|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
Messenger virus [HJT-logi]
|
|
|
Zanteri
Suspended due to non-functional email address
|
10. kesäkuuta 2008 @ 22:08 |
Linkki tähän viestiin
|
Siskon kone on ihan tukossa ja virus ilmoituksia pompii koko ajan. Piti tulla kirjoittamaan viesti omalle koneelle. Apua tarvitaan !
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:49:46, on 10.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\DT 4.0.3\daemon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\Winamp 5.51\winampa.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\winudmr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\GUARDGUI.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O3 - Toolbar: Alcohol Soft - Alcohol 120% Toolbar - {1CE4EE89-2D5C-4361-AF3B-D902AB545381} - C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\Alcohol 120%\a120_tb.dll (file missing)
O3 - Toolbar: Burn4Free Toolbar - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - C:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
O4 - HKLM\..\Run: [LXCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\DT 4.0.3\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Globe7] "C:\Documents and Settings\Zanteri\Työpöytä\Globe\Globe7.exe" /hide
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\Winamp 5.51\winampa.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
O4 - HKLM\..\Run: [Windows svchost] ups.exe
O4 - HKLM\..\Run: [Windows UDP Control Center] winudpmgr.exe
O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe
O4 - HKLM\..\Run: [BM433a51e6] Rundll32.exe "C:\WINDOWS\system32\djjineha.dll",s
O4 - HKLM\..\Run: [4009627a] rundll32.exe "C:\WINDOWS\system32\dbuluufj.dll",b
O4 - HKLM\..\RunServices: [Windows Update System Shell] svhostcs32.exe
O4 - HKLM\..\RunServices: [MSN PLUS XP] wspad.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Steam] "c:\progra~1\steam\steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download all links using BitComet - res://C:\Documents and Settings\Zanteri\Työpöytä\Uusi kansio\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Documents and Settings\Zanteri\Työpöytä\Uusi kansio\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Documents and Settings\Zanteri\Työpöytä\Uusi kansio\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Ebates. - file://C:\Program Files\EbatesMoeMoneyMaker4\ebatessmmm\ebatestmmm\ebmmC0.htm
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O9 - Extra button: Ebates - {F2B441CC-E026-47fb-BDC3-A07750FA3D2C} - file://C:\Program Files\EbatesMoeMoneyMaker4\ebatessmmm\ebatestmmm\ebmmC0.htm (HKCU)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdat...b?1123097197498
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxcg_device - - C:\WINDOWS\system32\lxcgcoms.exe
--
End of file - 8640 bytes
|
|
Hujo
Suspended permanently
|
11. kesäkuuta 2008 @ 00:32 |
Linkki tähän viestiin
|
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Voiko tietsikka koskaan toimia?
|
|
Zanteri
Suspended due to non-functional email address
|
11. kesäkuuta 2008 @ 16:13 |
Linkki tähän viestiin
|
combofix logi
ComboFix 08-06-10.3 - Zanteri 2008-06-11 15:50:11.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.200 [GMT 3:00]
Running from: C:\Documents and Settings\Zanteri\Työpöytä\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\BM433a51e6.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\service.exe
C:\WINDOWS\system32\abrrrpsv.dll
C:\WINDOWS\system32\bipwhvug.ini
C:\WINDOWS\system32\byXOggdd.dll
C:\WINDOWS\system32\cbXPfFwT.dll
C:\WINDOWS\system32\cbXQigff.dll
C:\WINDOWS\system32\cbXQjheb.dll
C:\WINDOWS\system32\cgvebxvo.ini
C:\WINDOWS\system32\cstygmps.dll
C:\WINDOWS\system32\dbuluufj.dll
C:\WINDOWS\system32\ddcAtQif.dll
C:\WINDOWS\system32\ddcbxwvw.dll
C:\WINDOWS\system32\djjineha.dll
C:\WINDOWS\system32\dtsfucuf.dll
C:\WINDOWS\system32\fbeyboeb.ini
C:\WINDOWS\system32\fccaWNdB.dll
C:\WINDOWS\system32\fccbAPiF.dll
C:\WINDOWS\system32\geBtUoml.dll
C:\WINDOWS\system32\gxbjwojb.ini
C:\WINDOWS\system32\gyyciebf.ini
C:\WINDOWS\system32\hgGayxYO.dll
C:\WINDOWS\system32\hmdhdwwu.dll
C:\WINDOWS\system32\install.exe
C:\WINDOWS\system32\jfuulubd.ini
C:\WINDOWS\system32\jnbmevdf.dll
C:\WINDOWS\system32\khfGyYoo.dll
C:\WINDOWS\system32\ljJDWOgf.dll
C:\WINDOWS\system32\lxbbljox.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mlJCTLfg.dll
C:\WINDOWS\system32\mlJDSmkj.dll
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\nodcsnjw.ini
C:\WINDOWS\system32\nyxvppbl.ini
C:\WINDOWS\system32\ooYyGfhk.ini
C:\WINDOWS\system32\ooYyGfhk.ini2
C:\WINDOWS\system32\qoMeCttu.dll
C:\WINDOWS\system32\rkqfrhbb.ini
C:\WINDOWS\system32\tuvUMfef.dll
C:\WINDOWS\system32\tuvWpQhE.dll
C:\WINDOWS\system32\urqPgeDS.dll
C:\WINDOWS\system32\urqRIaYr.dll
C:\WINDOWS\system32\urqRKDtQ.dll
C:\WINDOWS\system32\xctvwvym.ini
C:\WINDOWS\system32\xxyvuSJa.dll
C:\WINDOWS\system32\yayaAqrS.dll
C:\WINDOWS\system32\yayvVOeb.dll
C:\WINDOWS\ups.exe
.
((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-05-11 to 2008-06-11 )))))))))))))))))
.
2008-06-10 22:12 . 2008-06-11 15:59 2,232 --a------ C:\is155815.exe
2008-06-10 22:09 . 2008-06-10 22:24 115,215 --a------ C:\sexy.exe
2008-06-10 21:46 . 2008-06-10 21:46 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-06-09 23:34 . 2008-06-10 10:38 2,232 --a------ C:\mzda.exe
2008-06-09 23:10 . 2008-06-09 23:10 33,792 --a------ C:\WINDOWS\system32\vtUMEurO.VIR
2008-06-09 00:20 . 2008-06-09 17:31 29,342 --a------ C:\Documents and Settings\Zanteri\ps.exe
2008-06-08 23:57 . 2008-06-09 23:19 29,342 -r-hs---- C:\WINDOWS\winudmr.exe
2008-06-08 23:57 . 2008-06-09 23:19 29,342 --a------ C:\ps.exe
2008-06-08 22:21 . 2008-06-08 22:21 18,587 --a------ C:\Documents and Settings\Zanteri\packed.exe
2008-06-08 22:19 . 2008-06-08 22:19 18,587 --a------ C:\packed.exe
2008-06-08 11:27 . 2008-06-08 20:47 2,231 --a------ C:\is154890.exe
2008-06-06 15:03 . 2008-06-06 15:55 49,156 --a------ C:\Documents and Settings\Zanteri\sz.exe
2008-06-06 13:46 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Zanteri\sex2.exe
2008-06-06 13:24 . 2008-06-06 14:48 2,232 --a------ C:\sex2.exe
2008-06-06 13:18 . 2008-06-06 13:18 116,736 --a------ C:\WINDOWS\system32\wjnscdon.dll
2008-06-06 11:49 . 2008-06-06 11:49 2,232 --a------ C:\fs.exe
2008-06-06 11:49 . 2008-06-06 13:12 2,232 --a------ C:\f.exe
2008-06-04 23:47 . 2008-06-04 23:47 252,928 --a------ C:\Documents and Settings\Zanteri\Application Data\installer_fi[1].exe
2008-06-04 19:05 . 2008-06-04 19:05 3,424 --a------ C:\is155400.exe
2008-06-03 21:22 . 2008-06-03 21:22 86,548 --a------ C:\Documents and Settings\Zanteri\setupa.exe
2008-06-03 18:12 . 2008-06-04 11:44 3,423 --a------ C:\WINDOWS\is154890.exe
2008-06-03 16:26 . 2008-06-03 16:26 57,344 --a------ C:\WINDOWS\system32\awtqnkhe.dll
2008-06-02 22:33 . 2008-06-03 16:07 96,950 --a------ C:\Documents and Settings\Zanteri\setup.exe
2008-06-01 19:46 . 2008-06-01 20:46 86,502 --a------ C:\sexy.com
2008-06-01 14:06 . 2008-06-01 07:54 294 --ahs---- C:\WINDOWS\system32\oyyfluir.ini
2008-06-01 07:53 . 2008-06-01 07:54 1,486,158 --ahs---- C:\WINDOWS\system32\oyyfluir.tmp
2008-05-31 18:53 . 2008-05-31 18:53 86,512 --a------ C:\Documents and Settings\Zanteri\setup1.exe
2008-05-11 19:50 . 2008-05-11 19:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-11 19:50 . 2008-05-11 19:50 1,409 --a------ C:\WINDOWS\QTFont.for
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2080-04-16 09:43 --------- d-----w C:\Program Files\Lx_cats
2080-04-12 14:07 --------- d-----w C:\Program Files\MSN Messenger
2008-06-11 12:59 --------- d-----w C:\Program Files\Steam
2008-06-06 10:20 --------- d-----w C:\Documents and Settings\Zanteri\Application Data\OpenOffice.org2
2008-05-07 13:03 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-07 12:51 --------- d-----w C:\Program Files\Windows Live
2008-05-07 12:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-06-13 13:22 115,215 --sh--r C:\WINDOWS\system32\svho.exe
.
(((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-03-01 19:43 90112]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-09-04 23:40 6856704]
"Steam"="c:\progra~1\steam\steam.exe" [2008-03-28 15:15 1271032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LXCGCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll" [2005-07-20 20:48 73728]
"DAEMON Tools"="C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\DT 4.0.3\daemon.exe" [ ]
"Globe7"="C:\Documents and Settings\Zanteri\Työpöytä\Globe\Globe7.exe" [ ]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-09-23 23:13 155648]
"WinampAgent"="C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\Winamp 5.51\winampa.exe" [ ]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-05-08 18:11 262401]
"Windows UDP Control"="winudspm.exe" []
"Windows svchost"="ups.exe" [2004-09-15 02:12 18432 C:\WINDOWS\system32\ups.exe]
"Windows Controls Center"="winudmr.exe" [2008-06-09 23:19 29342 C:\WINDOWS\winudmr.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Windows Update System Shell"="svhostcs32.exe" []
"MSN PLUS XP"="wspad.exe" []
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 02:12 15360]
"Windows Update System Shell"="svhostcs32.exe" []
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALi5289]
--------- 2005-02-02 15:36 405504 C:\Program Files\ULI5289\ALi5289.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
--a------ 2005-08-12 15:43 45056 C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2004-11-30 21:10 344064 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CnxTrApp]
-ra------ 2003-07-18 09:32 247296 C:\Program Files\TeleWell\ADSL USB Router\CnxTrApp.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDonkey2000]
C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\Edonkey\edonkey2000.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
--a------ 2005-08-01 15:05 94208 C:\Program Files\Lexmark 2300 Series\ezprint.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
--a------ 2005-07-12 16:36 299008 C:\Program Files\Lexmark Fax Solutions\fm3032.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Program Files\Ahead\InCD\InCD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
--a------ 2005-03-24 02:26 217088 C:\Program Files\Microsoft IntelliPoint\point32.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\QuickTime 7\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcgmon.exe]
--a------ 2005-07-21 09:07 200704 C:\Program Files\Lexmark 2300 Series\lxcgmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-09-04 23:40 6856704 C:\Program Files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-09-23 23:13 155648 C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Repair Registry Pro]
C:\Program Files\Repair Registry Pro\RepairRegistryPro.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2005-11-10 14:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2004-12-20 21:41 33792 C:\Program Files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\javaw.exe"=
"C:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe"=
"C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"=
"C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"C:\\Program Files\\Steam\\Steam.exe"=
"C:\\Program Files\\Steam\\SteamApps\\zanteri_\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis SP Demo\\Bin32\\Crysis.exe"=
"C:\\Program Files\\Steam\\SteamApps\\zanteri\\source dedicated server\\srcds.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Steam\\SteamApps\\zanteri\\counter-strike source\\hl2.exe"=
"C:\\WINDOWS\\system32\\svho.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"17396:TCP"= 17396:TCP:BitComet 17396 TCP
"17396:UDP"= 17396:UDP:BitComet 17396 UDP
R0 m5289;m5289;C:\WINDOWS\system32\DRIVERS\m5289.sys [2004-12-01 10:49]
R0 uliagpkx;ULi AGP Bus Filter Driver;C:\WINDOWS\system32\DRIVERS\agpkx.sys [2004-07-08 15:58]
S3 ip100xp;IC Plus IP100 10/100 Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\ipfnd51.sys [2004-08-04 23:04]
S3 oflpydin;oflpydin;C:\DOCUME~1\Zanteri\LOCALS~1\Temp\oflpydin.sys []
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-11 15:59:06
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Steam\steam.exe
.
**************************************************************************
.
Completion time: 2008-06-11 16:07:46 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-11 13:07:41
Pre-Run: 14,709,231,616 tavua vapaana
Post-Run: 15,520,571,392 tavua vapaana
221 --- E O F --- 2008-05-28 11:00:05
|
|
Hujo
Suspended permanently
|
11. kesäkuuta 2008 @ 16:33 |
Linkki tähän viestiin
|
Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
Lainaus:
File::
C:\WINDOWS\winudmr.exe
C:\WINDOWS\system32\djjineha.dll
C:\WINDOWS\system32\dbuluufj.dll
C:\is155815.exe
C:\sexy.exe
C:\mzda.exe
C:\Documents and Settings\Zanteri\ps.exe
C:\WINDOWS\winudmr.exe
C:\ps.exe
C:\is154890.exe
C:\Documents and Settings\Zanteri\sz.exe
C:\Documents and Settings\Zanteri\sex2.exe
C:\sex2.exe
C:\fs.exe
C:\f.exe
C:\is155400.exe
C:\Documents and Settings\Zanteri\setupa.exe
C:\WINDOWS\is154890.exe
C:\sexy.com
C:\WINDOWS\ups.exe
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
==============
scannaa hjt:llä merkkaa paina Fix checked
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - (no file)
O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
O4 - HKLM\..\Run: [Windows svchost] ups.exe
O4 - HKLM\..\Run: [Windows UDP Control Center] winudpmgr.exe
O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe
O4 - HKLM\..\Run: [BM433a51e6] Rundll32.exe "C:\WINDOWS\system32\djjineha.dll",s
O4 - HKLM\..\Run: [4009627a] rundll32.exe "C:\WINDOWS\system32\dbuluufj.dll",b
O4 - HKLM\..\RunServices: [Windows Update System Shell] svhostcs32.exe
Voiko tietsikka koskaan toimia?
|
|
Zanteri
Suspended due to non-functional email address
|
11. kesäkuuta 2008 @ 17:29 |
Linkki tähän viestiin
|
Uusin ComboFix ja Hjt logi
ComboFix 08-06-10.3 - Zanteri 2008-06-11 16:58:12.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.185 [GMT 3:00]
Running from: C:\Documents and Settings\Zanteri\Työpöytä\ComboFix.exe
Command switches used :: C:\Documents and Settings\Zanteri\Työpöytä\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\Documents and Settings\Zanteri\ps.exe
C:\Documents and Settings\Zanteri\setupa.exe
C:\Documents and Settings\Zanteri\sex2.exe
C:\Documents and Settings\Zanteri\sz.exe
C:\f.exe
C:\fs.exe
C:\is154890.exe
C:\is155400.exe
C:\is155815.exe
C:\mzda.exe
C:\ps.exe
C:\sex2.exe
C:\sexy.com
C:\sexy.exe
C:\WINDOWS\is154890.exe
C:\WINDOWS\system32\dbuluufj.dll
C:\WINDOWS\system32\djjineha.dll
C:\WINDOWS\ups.exe
C:\WINDOWS\winudmr.exe
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Zanteri\ps.exe
C:\Documents and Settings\Zanteri\setupa.exe
C:\Documents and Settings\Zanteri\sex2.exe
C:\Documents and Settings\Zanteri\sz.exe
C:\f.exe
C:\fs.exe
C:\is154890.exe
C:\is155400.exe
C:\is155815.exe
C:\mzda.exe
C:\ps.exe
C:\sex2.exe
C:\sexy.com
C:\sexy.exe
C:\WINDOWS\BM433a51e6.xml
C:\WINDOWS\is154890.exe
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\llpdqyhg.dll
C:\WINDOWS\system32\pmnoLdDu.dll
C:\WINDOWS\system32\tgggelhm.dll
C:\WINDOWS\system32\urqQjhEx.dll
C:\WINDOWS\system32\xEhjQqru.ini
C:\WINDOWS\system32\xEhjQqru.ini2
C:\WINDOWS\winudmr.exe
.
((((( Tiedostot, jotka on luotu seuraavalla aikav?lill?: 2008-05-11 to 2008-06-11 )))))))))))))))))
.
2008-06-11 16:07 . 2008-06-11 16:07 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja
2008-06-11 16:07 . <KANSIO> C:\Documents and Settings\Jõrjestelmõnvalvoja\Local Settings
2008-06-11 16:07 . <KANSIO> C:\Documents and Settings\Jõrjestelmõnvalvoja\Local Settings
2008-06-10 21:46 . 2008-06-10 21:46 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-06-09 23:10 . 2008-06-09 23:10 33,792 --a------ C:\WINDOWS\system32\vtUMEurO.VIR
2008-06-08 22:21 . 2008-06-08 22:21 18,587 --a------ C:\Documents and Settings\Zanteri\packed.exe
2008-06-08 22:19 . 2008-06-08 22:19 18,587 --a------ C:\packed.exe
2008-06-06 13:18 . 2008-06-06 13:18 116,736 --a------ C:\WINDOWS\system32\wjnscdon.dll
2008-06-04 23:47 . 2008-06-04 23:47 252,928 --a------ C:\Documents and Settings\Zanteri\Application Data\installer_fi[1].exe
2008-06-03 16:26 . 2008-06-03 16:26 57,344 --a------ C:\WINDOWS\system32\awtqnkhe.dll
2008-06-02 22:33 . 2008-06-03 16:07 96,950 --a------ C:\Documents and Settings\Zanteri\setup.exe
2008-06-01 14:06 . 2008-06-01 07:54 294 --ahs---- C:\WINDOWS\system32\oyyfluir.ini
2008-06-01 07:53 . 2008-06-01 07:54 1,486,158 --ahs---- C:\WINDOWS\system32\oyyfluir.tmp
2008-05-31 18:53 . 2008-05-31 18:53 86,512 --a------ C:\Documents and Settings\Zanteri\setup1.exe
2008-05-11 19:50 . 2008-05-11 19:50 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-11 19:50 . 2008-05-11 19:50 1,409 --a------ C:\WINDOWS\QTFont.for
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2080-04-16 09:43 --------- d-----w C:\Program Files\Lx_cats
2080-04-12 14:07 --------- d-----w C:\Program Files\MSN Messenger
2008-06-11 14:04 --------- d-----w C:\Program Files\Steam
2008-06-06 10:20 --------- d-----w C:\Documents and Settings\Zanteri\Application Data\OpenOffice.org2
2008-05-07 13:03 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-07 12:51 --------- d-----w C:\Program Files\Windows Live
2008-05-07 12:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-06-13 13:22 115,215 --sh--r C:\WINDOWS\system32\svho.exe
.
((((((((((((((((((((((((((((( snapshot@2008-06-11_16.07.25.15 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-11 12:58:20 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-11 14:03:26 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
(((((((((((((((((((((((((((((( Rekisterin k?ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji? arvoja ja laillisia oletusarvoja ei n?ytet?
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-03-01 19:43 90112]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-09-04 23:40 6856704]
"Steam"="c:\progra~1\steam\steam.exe" [2008-03-28 15:15 1271032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LXCGCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll" [2005-07-20 20:48 73728]
"DAEMON Tools"="C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\DT 4.0.3\daemon.exe" [ ]
"Globe7"="C:\Documents and Settings\Zanteri\Työpöytä\Globe\Globe7.exe" [ ]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-09-23 23:13 155648]
"WinampAgent"="C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\Winamp 5.51\winampa.exe" [ ]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-05-08 18:11 262401]
"Windows UDP Control"="winudspm.exe" []
"Windows svchost"="ups.exe" [2004-09-15 02:12 18432 C:\WINDOWS\system32\ups.exe]
"Windows Controls Center"="winudmr.exe" []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Windows Update System Shell"="svhostcs32.exe" []
"MSN PLUS XP"="wspad.exe" []
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 02:12 15360]
"Windows Update System Shell"="svhostcs32.exe" []
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{C5B8495C-20BC-493C-8613-E4F6E5790B88}"= C:\WINDOWS\system32\pmnoLdDu.dll [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ALi5289]
--------- 2005-02-02 15:36 405504 C:\Program Files\ULI5289\ALi5289.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
--a------ 2005-08-12 15:43 45056 C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2004-11-30 21:10 344064 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CnxTrApp]
-ra------ 2003-07-18 09:32 247296 C:\Program Files\TeleWell\ADSL USB Router\CnxTrApp.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eDonkey2000]
C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\Edonkey\edonkey2000.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]
--a------ 2005-08-01 15:05 94208 C:\Program Files\Lexmark 2300 Series\ezprint.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FaxCenterServer]
--a------ 2005-07-12 16:36 299008 C:\Program Files\Lexmark Fax Solutions\fm3032.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Program Files\Ahead\InCD\InCD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
--a------ 2005-03-24 02:26 217088 C:\Program Files\Microsoft IntelliPoint\point32.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\QuickTime 7\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lxcgmon.exe]
--a------ 2005-07-21 09:07 200704 C:\Program Files\Lexmark 2300 Series\lxcgmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-09-04 23:40 6856704 C:\Program Files\MSN Messenger\msnmsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-09-23 23:13 155648 C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Repair Registry Pro]
C:\Program Files\Repair Registry Pro\RepairRegistryPro.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2005-11-10 14:03 36975 C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2004-12-20 21:41 33792 C:\Program Files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\javaw.exe"=
"C:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe"=
"C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"=
"C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"C:\\Program Files\\Steam\\Steam.exe"=
"C:\\Program Files\\Steam\\SteamApps\\zanteri_\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis SP Demo\\Bin32\\Crysis.exe"=
"C:\\Program Files\\Steam\\SteamApps\\zanteri\\source dedicated server\\srcds.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Steam\\SteamApps\\zanteri\\counter-strike source\\hl2.exe"=
"C:\\WINDOWS\\system32\\svho.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"17396:TCP"= 17396:TCP:BitComet 17396 TCP
"17396:UDP"= 17396:UDP:BitComet 17396 UDP
R0 m5289;m5289;C:\WINDOWS\system32\DRIVERS\m5289.sys [2004-12-01 10:49]
R0 uliagpkx;ULi AGP Bus Filter Driver;C:\WINDOWS\system32\DRIVERS\agpkx.sys [2004-07-08 15:58]
S3 ip100xp;IC Plus IP100 10/100 Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\ipfnd51.sys [2004-08-04 23:04]
S3 oflpydin;oflpydin;C:\DOCUME~1\Zanteri\LOCALS~1\Temp\oflpydin.sys []
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-11 17:04:11
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> ?:\WINDOWS\System32\CSCDLL.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Steam\steam.exe
.
**************************************************************************
.
Completion time: 2008-06-11 17:11:33 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-11 14:11:27
ComboFix2.txt 2008-06-11 13:07:47
Pre-Run: 15,669,731,328 tavua vapaana
Post-Run: 15,649,845,248 tavua vapaana
214 --- E O F --- 2008-05-28 11:00:05
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:24:12, on 11.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\DT 4.0.3\daemon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\Winamp 5.51\winampa.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\progra~1\steam\steam.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Burn4Free Toolbar Helper - {60BF5EE3-0105-4858-AD98-17C19F86B042} - C:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O3 - Toolbar: Alcohol Soft - Alcohol 120% Toolbar - {1CE4EE89-2D5C-4361-AF3B-D902AB545381} - C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\Alcohol 120%\a120_tb.dll (file missing)
O3 - Toolbar: Burn4Free Toolbar - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - C:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
O4 - HKLM\..\Run: [LXCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\DT 4.0.3\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Globe7] "C:\Documents and Settings\Zanteri\Työpöytä\Globe\Globe7.exe" /hide
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] "C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\Winamp 5.51\winampa.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunServices: [MSN PLUS XP] wspad.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Steam] "c:\progra~1\steam\steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download all links using BitComet - res://C:\Documents and Settings\Zanteri\Työpöytä\Uusi kansio\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Documents and Settings\Zanteri\Työpöytä\Uusi kansio\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Documents and Settings\Zanteri\Työpöytä\Uusi kansio\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Ebates. - file://C:\Program Files\EbatesMoeMoneyMaker4\ebatessmmm\ebatestmmm\ebmmC0.htm
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O9 - Extra button: Ebates - {F2B441CC-E026-47fb-BDC3-A07750FA3D2C} - file://C:\Program Files\EbatesMoeMoneyMaker4\ebatessmmm\ebatestmmm\ebmmC0.htm (HKCU)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdat...b?1123097197498
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxcg_device - - C:\WINDOWS\system32\lxcgcoms.exe
--
End of file - 8530 bytes
|
|
Hujo
Suspended permanently
|
11. kesäkuuta 2008 @ 17:39 |
Linkki tähän viestiin
|
scannaa hjt:llä merkkaa paina Fix checked
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O3 - Toolbar: Alcohol Soft - Alcohol 120% Toolbar - {1CE4EE89-2D5C-4361-AF3B-D902AB545381} - C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\Alcohol 120%\a120_tb.dll (file missing)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\RunServices: [MSN PLUS XP] wspad.exe
==============
Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.
Käynnistä koneesi vikasietotilaan:
sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä
Jossakin koneissa hakataan F8:sin sijasta F5:tä
" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
Voiko tietsikka koskaan toimia?
|
|
Zanteri
Suspended due to non-functional email address
|
11. kesäkuuta 2008 @ 18:45 |
Linkki tähän viestiin
|
Report.txt ja hjt logi. Toimii jo paljon paremmin :)
SDFix: Version 1.191
Run by Zanteri on ke 11.06.2008 at 18:14
Microsoft Windows XP [versio 5.1.2600]
Running From: C:\DOCUME~1\Zanteri\TYPYT~1\SDFix\SDFix
Checking Services :
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting
Checking Files :
Trojan Files Found:
C:\TIMESTMP.TMP - Deleted
C:\WINDOWS\system32\svho.exe - Deleted
Removing Temp Files
ADS Check :
Final Check :
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-11 18:31:28
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s0"=dword:db7c673a
"s1"=dword:353be2fb
"s2"=dword:9f3aa2ef
"h0"=dword:00000002
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:4e,e7,75,45,94,ba,47,7a,e4,92,86,39,02,8b,ee,aa,f5,ec,fc,9b,e1,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\DT 4.0.3\"
"h0"=dword:00000001
"khjeh"=hex:62,af,97,2f,f8,da,92,98,ce,26,97,7f,3b,80,18,1a,a3,42,b9,55,b8,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,e0,18,63,e2,21,08,be,b1,c8,64,52,90,34,86,84,d5,76,..
"khjeh"=hex:21,9b,0b,57,19,8f,6e,6e,96,57,e4,d5,50,41,92,11,3f,31,dc,50,84,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:6a,53,6c,18,f1,07,5a,f5,b6,8b,60,be,67,58,31,e6,1d,75,1c,44,24,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:3e,ab,85,36,08,1c,92,8b,be,7f,7e,4b,ce,42,56,61,bb,0b,81,d0,07,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:7d,76,48,4e,e7,a8,2e,dd,6d,73,b3,65,97,ff,28,dc,3d,43,bb,66,8e,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:c9,73,2b,3a,3a,b1,2c,4c,e1,7c,48,de,ee,3f,30,f1,f6,96,ad,69,50,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:4e,e7,75,45,94,ba,47,7a,e4,92,86,39,02,8b,ee,aa,f5,ec,fc,9b,e1,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\DT 4.0.3\"
"h0"=dword:00000001
"khjeh"=hex:62,af,97,2f,f8,da,92,98,ce,26,97,7f,3b,80,18,1a,a3,42,b9,55,b8,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,e0,18,63,e2,21,08,be,b1,c8,64,52,90,34,86,84,d5,76,..
"khjeh"=hex:21,9b,0b,57,19,8f,6e,6e,96,57,e4,d5,50,41,92,11,3f,31,dc,50,84,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:6a,53,6c,18,f1,07,5a,f5,b6,8b,60,be,67,58,31,e6,1d,75,1c,44,24,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:3e,ab,85,36,08,1c,92,8b,be,7f,7e,4b,ce,42,56,61,bb,0b,81,d0,07,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:7d,76,48,4e,e7,a8,2e,dd,6d,73,b3,65,97,ff,28,dc,3d,43,bb,66,8e,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:c9,73,2b,3a,3a,b1,2c,4c,e1,7c,48,de,ee,3f,30,f1,f6,96,ad,69,50,..
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services :
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\\Program Files\\Internet Explorer\\iexplore.exe"="C:\\Program Files\\Internet Explorer\\iexplore.exe:*:Enabled:Internet Explorer"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\WINDOWS\\system32\\javaw.exe"="C:\\WINDOWS\\system32\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"C:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\javaw.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe"="C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpctr.exe:*:Enabled:Et„tuki - Windows Messenger ja „„niyhteys"
"C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"="C:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe:*:Enabled:Nero Home"
"C:\\Program Files\\Steam\\Steam.exe"="C:\\Program Files\\Steam\\Steam.exe:*:Enabled:Steam"
"C:\\Program Files\\Steam\\SteamApps\\zanteri_\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\SteamApps\\zanteri_\\counter-strike source\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis SP Demo\\Bin32\\Crysis.exe"="C:\\Program Files\\Electronic Arts\\Crytek\\Crysis SP Demo\\Bin32\\Crysis.exe:*:Enabled:Crysis_32_sp_demo"
"C:\\Program Files\\Steam\\SteamApps\\zanteri\\source dedicated server\\srcds.exe"="C:\\Program Files\\Steam\\SteamApps\\zanteri\\source dedicated server\\srcds.exe:*:Enabled:srcds"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.0"
"C:\\Program Files\\Steam\\SteamApps\\zanteri\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\SteamApps\\zanteri\\counter-strike source\\hl2.exe:*:Enabled:hl2"
"C:\\WINDOWS\\system32\\svho.exe"="C:\\WINDOWS\\system32\\svho.exe:*:Disabled:svho"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.0"
Remaining Files :
File Backups: - C:\DOCUME~1\Zanteri\TYPYT~1\SDFix\SDFix\backups\backups.zip
Files with Hidden Attributes :
Sun 1 Jun 2008 1,486,158 A.SH. --- "C:\WINDOWS\system32\oyyfluir.tmp"
Fri 17 Nov 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 15 May 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Fri 9 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0045d90d3c637c74f834c75fe192b558\BIT3.tmp"
Wed 7 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\e2cdfda265544b05233b12ad6d933aba\BIT3.tmp"
Finished!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:44:05, on 11.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\DT 4.0.3\daemon.exe
C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\Winamp 5.51\winampa.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\Opera 9.25\Opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Burn4Free Toolbar Helper - {60BF5EE3-0105-4858-AD98-17C19F86B042} - C:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O3 - Toolbar: Burn4Free Toolbar - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - C:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
O4 - HKLM\..\Run: [LXCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCGtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\DT 4.0.3\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Globe7] "C:\Documents and Settings\Zanteri\Työpöytä\Globe\Globe7.exe" /hide
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Documents and Settings\Zanteri\Työpöytä\Kansio\Ohjelmat\Winamp 5.51\winampa.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Steam] "c:\progra~1\steam\steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward &Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Download all links using BitComet - res://C:\Documents and Settings\Zanteri\Työpöytä\Uusi kansio\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Documents and Settings\Zanteri\Työpöytä\Uusi kansio\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Documents and Settings\Zanteri\Työpöytä\Uusi kansio\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Ebates. - file://C:\Program Files\EbatesMoeMoneyMaker4\ebatessmmm\ebatestmmm\ebmmC0.htm
O8 - Extra context menu item: Si&milar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O9 - Extra button: Ebates - {F2B441CC-E026-47fb-BDC3-A07750FA3D2C} - file://C:\Program Files\EbatesMoeMoneyMaker4\ebatessmmm\ebatestmmm\ebmmC0.htm (HKCU)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {27527D31-447B-11D5-A46E-0001023B4289} (CoGSManager Class) - http://gamingzone.ubisoft.com/dev/packages/GSManager.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdat...b?1123097197498
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/sh...ash/swflash.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxcg_device - - C:\WINDOWS\system32\lxcgcoms.exe
--
End of file - 7941 bytes
|
|
Mainos
|
|
|
|
Hujo
Suspended permanently
|
11. kesäkuuta 2008 @ 18:52 |
Linkki tähän viestiin
|
Javan päivitys ja välimuistin tyhjennys:
1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
Niissä pitäisi olla seuraava kuva vieressä: 
3. Valitse kaikki entiset Java versiosi ja valitse Poista.
4. Asenna uusin Java päivitys seuraavasta linkistä..
5. Käynnistä kone uudelleen asennuksen jälkeen:
http://java.sun.com/javase/downloads/index.jsp
Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u6
Paina Download
Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.
6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).
7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.
(Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).
8. Varmista että kaikki kaksi valintaa ovat rastitettuja:
*Applications and Applets
*Trace and Log Files
Ja paina OK -nappia
9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.
10. Klikkaa OK jättääksesi Java asetusikkunasi.
Voiko tietsikka koskaan toimia?
|
|
