|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
Backdoor:win32/rbot.gen ei lähde koneelta(Hjt-logi)
|
|
|
qiac
Newbie
|
21. huhtikuuta 2008 @ 15:51 |
Linkki tähän viestiin
|
Hei
Windowsin haittaohjelmien postotyökalu löytää viruksen Backdoor:win32/rbot.gen koneeltani ja onnistuu poistamaan sen, mutta jos ajan työkälun uudestaan myöhemmin sama virus löytyy joka kerta. Norman antivirus, Ad-aware tai windown defender eivät kyseistä virusta löydä. Eli jos joku osaisi katsoa ja auttaa Hjt-login kautta.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:46:12, on 21.4.2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Norman\Npm\bin\ELOGSVC.EXE
C:\Program Files\Norman\Npm\Bin\Zanda.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\C&E\OSD\osd.exe
C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe
C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
C:\Program Files\Norman\Npm\Bin\Zlh.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
C:\Program Files\Norman\Nvc\bin\nvcoas.exe
C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\NetLimiter 2 Pro\NLClient.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Norman\Nvc\bin\cclaw.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\svehost.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Pelit\Steam\Steam.exe
C:\Program Files\Common Files\Steam\SteamService.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Windows\system32\conime.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [IaNvSrv] C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe
O4 - HKLM\..\Run: [OSD] C:\Program Files\C&E\OSD\osd.exe
O4 - HKLM\..\Run: [recinfo825] c:\RecInfo\RecInfo.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [recinfo] RecInfo.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Program Files\Norman\Npm\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Microsoft Updates] svehost.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\RunServices: [Microsoft Updates] svehost.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe 20080326
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\bin\ELOGSVC.EXE
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: OsdService - Unknown owner - C:\Program Files\C&E\OSD\OsdService\OsdService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
--
End of file - 10158 bytes
|
|
Hujo
Suspended permanently
|
21. huhtikuuta 2008 @ 16:44 |
Linkki tähän viestiin
|
scannaa hjt:llä merkkaa paina Fix checked
O4 - HKLM\..\Run: [Microsoft Updates] svehost.exe
=============
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Voiko tietsikka koskaan toimia?
|
|
qiac
Newbie
|
21. huhtikuuta 2008 @ 17:03 |
Linkki tähän viestiin
|
Täss combofix loki
ComboFix 08-04-20.5 - --- 2008-04-21 16:49:06.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1035.18.965 [GMT 3:00]
Running from: C:\Users\---\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Windows\system32\drivers\npf.sys
C:\Windows\system32\packet.dll
C:\Windows\system32\svehost.exe
C:\Windows\system32\wpcap.dll
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-03-21 to 2008-04-21 )))))))))))))))))
.
2008-04-21 15:29 . 2008-04-21 15:29 <KANSIO> d-------- C:\Windows\Sun
2008-04-20 18:11 . 2008-04-20 18:11 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-04-20 12:01 . 2008-04-20 12:27 <KANSIO> d-------- C:\Users\All Users\Spybot - Search & Destroy
2008-04-20 12:01 . 2008-04-20 12:27 <KANSIO> d-------- C:\ProgramData\Spybot - Search & Destroy
2008-04-20 12:01 . 2008-04-20 12:01 <KANSIO> d-------- C:\Program Files\Spybot - Search & Destroy
2008-04-19 18:27 . 2008-04-19 18:27 <KANSIO> d-------- C:\PerfLogs
2008-04-19 18:13 . 2008-04-19 17:44 152,576 --a------ C:\Windows\System32\SPWizUI.dll
2008-04-19 18:13 . 2008-04-19 17:44 47,560 --a------ C:\Windows\System32\SPReview.exe
2008-04-19 18:01 . 2008-01-18 23:33 193,024 --a------ C:\Windows\System32\recdisc.exe
2008-04-19 18:01 . 2008-01-18 23:36 6,656 --a------ C:\Windows\System32\sdspres.dll
2008-04-19 18:00 . 2008-01-18 23:33 599,552 --a------ C:\Windows\System32\vsp1cln.exe
2008-04-19 18:00 . 2008-01-18 23:36 142,336 --a------ C:\Windows\System32\spp.dll
2008-04-19 18:00 . 2008-01-18 23:36 28,160 --a------ C:\Windows\System32\sxproxy.dll
2008-04-19 17:56 . 2008-01-18 23:34 6,103,040 --a------ C:\Windows\System32\chtbrkr.dll
2008-04-19 17:52 . 2008-01-18 23:33 44,032 --a------ C:\Windows\System32\cbsra.exe
2008-04-19 17:44 . 2008-04-19 18:15 196,608 --a------ C:\Windows\SPInstall.etl
2008-04-09 12:24 . 2008-02-22 05:50 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-04-09 12:24 . 2008-02-22 08:01 826,880 --a------ C:\Windows\System32\wininet.dll
2008-04-09 12:24 . 2008-02-22 07:57 295,936 --a------ C:\Windows\System32\gdi32.dll
2008-04-04 11:32 . 2008-04-21 14:15 54,156 --ah----- C:\Windows\QTFont.qfn
2008-04-04 11:32 . 2008-04-04 11:32 1,409 --a------ C:\Windows\QTFont.for
2008-04-04 11:31 . 2008-04-04 11:32 <KANSIO> d-------- C:\Program Files\iTunes
2008-04-04 11:31 . 2008-04-04 11:31 <KANSIO> d-------- C:\Program Files\iPod
2008-04-04 11:30 . 2008-04-04 11:31 <KANSIO> d-------- C:\Program Files\QuickTime
2008-03-31 16:15 . 2008-04-06 16:51 <KANSIO> d-------- C:\Program Files\Common Files\Steam
2008-03-30 22:33 . 2008-03-30 22:53 82,774 --a------ C:\Windows\Uninstall Jade Empire.exe
2008-03-29 13:59 . 2008-03-29 13:59 283 --a------ C:\Windows\game.ini
2008-03-28 23:37 . 2008-03-28 23:37 90,112 --a------ C:\Windows\System32\QuickTimeVR.qtx
2008-03-28 23:37 . 2008-03-28 23:37 57,344 --a------ C:\Windows\System32\QuickTime.qts
2008-03-25 23:09 . 2008-04-21 15:29 <KANSIO> d-------- C:\Users\---\e-Safekey
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-21 12:21 --------- d-----w C:\Program Files\Java
2008-04-21 11:15 --------- d---a-w C:\ProgramData\TEMP
2008-04-21 11:15 --------- d-----w C:\Program Files\Norman
2008-04-20 15:18 --------- d-----w C:\Users\---\AppData\Roaming\uTorrent
2008-04-20 14:52 --------- d-----w C:\Program Files\uTorrent
2008-04-20 14:51 --------- d-----w C:\Program Files\RevConnect
2008-04-19 15:35 174 --sha-w C:\Program Files\desktop.ini
2008-04-19 15:28 --------- d-----w C:\Program Files\Windows Sidebar
2008-04-19 15:28 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-04-19 15:28 --------- d-----w C:\Program Files\Windows Mail
2008-04-19 15:28 --------- d-----w C:\Program Files\Windows Defender
2008-04-19 15:28 --------- d-----w C:\Program Files\Windows Calendar
2008-04-19 15:20 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-04-19 15:19 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-04-14 14:25 --------- d-----w C:\Users\---\AppData\Roaming\ImgBurn
2008-04-09 10:27 --------- d-----w C:\ProgramData\Microsoft Help
2008-04-04 11:42 --------- d-----w C:\Program Files\Opera
2008-03-30 18:56 --------- d-----w C:\Users\---\AppData\Roaming\Bioshock
2008-03-30 18:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-30 18:31 --------- d-----w C:\ProgramData\Media Center Programs
2008-03-30 18:31 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-13 00:13 43,520 ----a-w C:\Windows\System32\CmdLineExt03.dll
2008-03-12 23:52 --------- d-----w C:\Users\---\AppData\Roaming\BSplayer PRO
2008-03-12 23:52 --------- d-----w C:\Program Files\Webteh
2008-03-12 13:37 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-09 11:43 --------- d-----w C:\ProgramData\Trymedia
2008-03-02 11:20 --------- d-----w C:\Program Files\ImgBurn
2008-02-29 07:14 19,000 ----a-w C:\Windows\System32\kd1394.dll
2008-02-29 07:11 988,216 ----a-w C:\Windows\System32\winload.exe
2008-02-29 07:11 927,288 ----a-w C:\Windows\System32\winresume.exe
2008-02-29 06:53 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll
2008-02-29 06:53 40,960 ----a-w C:\Windows\System32\srclient.dll
2008-02-29 06:53 378,368 ----a-w C:\Windows\System32\srcore.dll
2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll
2008-02-29 04:21 2,032,128 ----a-w C:\Windows\System32\win32k.sys
2008-02-29 04:12 318,464 ----a-w C:\Windows\System32\rstrui.exe
2008-02-29 04:12 14,848 ----a-w C:\Windows\System32\srdelayed.exe
2008-02-23 00:21 --------- d-----w C:\Users\---\AppData\Roaming\Sports Interactive
2008-02-23 00:04 --------- d--h--w C:\Program Files\Zero G Registry
2008-02-22 05:05 615,992 ----a-w C:\Windows\System32\ci.dll
2008-02-14 01:03 48,640 ----a-w C:\Windows\System32\davclnt.dll
2008-01-31 21:53 86,016 ----a-w C:\Windows\System32\OpenAL32.dll
2008-01-31 21:53 262,144 ----a-w C:\Windows\System32\wrap_oal.dll
2008-01-29 09:02 107,368 ----a-w C:\Windows\System32\GEARAspi.dll
2008-01-27 12:19 7,680 ----a-w C:\Windows\System32\ff_vfw.dll
2007-12-27 19:30 22,328 ----a-w C:\Users\---\AppData\Roaming\PnkBstrK.sys
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-18 23:33 1233920]
"fsc-reg"="C:\ProgramData\fsc-reg\fscreg.exe" [2007-11-08 12:05 470288]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-18 23:33 125952]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2007-12-19 23:13 486856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-18 23:38 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2007-05-10 18:10 4468736 C:\Windows\RtHDVCpl.exe]
"SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 19:31 630784]
"JMB36X IDE Setup"="C:\Windows\RaidTool\xInsIDE.exe" [2007-03-20 15:36 36864]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-07-24 19:02 174616]
"IaNvSrv"="C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe" [2007-07-24 19:02 33304]
"OSD"="C:\Program Files\C&E\OSD\osd.exe" [2007-09-21 03:32 561152]
"recinfo825"="c:\RecInfo\RecInfo.exe" [2007-10-23 15:52 2764800]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-02-26 21:46 153136]
"recinfo"="RecInfo.exe" []
"Norman ZANDA"="C:\Program Files\Norman\Npm\bin\ZLH.exe" [2007-08-09 15:40 183352]
"itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-11-21 18:08 813912]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 13:01 1037736]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 08:00 33648]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35 90112]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Microsoft Updates"="svehost.exe" []
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.mkdmp3enc"= C:\PROGRA~1\CYBERL~1\PowerDV\Kernel\Burner\MKDMP3Enc.ACM
"msacm.avis"= ff_acm.acm
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3384487556-148120472-1223521730-1000]
"EnableNotificationsRef"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\AuthorizedApplications\List]
"C:\\Program Files\\FlashFXP\\FlashFXP.exe"= C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{6125539A-503A-42BE-AE68-86F16A9BCFE0}"= C:\Program Files\CyberLink\PowerDV\PowerDV.exe:CyberLink PowerDV
"TCP Query User{88C2A457-0B1A-4E5C-8CEB-D085F3720854}C:\\pelit\\star wars kotor ii\\swupdate.exe"= UDP:C:\pelit\star wars kotor ii\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program
"UDP Query User{AE0FC0F9-B5C5-44B4-80AF-3FE28D266DDF}C:\\pelit\\star wars kotor ii\\swupdate.exe"= TCP:C:\pelit\star wars kotor ii\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program
"TCP Query User{3D51B28A-E0CE-495E-B237-D9A64F4D474A}C:\\pelit\\star wars knights of the old republic ii\\swupdate.exe"= UDP:C:\pelit\star wars knights of the old republic ii\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program
"UDP Query User{7245988E-0613-4C0A-84B8-5E2DA5A3FEBF}C:\\pelit\\star wars knights of the old republic ii\\swupdate.exe"= TCP:C:\pelit\star wars knights of the old republic ii\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program
"{981F8CCC-9397-4440-97B8-EEF1F9750B85}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{243A47F9-EEB9-470B-B802-E217C2FB31BD}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{FFDC794A-D149-42DD-832C-CEA76D740C45}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{F5F7DB5F-5887-47AC-A3BE-A10A426AB547}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{34E382AC-C132-45F5-9A2C-214ED3DE7914}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{4FD2FEA0-A9AA-4C6C-A9A1-E4B4364F1513}"= UDP:C:\Pelit\Crysis\Bin32\Crysis.exe:Crysis_32
"{5CF798ED-3246-4855-8291-4D8AE66C55FA}"= TCP:C:\Pelit\Crysis\Bin32\Crysis.exe:Crysis_32
"{581A5A30-EF36-4EE1-A69A-BE326294772B}"= UDP:C:\Pelit\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{C16E025A-33CB-426C-B6AA-8A1CA8A74149}"= TCP:C:\Pelit\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{46E2844A-799F-42B7-B275-76AFBA56955A}"= UDP:C:\Pelit\World in Conflict\wic.exe:World in Conflict
"{8AF01BA4-6E45-452C-A113-00AD8536BF3A}"= TCP:C:\Pelit\World in Conflict\wic.exe:World in Conflict
"{E5944370-2B21-412D-B80B-6F6EE162F8A9}"= UDP:C:\Pelit\World in Conflict\wic_online.exe:World in Conflict - Online Only
"{D964305E-922C-4EFD-8935-700707F82784}"= TCP:C:\Pelit\World in Conflict\wic_online.exe:World in Conflict - Online Only
"{78011E16-A9D3-47F8-940B-6E6DD28C1C5D}"= UDP:C:\Pelit\World in Conflict\wic_ds.exe:World in Conflict - Dedicated Server
"{CE78C257-E6C8-4AB1-9869-74AB26FDCC26}"= TCP:C:\Pelit\World in Conflict\wic_ds.exe:World in Conflict - Dedicated Server
"TCP Query User{00ABFFE4-C070-43EF-A377-1CD1286EE363}C:\\program files\\revconnect\\dcplusplus.exe"= UDP:C:\program files\revconnect\dcplusplus.exe:DC++
"UDP Query User{AA400803-B8E1-4E87-AF8D-0E863604114B}C:\\program files\\revconnect\\dcplusplus.exe"= TCP:C:\program files\revconnect\dcplusplus.exe:DC++
"TCP Query User{03197276-B259-4475-95F8-C0A348CA37FA}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
"UDP Query User{8E78009F-8A04-4EE5-ADEF-749E607345ED}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
"{17ED6893-9D31-4F8B-BA30-0D67FF9A5E06}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{71A8EFCF-7817-4768-AF1A-7AAA43661BEA}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{F45715B0-422B-4E69-999D-FB20017425B8}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{0BEE21E2-F40C-4D0D-ABA2-F8F5B4156E6B}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{C9A4E229-B740-4C57-81D8-35C4206B30F3}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{8CEC2074-0A09-4CEC-88E9-C6051BE2E598}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{77B6CCC6-B607-4F88-B471-060A5D9938C7}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{7A69BB66-2226-4BA5-B899-2F1972231A68}"= UDP:C:\Pelit\Football Manager 2008\fm.exe:Football Manager 2008
"{EE616DB0-8327-424E-BF11-83C572CE2ECF}"= TCP:C:\Pelit\Football Manager 2008\fm.exe:Football Manager 2008
"{A6B5F5C9-EEC8-4D68-8C5C-FA3C48438E06}"= UDP:C:\Pelit\Call of Duty 4\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{1C38AEC0-50E8-4343-8713-24E588619A1C}"= TCP:C:\Pelit\Call of Duty 4\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"TCP Query User{32E3E24D-7D08-4300-93EC-5C609D744547}C:\\pelit\\steam\\steamapps\\---\\counter-strike source\\hl2.exe"= UDP:C:\pelit\steam\steamapps\---\counter-strike source\hl2.exe:hl2
"UDP Query User{F7B9EE97-78E8-48AF-BEDC-A64156E61A6B}C:\\pelit\\steam\\steamapps\\---\\counter-strike source\\hl2.exe"= TCP:C:\pelit\steam\steamapps\---\counter-strike source\hl2.exe:hl2
"{F1746358-C31E-4454-B85C-249B9391C573}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{16626BB1-F893-45E6-A3F5-6E0D8ABF7284}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"TCP Query User{2B763924-4728-48E8-A8F4-E9EEA2F59CBD}C:\\pelit\\steam\\steamapps\\---\\counter-strike source\\hl2.exe"= UDP:C:\pelit\steam\steamapps\---\counter-strike source\hl2.exe:hl2
"UDP Query User{C03AA628-38A6-4F39-942B-8C15A364F9B9}C:\\pelit\\steam\\steamapps\\---\\counter-strike source\\hl2.exe"= TCP:C:\pelit\steam\steamapps\---\counter-strike source\hl2.exe:hl2
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\FlashFXP\\FlashFXP.exe"= C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3
R0 iaNvStor;Intel(R) Turbo Memory Controller;C:\Windows\system32\DRIVERS\iaNvStor.sys [2007-07-09 14:28]
R0 Si3531;SiI-3531 SATA Controller;C:\Windows\system32\DRIVERS\Si3531.sys [2007-01-30 11:31]
R1 nltdi;nltdi;C:\Windows\system32\drivers\nltdi.sys [2007-04-23 14:03]
R2 Ndiskio;Ndiskio;C:\Program Files\Norman\Nse\bin\NDISKIO.SYS [2007-01-02 10:55]
R2 TestHandler;Fujitsu Siemens Computers Diagnostic Testhandler;C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe [2006-12-08 21:52]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-12-04 23:08]
R3 CEBFilter;CEBFilter;C:\Program Files\C&E\OSD\OsdService\cebuffer.sys [2007-09-05 03:20]
R3 CEIO;CEIO;C:\Program Files\C&E\OSD\OsdService\ceio.sys [2007-09-01 03:18]
R3 cKBFilter;cKBFilter;C:\Program Files\C&E\OSD\OsdService\kbfiltr.sys [2007-09-01 01:22]
R3 itecir;ITECIR Infrared Receiver;C:\Windows\system32\DRIVERS\itecir.sys [2007-04-04 06:57]
R3 NvcMFlt;NvcMFlt;C:\Windows\system32\DRIVERS\nvcv32mf.sys [2008-02-11 15:56]
R3 nvcoas;Norman Virus Control on-access component;C:\Program Files\Norman\Nvc\bin\nvcoas.exe [2007-12-12 12:45]
R3 NVCScheduler;Norman Virus Control Scheduler;C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE [2007-05-23 14:23]
R3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-04-06 16:50]
S2 OsdService;OsdService;C:\Program Files\C&E\OSD\OsdService\OsdService.exe [2007-09-04 04:01]
S3 nvcfsr;nvcfsr;C:\Program Files\Norman\Nvc\bin\nvcfsr.sys [2007-01-09 16:25]
S3 nvcoafl4;nvcoafl4;C:\Program Files\Norman\Nvc\bin\nvcoafl4.sys [2007-01-09 16:25]
S3 nvcoaft4;nvcoaft4;C:\Program Files\Norman\Nvc\bin\nvcoaft4.sys [2007-01-09 16:25]
S3 nvcoarc4;nvcoarc4;C:\Program Files\Norman\Nvc\bin\nvcoarc4.sys [2007-01-09 16:25]
S4 nvrd32;NVIDIA nForce RAID Driver;C:\Windows\system32\drivers\nvrd32.sys [2007-07-02 18:37]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
*Newly Created Service* - CATCHME
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-21 16:52:18
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-04-21 16:55:31
ComboFix-quarantined-files.txt 2008-04-21 13:55:12
Pre-Run: 43,506,573,312 tavua vapaana
Post-Run: 43,264,151,552 tavua vapaana
220 --- E O F --- 2008-04-17 20:41:00
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 22. huhtikuuta 2008 @ 02:38
|
|
Hujo
Suspended permanently
|
21. huhtikuuta 2008 @ 17:15 |
Linkki tähän viestiin
|
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.
Voiko tietsikka koskaan toimia?
|
|
qiac
Newbie
|
21. huhtikuuta 2008 @ 20:44 |
Linkki tähän viestiin
|
|
Malwarebytes ei löytänyt mitään, eikä windowsin haittaohjelmien poistotyökalu enää löytänyt kyseistä viirusta joten luultavasti se lähti koneelta, joten kiitokset avusta. Tuossa nyt on vielä tuo Malwarebytesin logi
Malwarebytes' Anti-Malware 1.11
Tietokantaversio: 665
Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|)
Tarkistetut kohteet: 220547
Kulunut aika: 1 hour(s), 29 minute(s), 17 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)
|
|
Mainos
|
|
|
|
Hujo
Suspended permanently
|
21. huhtikuuta 2008 @ 21:27 |
Linkki tähän viestiin
|
|
ok..
Voiko tietsikka koskaan toimia?
|
|
