4b7-a25d2e63cdba} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e2e7d7e7-ea40-4cc3-89fb-fc6c43c8ca77} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e3cd3689-b032-4d47-8d5f-d886628914a6} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e5a292c6-2ce5-4702-b1fc-1f9d5f7f810d} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e691676d-381a-4fa2-8188-f8597aa5e789} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e6c3097f-1cf8-4563-8318-d25ccaaa1191} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e779dc78-51e9-4630-a8d4-c9ae3548c6c7} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e8e367a1-57d1-49cb-b1b0-192b95bd5e6a} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f4d40fe2-8fef-45b0-8ddc-8fbd080e6a37} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{fecb6f44-0b53-43c3-b5e8-aa03ece60aa9} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{06118cbf-3228-4d60-8139-201e32675dc7} (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
C:\Program Files\SysCleaner (Rogue.SysCleaner) -> Quarantined and deleted successfully.
C:\Documents and Settings\eki\Application Data\EasySpywareCleaner.com (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
C:\Documents and Settings\eki\Application Data\EasySpywareCleaner.com\EasySpywareCleaner (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
C:\Documents and Settings\eki\Application Data\EasySpywareCleaner.com\EasySpywareCleaner\Autorun (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
C:\Documents and Settings\eki\Application Data\EasySpywareCleaner.com\EasySpywareCleaner\BrowserObjects (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
C:\Documents and Settings\eki\Application Data\EasySpywareCleaner.com\EasySpywareCleaner\Autorun\HKCURun (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
C:\Documents and Settings\eki\Application Data\EasySpywareCleaner.com\EasySpywareCleaner\Autorun\HKLMRun (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
C:\Documents and Settings\eki\Application Data\EasySpywareCleaner.com\EasySpywareCleaner\Autorun\StartMenuAllUsers (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
C:\Documents and Settings\eki\Application Data\EasySpywareCleaner.com\EasySpywareCleaner\Autorun\StartMenuCurrentUser (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
C:\Documents and Settings\eki\Application Data\EasySpywareCleaner.com\EasySpywareCleaner\Autorun\HKCURun\RunOnce (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
C:\Documents and Settings\eki\Application Data\EasySpywareCleaner.com\EasySpywareCleaner\Autorun\HKCURun\RunOnceEx (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
C:\Documents and Settings\eki\Application Data\EasySpywareCleaner.com\EasySpywareCleaner\Autorun\HKLMRun\RunOnce (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
C:\Documents and Settings\eki\Application Data\EasySpywareCleaner.com\EasySpywareCleaner\Autorun\HKLMRun\RunOnceEx (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
Files Infected:
C:\System Volume Information\_restore{0EFF3A47-4413-499E-9A15-0B6050F1F895}\RP125\A0041069.dll (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0EFF3A47-4413-499E-9A15-0B6050F1F895}\RP125\A0041071.dll (Rogue.EasySpywareCleaner) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{0EFF3A47-4413-499E-9A15-0B6050F1F895}\RP9\A0009065.dll (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\opnllkl.0ll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\inf\ultra.PNF (Malware.Trace) -> Quarantined and deleted successfully.
|
|
Hujo
Suspended permanently
|
21. maaliskuuta 2008 @ 19:54 |
Linkki tähän viestiin
|
Lataa tuolta Ccleaner
CCleaner v2.05.555- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
laita asetukset näin:
Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.
aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi
=========
1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
2. Valitse ominaisuudet
3. Valitse järjestelmän palauttaminen välilehti
4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä
6. Paina ok
7. Sammuta ja käynnistä
8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
9. Käytä ja OK
Voiko tietsikka koskaan toimia?
|
|
Randati
Newbie
|
21. maaliskuuta 2008 @ 20:08 |
Linkki tähän viestiin
|
|
Noin. Olikos se sitten siinä?
|
|
Hujo
Suspended permanently
|
21. maaliskuuta 2008 @ 20:12 |
Linkki tähän viestiin
|
|
niin se oli siinä.
onkos niitä ongelmia vielä
Voiko tietsikka koskaan toimia?
|
|
Mainos
|
|
|
|
Randati
Newbie
|
21. maaliskuuta 2008 @ 20:13 |
Linkki tähän viestiin
|
|
Eipä näy ongelmia. Kiitoksia!
|
|
