|
Hijackthis-logini tarkistusta, joku?
|
|
|
sonjaa
Junior Member
|
9. kesäkuuta 2008 @ 22:53 |
Linkki tähän viestiin
|
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:49:32, on 9.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\QuickTime\QTTask.exe
C:\iTunes\iTunesHelper.exe
C:\WINDOWS\winudspm.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\winudmr.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\AntiVir PersonalEdition Classic\update.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\Program Files\Last.fm\LastFM.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Music Manager\OD2State.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ig?hl=fi
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;<local>;*.local
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe
O4 - HKLM\..\Run: [BMa727cb6e] Rundll32.exe "C:\WINDOWS\system32\rewvifwi.dll",s
O4 - HKLM\..\Run: [a414f8f2] rundll32.exe "C:\WINDOWS\system32\ooycjevh.dll",b
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Tuki - {43D2E5C2-7C6F-4FA0-8E99-3710D39419E3} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Service - {4B8A4CEF-46CE-442D-914B-6EEDAA0B0757} - http://service.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: SMS - {51AEE4AD-ED6C-477D-986F-BA295C34AE49} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: SMS-viesti - {87AC75E3-B87C-41A0-9944-DE3843486312} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Support - {9A8D9E17-C866-4C12-A4A3-96B579D0CEA8} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Palvelut - {FB431587-8135-49D9-8BBD-446412BB777F} - http://service.kolumbus.fi/ (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
--
End of file - 6889 bytes
|
|
Hujo
Suspended permanently
|
10. kesäkuuta 2008 @ 00:24 |
Linkki tähän viestiin
|
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Voiko tietsikka koskaan toimia?
|
|
sonjaa
Junior Member
|
10. kesäkuuta 2008 @ 15:31 |
Linkki tähän viestiin
|
Kiitos, tällästä nyt:
--------
ComboFix 08-06-09.7 - Aira&Pekka 2008-06-10 14:48:31.2 - NTFSx86
Running from: C:\Documents and Settings\Aira&Pekka\My Documents\Downloads\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\eKnpAcdd.ini
C:\WINDOWS\system32\eKnpAcdd.ini2
C:\WINDOWS\system32\iafwnetn.dll
C:\WINDOWS\system32\uevcrkby.ini
C:\WINDOWS\system32\ybkrcveu.dll
.
---- Previous Run -------
.
C:\bot.exe
C:\Documents and Settings\Aira&Pekka\Application Data\macromedia\Flash Player\#SharedObjects\4R6GMKYF\iforex.com
C:\Documents and Settings\Aira&Pekka\Application Data\macromedia\Flash Player\#SharedObjects\4R6GMKYF\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\Aira&Pekka\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\Aira&Pekka\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\WINDOWS\BMa727cb6e.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\service.exe
C:\WINDOWS\system32\aaxwnqyd.exe
C:\WINDOWS\system32\aqbkkela.ini
C:\WINDOWS\system32\benomatf.ini
C:\WINDOWS\system32\bxuvuccj.exe
C:\WINDOWS\system32\cbyqwtnq.dll
C:\WINDOWS\system32\dlmsadux.exe
C:\WINDOWS\system32\efcCuVoo.dll
C:\WINDOWS\system32\eKnpAcdd.ini
C:\WINDOWS\system32\eKnpAcdd.ini2
C:\WINDOWS\system32\gfhpiqmc.dll
C:\WINDOWS\system32\hhrfofjy.dll
C:\WINDOWS\system32\hvejcyoo.ini
C:\WINDOWS\system32\kgukcatm.dll
C:\WINDOWS\system32\kkfotyfl.dll
C:\WINDOWS\system32\knelrrml.ini
C:\WINDOWS\system32\lfytofkk.ini
C:\WINDOWS\system32\lmrrlenk.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nnnlmJDW.dll
C:\WINDOWS\system32\ooycjevh.dll
C:\WINDOWS\system32\opnmJDUn.dll
C:\WINDOWS\system32\rewvifwi.dll
C:\WINDOWS\system32\ssqPiffE.dll
C:\WINDOWS\system32\tgpxfrnf.dll
C:\WINDOWS\system32\vljnvqvt.dll
C:\WINDOWS\system32\vnxdcabl.exe
C:\WINDOWS\system32\wsyacstx.dll
C:\WINDOWS\system32\vtUlMfGy.dll
C:\WINDOWS\system32\xyxpqbgc.ini
C:\WINDOWS\system32\yjfofrhh.ini
C:\WINDOWS\system32\yrwixtwm.exe
.
((((((((((((((((((((((((( Files Created from 2008-05-10 to 2008-06-10 )))))))))))))))))))))))))))))))
.
2008-06-10 14:41 . 2008-06-10 14:41 0 --a------ C:\WINDOWS\BMa727cb6e.xml
2008-06-09 21:53 . 2008-06-10 14:50 2,232 --a------ C:\mzda.exe
2008-06-09 21:48 . 2008-06-09 21:48 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-09 20:58 . 2008-06-09 20:58 <DIR> d-------- C:\Documents and Settings\Aira&Pekka\Application Data\MSNInstaller
2008-06-09 19:35 . 2008-06-09 19:35 29,342 --a------ C:\gf.exe
2008-06-09 18:59 . 2008-06-09 18:59 29,342 --a------ C:\gpf.exe
2008-06-09 15:35 . 2008-06-09 15:35 29,342 -r-hs---- C:\WINDOWS\winudmr.exe
2008-06-09 15:35 . 2008-06-09 15:35 29,342 --a------ C:\pf.exe
2008-06-09 15:35 . 2008-06-10 14:40 2,232 --a------ C:\ps.exe
2008-06-08 16:28 . 2008-06-08 16:55 2,231 --a------ C:\hszs.exe
2008-06-08 16:27 . 2008-06-08 19:00 2,229 --a------ C:\is154890.exe
2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
2008-06-03 20:34 . 2008-06-03 20:34 <DIR> d-------- C:\Documents and Settings\Aira&Pekka\Application Data\Grisoft
2008-06-03 20:29 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-06-03 20:28 . 2008-06-03 20:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-06-03 20:17 . 2008-06-03 22:58 86,548 --a------ C:\Documents and Settings\Aira&Pekka\setupa.exe
2008-06-03 18:53 . 2008-06-03 23:05 86,548 --a------ C:\ssetup.exe
2008-06-01 20:46 . 2008-06-01 20:46 86,502 --a------ C:\sexy.com
2008-06-01 20:07 . 2008-06-01 20:07 <DIR> d--h----- C:\WINDOWS\PIF
2008-06-01 17:36 . 2008-06-03 21:13 4,217 --a------ C:\WINDOWS\is154890.exe
2008-05-29 20:18 . 2008-05-29 20:18 86,340 --a------ C:\img.com
2008-05-29 19:38 . 2008-05-29 19:38 40,960 --a------ C:\dsdc.exe
2008-05-29 19:25 . 2008-05-29 20:28 60,132 --a------ C:\ddc.exe
2008-05-29 15:14 . 2008-05-29 15:14 56,832 --a------ C:\fa.com
2008-05-29 15:14 . 2008-05-29 15:17 40,960 --a------ C:\d.exe
2008-05-29 15:07 . 2008-05-29 15:07 59,392 --a------ C:\WINDOWS\system32\nnnkKATl.dll
2008-05-28 17:28 . 2008-05-28 17:28 380,416 --a------ C:\WINDOWS\system32\ddcApnKe.dll
2008-05-27 20:38 . 2008-05-27 20:38 40,960 --a------ C:\dchi.exe
2008-05-27 20:30 . 2008-05-29 15:14 56,832 -r-hs---- C:\WINDOWS\winudspm.exe
2008-05-27 20:30 . 2008-05-27 21:55 40,960 --a------ C:\dci.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-10 11:42 --------- d-----w C:\Documents and Settings\Aira&Pekka\Application Data\OpenOffice.org2
2008-06-09 17:55 --------- d-----w C:\Program Files\Sony
2008-05-29 17:00 --------- d-----w C:\Program Files\Creative
2008-05-29 16:52 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-20 10:17 --------- d-----w C:\Program Files\Last.fm
2008-05-04 13:47 --------- d-----w C:\Program Files\Google
2008-05-02 19:11 --------- d-----w C:\Program Files\iPod
2008-05-02 18:58 --------- d-----w C:\Program Files\Bonjour
2008-05-02 18:56 --------- d-----w C:\Program Files\Canon
2008-05-02 18:55 --------- d-----w C:\Program Files\DivX
2008-05-02 18:39 --------- d-----w C:\Program Files\Juice
2008-04-23 15:32 --------- d-----w C:\Program Files\Apple Software Update
2008-04-13 14:56 --------- d-----w C:\Program Files\QuickTime
.
------- Sigcheck -------
2008-05-28 17:28 87552 918e116feae29a433201b7a5400829ba C:\WINDOWS\system32\ws2_32.dll
2004-08-04 04:07 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\dllcache\ws2_32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{84DC7C50-3080-41C9-A11B-FFB851A7B222}]
2008-05-28 17:28 380416 --a------ C:\WINDOWS\system32\ddcApnKe.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-03 05:23 102400]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 23:55 5674352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 22:00 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-17 10:11 49152]
"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-27 18:41 262401]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 04:06 40048]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"Windows UDP Control"="winudspm.exe" [2008-05-29 15:14 56832 C:\WINDOWS\winudspm.exe]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]
"Windows Controls Center"="winudmr.exe" [2008-06-09 15:35 29342 C:\WINDOWS\winudmr.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:07 15360]
C:\Documents and Settings\Aira&Pekka\Start Menu\Programs\Startup\
OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe [2005-10-15 13:02:32 61440]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 16:19:24 237568]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Last.fm\\LastFM.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\iTunes\\iTunes.exe"=
S1 ensqio;ensqio;C:\WINDOWS\system32\DRIVERS\ensqio.sys []
S1 sbpcint4;SB AudioPCI 128;C:\WINDOWS\system32\DRIVERS\sbpcint4.sys []
S3 ES1370;Creative AudioPCI (ES1370), SB PCI 64/128 (WDM);C:\WINDOWS\system32\drivers\ES1370MP.sys [2001-08-17 23:19]
.
Contents of the 'Scheduled Tasks' folder
"2008-04-20 16:10:26 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-10 15:02:40
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.bin
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2008-06-10 15:18:22 - machine was rebooted [Aira&Pekka]
ComboFix-quarantined-files.txt 2008-06-10 12:17:12
Pre-Run: 489,512,960 bytes free
Post-Run: 435,904,512 bytes free
190 --- E O F --- 2008-05-18 11:53:23
|
|
Hujo
Suspended permanently
|
10. kesäkuuta 2008 @ 16:00 |
Linkki tähän viestiin
|
Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
Lainaus:
File::
C:\WINDOWS\winudmr.exe
C:\WINDOWS\winudspm.exe
C:\gf.exe
C:\gpf.exe
C:\pf.exe
C:\ps.exe
C:\hszs.exe
C:\is154890.exe
C:\ssetup.exe
C:\sexy.com
C:\WINDOWS\is154890.exe
C:\img.com
C:\dsdc.exe
C:\ddc.exe
C:\fa.com
C:\d.exe
C:\dchi.exe
C:\dci.exe
C:\WINDOWS\system32\rewvifwi.dll
C:\WINDOWS\system32\ooycjevh.dll
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
=============
scannaa hjt:llä merkkaa paina Fix checked
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe
O4 - HKLM\..\Run: [BMa727cb6e] Rundll32.exe "C:\WINDOWS\system32\rewvifwi.dll",s
O4 - HKLM\..\Run: [a414f8f2] rundll32.exe "C:\WINDOWS\system32\ooycjevh.dll",b
==============
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.
Voiko tietsikka koskaan toimia?
|
|
sonjaa
Junior Member
|
10. kesäkuuta 2008 @ 17:02 |
Linkki tähän viestiin
|
Tässä tämä, sitte skannaamaan HJT:lla...
---
ComboFix 08-06-09.7 - Aira&Pekka 2008-06-10 16:27:55.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.320 [GMT 3:00]
Running from: C:\Documents and Settings\Aira&Pekka\My Documents\Downloads\ComboFix.exe
Command switches used :: C:\Documents and Settings\Aira&Pekka\My Documents\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\d.exe
C:\dchi.exe
C:\dci.exe
C:\ddc.exe
C:\dsdc.exe
C:\fa.com
C:\gf.exe
C:\gpf.exe
C:\hszs.exe
C:\img.com
C:\is154890.exe
C:\pf.exe
C:\ps.exe
C:\sexy.com
C:\ssetup.exe
C:\WINDOWS\is154890.exe
C:\WINDOWS\system32\ooycjevh.dll
C:\WINDOWS\system32\rewvifwi.dll
C:\WINDOWS\winudmr.exe
C:\WINDOWS\winudspm.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\d.exe
C:\dchi.exe
C:\dci.exe
C:\ddc.exe
C:\dsdc.exe
C:\fa.com
C:\gf.exe
C:\gpf.exe
C:\hszs.exe
C:\img.com
C:\is154890.exe
C:\pf.exe
C:\ps.exe
C:\sexy.com
C:\ssetup.exe
C:\WINDOWS\BMa727cb6e.xml
C:\WINDOWS\is154890.exe
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\ddmbwxly.dll
C:\WINDOWS\system32\dohbklff.dll
C:\WINDOWS\system32\eKnpAcdd.ini
C:\WINDOWS\system32\eKnpAcdd.ini2
C:\WINDOWS\system32\fflkbhod.ini
C:\WINDOWS\winudmr.exe
C:\WINDOWS\winudspm.exe
.
((((((((((((((((((((((((( Files Created from 2008-05-10 to 2008-06-10 )))))))))))))))))))))))))))))))
.
2008-06-09 21:53 . 2008-06-10 14:50 2,232 --a------ C:\mzda.exe
2008-06-09 21:48 . 2008-06-09 21:48 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-09 20:58 . 2008-06-09 20:58 <DIR> d-------- C:\Documents and Settings\Aira&Pekka\Application Data\MSNInstaller
2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
2008-06-03 20:34 . 2008-06-03 20:34 <DIR> d-------- C:\Documents and Settings\Aira&Pekka\Application Data\Grisoft
2008-06-03 20:29 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-06-03 20:28 . 2008-06-03 20:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-06-03 20:17 . 2008-06-03 22:58 86,548 --a------ C:\Documents and Settings\Aira&Pekka\setupa.exe
2008-06-01 20:07 . 2008-06-01 20:07 <DIR> d--h----- C:\WINDOWS\PIF
2008-05-29 15:07 . 2008-05-29 15:07 59,392 --a------ C:\WINDOWS\system32\nnnkKATl.dll
2008-05-28 17:28 . 2008-05-28 17:28 380,416 --a------ C:\WINDOWS\system32\ddcApnKe.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-10 12:09 --------- d-----w C:\Documents and Settings\Aira&Pekka\Application Data\OpenOffice.org2
2008-06-09 17:55 --------- d-----w C:\Program Files\Sony
2008-05-29 17:00 --------- d-----w C:\Program Files\Creative
2008-05-29 16:52 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-20 10:17 --------- d-----w C:\Program Files\Last.fm
2008-05-04 13:47 --------- d-----w C:\Program Files\Google
2008-05-02 19:11 --------- d-----w C:\Program Files\iPod
2008-05-02 18:58 --------- d-----w C:\Program Files\Bonjour
2008-05-02 18:56 --------- d-----w C:\Program Files\Canon
2008-05-02 18:55 --------- d-----w C:\Program Files\DivX
2008-05-02 18:39 --------- d-----w C:\Program Files\Juice
2008-04-23 15:32 --------- d-----w C:\Program Files\Apple Software Update
2008-04-13 14:56 --------- d-----w C:\Program Files\QuickTime
.
------- Sigcheck -------
2008-05-28 17:28 87552 918e116feae29a433201b7a5400829ba C:\WINDOWS\system32\ws2_32.dll
2004-08-04 04:07 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\dllcache\ws2_32.dll
.
((((((((((((((((((((((((((((( snapshot@2008-06-10_15.16.21.04 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-10 12:01:02 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-10 13:35:47 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C5F134A9-9A48-44CF-82B0-948FDA82C09E}]
2008-05-28 17:28 380416 --a------ C:\WINDOWS\system32\ddcApnKe.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-03 05:23 102400]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 23:55 5674352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 22:00 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-17 10:11 49152]
"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-27 18:41 262401]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 04:06 40048]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"Windows UDP Control"="winudspm.exe" []
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]
"Windows Controls Center"="winudmr.exe" []
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:07 15360]
C:\Documents and Settings\Aira&Pekka\Start Menu\Programs\Startup\
OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe [2005-10-15 13:02:32 61440]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 16:19:24 237568]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Last.fm\\LastFM.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\iTunes\\iTunes.exe"=
S1 ensqio;ensqio;C:\WINDOWS\system32\DRIVERS\ensqio.sys []
S1 sbpcint4;SB AudioPCI 128;C:\WINDOWS\system32\DRIVERS\sbpcint4.sys []
S3 ES1370;Creative AudioPCI (ES1370), SB PCI 64/128 (WDM);C:\WINDOWS\system32\drivers\ES1370MP.sys [2001-08-17 23:19]
.
Contents of the 'Scheduled Tasks' folder
"2008-04-20 16:10:26 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-10 16:37:20
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.bin
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2008-06-10 16:51:55 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-10 13:50:46
ComboFix2.txt 2008-06-10 12:18:25
Pre-Run: 378,699,776 bytes free
Post-Run: 404,967,424 bytes free
177 --- E O F --- 2008-05-18 11:53:23
|
|
sonjaa
Junior Member
|
10. kesäkuuta 2008 @ 17:11 |
Linkki tähän viestiin
|
|
Tota noin, näitä kahta ei löytynyt tuosta listasta HJT:lla. Haittaako?
O4 - HKLM\..\Run: [BMa727cb6e] Rundll32.exe "C:\WINDOWS\system32\rewvifwi.dll",s
ja
O4 - HKLM\..\Run: [a414f8f2] rundll32.exe "C:\WINDOWS\system32\ooycjevh.dll",b
|
|
Hujo
Suspended permanently
|
10. kesäkuuta 2008 @ 17:14 |
Linkki tähän viestiin
|
Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
Lainaus:
File::
C:\mzda.exe
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
=============
ei haittaa
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 10. kesäkuuta 2008 @ 17:15
|
|
sonjaa
Junior Member
|
10. kesäkuuta 2008 @ 17:19 |
Linkki tähän viestiin
|
|
Okei, kiitti.
Lataan eka vaan ton Malwarebytesin, ku en ole vielä ehtinyt...
|
|
sonjaa
Junior Member
|
10. kesäkuuta 2008 @ 20:09 |
Linkki tähän viestiin
|
|
Noniiin... Ja nyt teen ton C:\mzda.exe ComboFix jutun?
--
Malwarebytes' Anti-Malware 1.16
Database version: 845
20:03:42 10.6.2008
mbam-log-6-10-2008 (20-03-42).txt
Scan type: Full Scan (C:\|)
Objects scanned: 97915
Time elapsed: 2 hour(s), 29 minute(s), 22 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 21
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
C:\WINDOWS\system32\ddcApnKe.dll (Trojan.Vundo) -> Unloaded module successfully.
Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{c5f134a9-9a48-44cf-82b0-948fda82c09e} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c5f134a9-9a48-44cf-82b0-948fda82c09e} (Trojan.Vundo) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\QooBox\Quarantine\C\bot.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\d.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\dchi.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\dci.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\ddc.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\dsdc.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\fa.com.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\img.com.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\winudspm.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\aaxwnqyd.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\bxuvuccj.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\dlmsadux.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\nnnlmJDW.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\opnmJDUn.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\ssqPiffE.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\vnxdcabl.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\vtUlMfGy.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\yrwixtwm.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nnnkKATl.dll (Backdoor.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ddcApnKe.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
|
|
Hujo
Suspended permanently
|
10. kesäkuuta 2008 @ 21:22 |
Linkki tähän viestiin
|
|
ok....
Voiko tietsikka koskaan toimia?
|
|
sonjaa
Junior Member
|
10. kesäkuuta 2008 @ 21:58 |
Linkki tähän viestiin
|
Näin..:
---
ComboFix 08-06-09.7 - Aira&Pekka 2008-06-10 21:27:55.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.375 [GMT 3:00]
Running from: C:\Documents and Settings\Aira&Pekka\My Documents\Downloads\ComboFix.exe
Command switches used :: C:\Documents and Settings\Aira&Pekka\My Documents\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\mzda.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Aira&Pekka\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\mzda.exe
.
((((((((((((((((((((((((( Files Created from 2008-05-10 to 2008-06-10 )))))))))))))))))))))))))))))))
.
2008-06-10 17:22 . 2008-06-10 17:22 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-10 17:22 . 2008-06-10 17:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-10 17:22 . 2008-06-10 17:22 <DIR> d-------- C:\Documents and Settings\Aira&Pekka\Application Data\Malwarebytes
2008-06-10 17:22 . 2008-06-09 20:13 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-10 17:22 . 2008-06-09 20:13 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-09 21:48 . 2008-06-09 21:48 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-09 20:58 . 2008-06-09 20:58 <DIR> d-------- C:\Documents and Settings\Aira&Pekka\Application Data\MSNInstaller
2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
2008-06-03 20:34 . 2008-06-03 20:34 <DIR> d-------- C:\Documents and Settings\Aira&Pekka\Application Data\Grisoft
2008-06-03 20:29 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-06-03 20:28 . 2008-06-03 20:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-06-03 20:17 . 2008-06-03 22:58 86,548 --a------ C:\Documents and Settings\Aira&Pekka\setupa.exe
2008-06-01 20:07 . 2008-06-01 20:07 <DIR> d--h----- C:\WINDOWS\PIF
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-10 17:19 --------- d-----w C:\Documents and Settings\Aira&Pekka\Application Data\OpenOffice.org2
2008-06-09 17:55 --------- d-----w C:\Program Files\Sony
2008-05-29 17:00 --------- d-----w C:\Program Files\Creative
2008-05-29 16:52 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-20 10:17 --------- d-----w C:\Program Files\Last.fm
2008-05-04 13:47 --------- d-----w C:\Program Files\Google
2008-05-02 19:11 --------- d-----w C:\Program Files\iPod
2008-05-02 18:58 --------- d-----w C:\Program Files\Bonjour
2008-05-02 18:56 --------- d-----w C:\Program Files\Canon
2008-05-02 18:55 --------- d-----w C:\Program Files\DivX
2008-05-02 18:39 --------- d-----w C:\Program Files\Juice
2008-04-23 15:32 --------- d-----w C:\Program Files\Apple Software Update
2008-04-13 14:56 --------- d-----w C:\Program Files\QuickTime
.
------- Sigcheck -------
2008-05-28 17:28 87552 918e116feae29a433201b7a5400829ba C:\WINDOWS\system32\ws2_32.dll
2004-08-04 04:07 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\dllcache\ws2_32.dll
.
((((((((((((((((((((((((((((( snapshot@2008-06-10_15.16.21.04 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-10 12:01:02 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-10 18:35:24 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-03 05:23 102400]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 23:55 5674352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 22:00 49152]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-17 10:11 49152]
"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-27 18:41 262401]
"iTunesHelper"="C:\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:07 15360]
C:\Documents and Settings\Aira&Pekka\Start Menu\Programs\Startup\
OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe [2005-10-15 13:02:32 61440]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 16:19:24 237568]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Last.fm\\LastFM.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\iTunes\\iTunes.exe"=
S1 ensqio;ensqio;C:\WINDOWS\system32\DRIVERS\ensqio.sys []
S1 sbpcint4;SB AudioPCI 128;C:\WINDOWS\system32\DRIVERS\sbpcint4.sys []
S3 ES1370;Creative AudioPCI (ES1370), SB PCI 64/128 (WDM);C:\WINDOWS\system32\drivers\ES1370MP.sys [2001-08-17 23:19]
.
Contents of the 'Scheduled Tasks' folder
"2008-04-20 16:10:26 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-10 21:37:32
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.bin
.
**************************************************************************
.
Completion time: 2008-06-10 21:51:34 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-10 18:50:26
ComboFix2.txt 2008-06-10 13:51:57
ComboFix3.txt 2008-06-10 12:18:25
Pre-Run: 377,700,352 bytes free
Post-Run: 452,321,280 bytes free
130 --- E O F --- 2008-05-18 11:53:23
|
|
Hujo
Suspended permanently
|
10. kesäkuuta 2008 @ 22:05 |
Linkki tähän viestiin
|
Lataa TÄSTÄ VundoFix.exe työpöydällesi.
Tupla-klikkaa VundoFix.exe ajaaksesi sen.
Klikkaa Scan for Vundo valintaa.
Kun skannaus on valmis, klikkaa Fix Vundo valintaa.
Sinulta kysytään haluatko poistaa filut - klikkaa YES.
Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.
Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 10. kesäkuuta 2008 @ 22:05
|
|
sonjaa
Junior Member
|
11. kesäkuuta 2008 @ 00:30 |
Linkki tähän viestiin
|
|
Olen tässä kohta kaksi tuntia odottanut vundoa, että se poistuisi..
Siinä lukee vaan "Removing vundo..."
Eli... Pitää kai vaan venaa?
|
|
Hujo
Suspended permanently
|
11. kesäkuuta 2008 @ 01:46 |
Linkki tähän viestiin
|
fix vundo
päräytä poikki se ohjelma taitaa olla sulla vanha vundofix
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 11. kesäkuuta 2008 @ 01:50
|
|
sonjaa
Junior Member
|
11. kesäkuuta 2008 @ 01:51 |
Linkki tähän viestiin
|
|
Ei auta... Siihen tulee teksti, että se nyt sulkee Vundon, mut lukee edelleen "Removing vundo..." Enkä tiiä kauaa pitäis odottaa vielä.
Ok, suljen ikkunan...
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 11. kesäkuuta 2008 @ 01:52
|
|
Hujo
Suspended permanently
|
11. kesäkuuta 2008 @ 01:55 |
Linkki tähän viestiin
|
|
tee raaka tempu sammuta ja käynnistä kone
Voiko tietsikka koskaan toimia?
|
|
sonjaa
Junior Member
|
11. kesäkuuta 2008 @ 02:02 |
Linkki tähän viestiin
|
Käskystä.. Eli nyt tota "Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö."
Mistä saan ton vundofix lokin?
|
|
sonjaa
Junior Member
|
11. kesäkuuta 2008 @ 02:07 |
Linkki tähän viestiin
|
Oho, löysinkin sellasen.!
---
VundoFix V7.0.5
Scan started at 22:19:03 10.6.2008
Listing files found while scanning....
No infected files were found.
Beginning removal...
Beginning removal...
Beginning removal...
|
|
sonjaa
Junior Member
|
11. kesäkuuta 2008 @ 02:11 |
Linkki tähän viestiin
|
Ja tämä vielä...
Olisko jo puhdas kone?
---
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:06:15, on 11.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ig?hl=fi
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;<local>;*.local
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [iTunesHelper] "C:\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Tuki - {43D2E5C2-7C6F-4FA0-8E99-3710D39419E3} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Service - {4B8A4CEF-46CE-442D-914B-6EEDAA0B0757} - http://service.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: SMS - {51AEE4AD-ED6C-477D-986F-BA295C34AE49} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: SMS-viesti - {87AC75E3-B87C-41A0-9944-DE3843486312} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Support - {9A8D9E17-C866-4C12-A4A3-96B579D0CEA8} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Palvelut - {FB431587-8135-49D9-8BBD-446412BB777F} - http://service.kolumbus.fi/ (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
--
End of file - 6576 bytes
|
|
Hujo
Suspended permanently
|
11. kesäkuuta 2008 @ 02:18 |
Linkki tähän viestiin
|
Javan päivitys ja välimuistin tyhjennys:
1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
Niissä pitäisi olla seuraava kuva vieressä: 
3. Valitse kaikki entiset Java versiosi ja valitse Poista.
4. Asenna uusin Java päivitys seuraavasta linkistä..
5. Käynnistä kone uudelleen asennuksen jälkeen:
http://java.sun.com/javase/downloads/index.jsp
Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u6
Paina Download
Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.
6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).
7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.
(Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).
8. Varmista että kaikki kaksi valintaa ovat rastitettuja:
*Applications and Applets
*Trace and Log Files
Ja paina OK -nappia
9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.
10. Klikkaa OK jättääksesi Java asetusikkunasi.
=============
scannaa vielä uusi combofix loki ja Malwarebytes' Anti-Malware loki
Voiko tietsikka koskaan toimia?
|
|
sonjaa
Junior Member
|
11. kesäkuuta 2008 @ 02:27 |
Linkki tähän viestiin
|
|
Selvä, poistanko myös kaikki Java(TM) Updatet, mitkä sieltä löytyy? Niissä on kyl sitte vähä erilainen kuva Javasta, kun mitä mainitsit...
|
|
Hujo
Suspended permanently
|
11. kesäkuuta 2008 @ 02:30 |
Linkki tähän viestiin
|
Luo poistolista:
? Avaa HiJackThis
? Klikkaa "Configure" valintaa oikealla alhaalla
? Klikkaa "Misc Tools"
? Klikkaa boxia joka sanoo "Uninstall Manager"
? Klikkaa valintaa "Save list"
? Kopioi ja liitä kyseinen lista muistiosta postiisi
Voiko tietsikka koskaan toimia?
|
|
sonjaa
Junior Member
|
11. kesäkuuta 2008 @ 02:34 |
Linkki tähän viestiin
|
Noniin..
--
123 Free Solitaire
Adobe Acrobat 5.0
Adobe Flash Player 9 ActiveX
Adobe Reader 8.1.0 - Suomi
Apple Mobile Device Support -tuki
Apple Software Update
ArcSoft Panorama Maker 3.5
ArcSoft PhotoStudio 5.5
AVG Anti-Spyware 7.5
Avira AntiVir Personal ? Free Antivirus
Bonjour
Canon MP Navigator 2.0
Canon MP150
Creative MediaSource
Creative MuVo V200
Creative System Information
HijackThis 2.0.2
HP Image Zone 3.5
HP Photosmart -kamerat 3.5
HP Software Update
iTunes
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Java(TM) SE Runtime Environment 6 Update 1
Last.fm 1.5.0.24910
LimeWire 4.16.6
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Finnish Language Pack
Microsoft .NET Framework 1.1 Hotfix (KB928366)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
Music Manager
MuVo Driver
OmniPage SE 2.0
OpenOffice.org 2.0
QuickTime
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925454)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928090)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931768)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933566)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944338)
Security Update for Windows XP (KB944533)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB947864)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
Update for Windows XP (KB946627)
Windows Installer 3.1 (KB893803)
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Format Runtime
Windows Media Player 10
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinRAR archiver
Yahoo! Toolbar
|
|
Hujo
Suspended permanently
|
11. kesäkuuta 2008 @ 02:42 |
Linkki tähän viestiin
|
Voiko tietsikka koskaan toimia?
|
|
Mainos
|
|
|
|
sonjaa
Junior Member
|
11. kesäkuuta 2008 @ 04:00 |
Linkki tähän viestiin
|
Tällästä... Ja nyt skannaan viel Malwarella, millä kestää varmaan taas se pari tuntia...
---
ComboFix 08-06-09.7 - Aira&Pekka 2008-06-11 3:34:06.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.373 [GMT 3:00]
Running from: C:\Documents and Settings\Aira&Pekka\My Documents\Downloads\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-05-11 to 2008-06-11 )))))))))))))))))))))))))))))))
.
2008-06-11 03:21 . 2008-06-11 03:21 <DIR> d-------- C:\Program Files\Sun
2008-06-11 03:21 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-06-11 03:14 . 2008-06-11 03:14 <DIR> d-------- C:\Program Files\Common Files\Java
2008-06-10 22:19 . 2008-06-10 22:19 <DIR> d-------- C:\VundoFix Backups
2008-06-10 17:22 . 2008-06-10 17:22 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-10 17:22 . 2008-06-10 17:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-10 17:22 . 2008-06-10 17:22 <DIR> d-------- C:\Documents and Settings\Aira&Pekka\Application Data\Malwarebytes
2008-06-10 17:22 . 2008-06-09 20:13 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-10 17:22 . 2008-06-09 20:13 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-09 21:48 . 2008-06-09 21:48 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-09 20:58 . 2008-06-09 20:58 <DIR> d-------- C:\Documents and Settings\Aira&Pekka\Application Data\MSNInstaller
2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
2008-06-03 20:34 . 2008-06-03 20:34 <DIR> d-------- C:\Documents and Settings\Aira&Pekka\Application Data\Grisoft
2008-06-03 20:29 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-06-03 20:28 . 2008-06-03 20:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-06-03 20:17 . 2008-06-03 22:58 86,548 --a------ C:\Documents and Settings\Aira&Pekka\setupa.exe
2008-06-01 20:07 . 2008-06-01 20:07 <DIR> d--h----- C:\WINDOWS\PIF
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-11 00:27 --------- d-----w C:\Documents and Settings\Aira&Pekka\Application Data\OpenOffice.org2
2008-06-11 00:21 --------- d-----w C:\Program Files\Java
2008-06-09 17:55 --------- d-----w C:\Program Files\Sony
2008-05-29 17:00 --------- d-----w C:\Program Files\Creative
2008-05-29 16:52 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-20 10:17 --------- d-----w C:\Program Files\Last.fm
2008-05-04 13:47 --------- d-----w C:\Program Files\Google
2008-05-02 19:11 --------- d-----w C:\Program Files\iPod
2008-05-02 18:58 --------- d-----w C:\Program Files\Bonjour
2008-05-02 18:56 --------- d-----w C:\Program Files\Canon
2008-05-02 18:55 --------- d-----w C:\Program Files\DivX
2008-05-02 18:39 --------- d-----w C:\Program Files\Juice
2008-04-23 15:32 --------- d-----w C:\Program Files\Apple Software Update
2008-04-13 14:56 --------- d-----w C:\Program Files\QuickTime
.
------- Sigcheck -------
2008-05-28 17:28 87552 918e116feae29a433201b7a5400829ba C:\WINDOWS\system32\ws2_32.dll
2004-08-04 04:07 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\dllcache\ws2_32.dll
.
((((((((((((((((((((((((((((( snapshot@2008-06-10_15.16.21.04 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-10 12:01:02 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-11 00:42:13 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2007-09-24 19:30:28 135,168 -c--a-w C:\WINDOWS\system32\java.exe
+ 2008-03-24 22:28:39 135,168 ----a-w C:\WINDOWS\system32\java.exe
- 2007-09-24 19:30:30 135,168 -c--a-w C:\WINDOWS\system32\javaw.exe
+ 2008-03-24 22:28:43 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
- 2007-09-24 20:31:42 139,264 -c--a-w C:\WINDOWS\system32\javaws.exe
+ 2008-03-24 23:37:01 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-03 05:23 102400]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 23:55 5674352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 22:00 49152]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-17 10:11 49152]
"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-27 18:41 262401]
"iTunesHelper"="C:\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:07 15360]
C:\Documents and Settings\Aira&Pekka\Start Menu\Programs\Startup\
OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe [2005-10-15 13:02:32 61440]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 16:19:24 237568]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Last.fm\\LastFM.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\iTunes\\iTunes.exe"=
S1 ensqio;ensqio;C:\WINDOWS\system32\DRIVERS\ensqio.sys []
S1 sbpcint4;SB AudioPCI 128;C:\WINDOWS\system32\DRIVERS\sbpcint4.sys []
S3 ES1370;Creative AudioPCI (ES1370), SB PCI 64/128 (WDM);C:\WINDOWS\system32\drivers\ES1370MP.sys [2001-08-17 23:19]
.
Contents of the 'Scheduled Tasks' folder
"2008-04-20 16:10:26 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-11 03:44:08
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.bin
.
**************************************************************************
.
Completion time: 2008-06-11 3:58:24 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-11 00:57:15
ComboFix2.txt 2008-06-10 18:51:36
ComboFix3.txt 2008-06-10 13:51:57
ComboFix4.txt 2008-06-10 12:18:25
Pre-Run: 405,786,624 bytes free
Post-Run: 554,422,272 bytes free
134 --- E O F --- 2008-05-18 11:53:23
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 11. kesäkuuta 2008 @ 04:02
|
