|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
viiruksia ja troijalaisia pääsi koneelle
|
|
|
AitiKoira
Newbie
|
16. syyskuuta 2008 @ 14:45 |
Linkki tähän viestiin
|
lataamani codec-päkin mukana koneelle tuli kaiken maailman juttuja, mm. avasivat mainos popuppeja jne. scannailtuani asioita avg:llä, A2 malvarella ja ad-awarella löysin jotain la poistin ne. silti kone on vielä hidas joten tässä lista tarkastettavaksi. kiitos kovasti!!
lisäksi uusi lataamani google chrome pistää tehtävien hallinnassa näkyviin useita chrome.exe:jä. onko tämä normallia??
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:40:02, on 16.9.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Anti-Malware\a2service.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\VentriloMIX\Ventrilo 2.1.4.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\AVG\AVG8\avgscanx.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/fi/index.php?rvs=hompag&d=79919278
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: {a53b3965-52a3-45c8-f294-cb1c346f93f3} - {3f39f643-c1bc-492f-8c54-3a255693b35a} - C:\WINDOWS\system32\mupect.dll
O2 - BHO: (no name) - {644D9331-F010-4A1A-99B1-6D2F04622803} - (no file)
O2 - BHO: QXK Olive - {7287293E-B0BE-4A31-B52B-EA15F57679E3} - C:\WINDOWS\vmgspntbnrp.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {842C53C2-9959-4A21-BB67-D98A1457DA37} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: fqbewlna - {94E952A4-FAE1-40E5-BBE1-8199D8CF7FD0} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/Ap...ap/PhtPkMSN.cab
O16 - DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} (Windows Live SkyDrive Upload Tool) - https://secure.shared.live.com/Pa6vGqB728AxD-ckvrPc0A/etc/Microsoft.Live.Folders.RichUpload.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.12) - http://www.yougamers.com/systeminfo/MSC3.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{41539730-8FE8-4EC8-988C-3B739F9BB5B7}: NameServer = 192.168.1.1,192.168.2.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll mupect.dll
O20 - Winlogon Notify: ssqPgFvU - ssqPgFvU.dll (file missing)
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
--
End of file - 7831 bytes
|
|
Hujo
Suspended permanently
|
16. syyskuuta 2008 @ 15:45 |
Linkki tähän viestiin
|
scannaa hjt:llä merkkaa paina Fix checked
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/fi/index.php?rvs=hompag&d=79919278
O2 - BHO: (no name) - {644D9331-F010-4A1A-99B1-6D2F04622803} - (no file)
O2 - BHO: (no name) - {842C53C2-9959-4A21-BB67-D98A1457DA37} - (no file)
O3 - Toolbar: fqbewlna - {94E952A4-FAE1-40E5-BBE1-8199D8CF7FD0} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O20 - Winlogon Notify: ssqPgFvU - ssqPgFvU.dll (file missing)
==================
1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
================
Jos koneella on Malwarebytes' Anti-Malware ennestään suorita ensin päivitys aja sen jälkeen.
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.
==================
Lataa Tästä Ccleaner
CCleaner v2.05.555- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
Asennuksen jälkeen aukaise CCleaner.
Valitse vasemmalta pystyrivistä Options.
Valitse viereisestä pystyrivistä Settings.
Language kohtaan valitse Suomi.
Puhdistaja
Valitse vasemmalta pystyrivistä Puhdistaja.
Paina alhaalta Tutki.
Nyt CCleaner tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
Kun tutkiminen on valmis, paina Aja CCleaner.
Nyt CCleaner poistaa löydetyt tempit, cookiessit jne.
Rekisterin virheiden korjaus
Valitse vasemmalta pystyrivistä Rekisteri.
Paina alhaalta Etsi rekisterin virheitä.
Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
Saat vielä varmistus kysymyksen, paina Ok.
Kun virheet on korjattu, paina Sulje.
Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.
Voiko tietsikka koskaan toimia?
|
|
AitiKoira
Newbie
|
17. syyskuuta 2008 @ 17:06 |
Linkki tähän viestiin
|
|
hjt:n fix checkin tein ja malwarebutesin latasin ja scannailin ja ccleanerilla pyyhin ( käytin muuten uusinta versiota CCleanerista, 2.11.363. ei kai haittaa )
tässä malwarebytesin loki:
Malwarebytes' Anti-Malware 1.28
Tietokantaversio: 1163
Windows 5.1.2600 Service Pack 2
17.9.2008 17:05:55
mbam-log-2008-09-17 (17-05-55).txt
Tarkistustyyppi: Täysi tarkistus (C:\|D:\|F:\|)
Tarkistetut kohteet: 188548
Kulunut aika: 51 minute(s), 9 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 1
Saastuneita rekisteriavaimia: 18
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 2
Saastuneita hakemistoja: 1
Saastuneita tiedostoja: 25
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
C:\WINDOWS\system32\mupect.dll (Trojan.Vundo) -> Delete on reboot.
Saastuneita rekisteriavaimia:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3f39f643-c1bc-492f-8c54-3a255693b35a} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3f39f643-c1bc-492f-8c54-3a255693b35a} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{d15d736d-0f85-43f0-b9b7-440281a2f463} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3dd3c2ae-50f9-4606-a1c6-6866616dba1e} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{971eed72-60a4-4c07-9c6c-8b7485b0f860} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7287293e-b0be-4a31-b52b-ea15f57679e3} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7287293e-b0be-4a31-b52b-ea15f57679e3} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\fqbewlna.bldx (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\fqbewlna.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Malware.Trace) -> Data: c:\windows\system32\ -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Malware.Trace) -> Data: system32\ -> Quarantined and deleted successfully.
Saastuneita hakemistoja:
C:\Program Files\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully.
Saastuneita tiedostoja:
C:\WINDOWS\system32\mupect.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\System Volume Information\_restore{BA514DD7-E19A-42EC-982A-D9EC932578E9}\RP307\A0061392.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{BA514DD7-E19A-42EC-982A-D9EC932578E9}\RP307\A0061393.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gpmrxisy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\1.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\2.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\2.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\3.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\sc.html (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\casino1.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\casino2.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\casino3.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tdssadw.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssl.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssmain.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssinit.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdsslog.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\tdssservers.dat (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\drivers\tdssserv.sys (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\dtseqrxk.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\mgxfebsq.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\mqgldfvo.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\vmgspntbnrp.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
|
|
AitiKoira
Newbie
|
17. syyskuuta 2008 @ 17:32 |
Linkki tähän viestiin
|
combofix linkki kenkkuili, mutta nyt se toimi ja tässä on loki:
ComboFix 08-09-16.05 - ÄitiKoira 2008-09-17 17:15:39.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.1572 [GMT 3:00]
Sijainti: C:\Lataus loota lol\ComboFix.exe
* Uusi palautuspiste luotu
* Resident AV is active
VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !!
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\emnf.exe
C:\WINDOWS\system32\jthtkyub.ini
C:\WINDOWS\system32\kevinuip.ini
C:\WINDOWS\system32\mlUvCJjl.ini
C:\WINDOWS\system32\mlUvCJjl.ini2
C:\WINDOWS\system32\tdsspopup.dll
C:\WINDOWS\system32\tdsspopup1.url
C:\WINDOWS\system32\tdsspopup2.url
C:\WINDOWS\system32\tdsspopup3.url
C:\WINDOWS\system32\windows_update.exe
.
((((((((((((((((((((((((((((((((((((((( Ajurit/Palvelut )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_TDSSSERV
-------\Service_TDSSserv
((((( Tiedostot, jotka on luotu seuraavalla aikav?lill?: 2008-08-17 to 2008-09-17 )))))))))))))))))
.
2008-09-17 16:01 . 2008-09-17 16:01 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-17 16:01 . 2008-09-17 16:01 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-09-17 16:01 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-17 16:01 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-14 18:17 . 2008-09-14 18:17 <KANSIO> d-------- C:\Program Files\K-Lite Codec Pack417
2008-09-10 23:12 . 2008-09-10 23:25 <KANSIO> d-------- C:\Program Files\mIRC
2008-09-10 20:39 . 2004-09-14 16:07 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-09-10 20:39 . 2004-09-14 16:07 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-09-10 20:38 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-09-10 20:38 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-08-28 00:03 . 2008-08-28 00:03 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-08-27 21:00 . 2008-08-30 18:59 <KANSIO> d-------- C:\WINDOWS\system32\Adobe
2008-08-27 20:04 . 2008-08-27 20:06 <KANSIO> d-------- C:\WINDOWS\.jagex_cache_32
2008-08-25 21:09 . 2008-08-25 21:09 <KANSIO> d-------- C:\WINDOWS\system32\drivers\SAMSUNG
2008-08-25 21:09 . 2007-03-01 00:33 172,032 --a------ C:\WINDOWS\system32\SECSNMP.dll
2008-08-25 21:09 . 2006-08-17 23:46 151,552 --a------ C:\WINDOWS\system32\scx530ci.exe
2008-08-25 21:09 . 2006-08-17 23:46 57,344 --a------ C:\WINDOWS\system32\scx530ci.dll
2008-08-25 21:09 . 2006-08-17 23:46 22,663 --a------ C:\WINDOWS\system32\scx530lk.dll
2008-08-25 21:09 . 2006-08-16 19:59 11,502 --------- C:\WINDOWS\Dr. Printer Icon.ico
2008-08-25 21:09 . 2006-08-17 23:46 488 --a------ C:\WINDOWS\system32\scx530lk.smt
2008-08-25 20:47 . 2008-08-25 20:47 <KANSIO> d-------- C:\WINDOWS\Samsung
2008-08-25 20:47 . 2008-08-25 21:09 <KANSIO> d-------- C:\Program Files\Samsung
2008-08-25 20:47 . 2007-02-02 03:44 41,984 --------- C:\WINDOWS\system32\drivers\DgivEcp.sys
2008-08-19 21:01 . 2008-08-19 21:01 <KANSIO> d-------- C:\Program Files\GameSpy
2008-08-19 21:00 . 2008-08-19 21:00 <KANSIO> d-------- C:\WINDOWS\system32\URTTEMP
2008-08-19 20:58 . 2008-08-19 20:58 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-08-17 14:04 . 2008-08-17 14:04 <KANSIO> d-------- C:\Program Files\DAEMON Tools Toolbar
2008-08-17 14:03 . 2008-08-21 07:11 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-14 15:16 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-09-11 18:55 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\avg8
2008-09-11 15:53 --------- d-----w C:\Program Files\DivX
2008-09-11 12:32 --------- d-----w C:\Program Files\Xfire
2008-09-10 13:30 --------- d-----w C:\Program Files\Steam
2008-09-08 14:13 --------- d-----w C:\Program Files\SpeedFan
2008-08-30 08:15 97,928 ----a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2008-08-25 17:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-20 15:48 --------- d-----w C:\Program Files\Microsoft Games
2008-08-19 20:02 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-08-19 17:59 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-08-19 17:52 --------- d-----w C:\Program Files\Electronic Arts
2008-08-07 08:51 --------- d-----w C:\Program Files\Opera
2008-08-07 08:42 --------- d-----w C:\Program Files\PAFPoker
2008-08-07 08:01 --------- d-----w C:\Program Files\PalickSoft
2008-08-02 09:22 --------- d-----w C:\Program Files\MP3Gain
2008-07-29 17:07 --------- d-----w C:\Program Files\Diablo II
2008-07-28 14:29 --------- d-----w C:\Program Files\Java
2008-07-27 23:06 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-07-21 09:31 --------- d-----w C:\Program Files\Microsoft SDKs
2008-07-19 11:08 --------- d-----w C:\Program Files\Lavasoft
2008-07-19 11:08 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-04 12:56 32 ----a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\ezsid.dat
.
(((((((((((((((((((((((((((((( Rekisterin k?ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhji? arvoja ja laillisia oletusarvoja ei n?ytet?
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-06-12 700416]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 13529088]
"IntelliPoint"="c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
"itype"="c:\Program Files\Microsoft IntelliType Pro\itype.exe" [2007-08-31 988584]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-30 1235736]
"CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 57344]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 86016]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-09-14 C:\WINDOWS\system32\bthprops.cpl]
"RTHDCPL"="RTHDCPL.EXE" [2007-03-21 C:\WINDOWS\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll mupect.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"VIDC.YV12"= yv12vfw.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"C:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe"=
"C:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"=
"C:\\WINDOWS\\system32\\mmc.exe"=
"C:\\Program Files\\Steam\\steamapps\\4rs0\\source sdk base\\hl2.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"F:\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\THQ\\Dawn of War - Soulstorm\\Soulstorm.exe"=
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-30 97928]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-30 875288]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-30 231704]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-04 76040]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2007-03-15 38656]
S2 SSPORT;SSPORT;C:\WINDOWS\system32\Drivers\SSPORT.sys [ ]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f308c26-b6c5-11dc-b84c-001bfc8e9c58}]
\Shell\AutoRun\command - G:\SETUP.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f308c27-b6c5-11dc-b84c-001bfc8e9c58}]
\Shell\AutoRun\command - H:\Setup.exe
.
'Ajoitetut teht?v?t'-kansion sis?lt?
.
- - - - POISTETUT J?M?RIVIT - - - -
ShellExecuteHooks-{644D9331-F010-4A1A-99B1-6D2F04622803} - (no file)
.
------- T?ydent?v? tarkistus -------
.
FireFox -: Profile - C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\Mozilla\Firefox\Profiles\yb7jo285.default\
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-17 17:25:13
Windows 5.1.2600 Service Pack 2 NTFS
tarkistaa piilotettuja prosesseja ...
tarkistaa piilotettuja k?ynnistysarvoja ...
tarkistaa piilotettuja tiedostoja ...
tarkistus on valmis
piilotetut tiedostot: 0
**************************************************************************
.
------------------------ Muut prosessit ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\ComboFix\pv.cfexe
.
**************************************************************************
.
Valmistumisajankohta: 2008-09-17 17:29:52 - kone k?ynnistettiin uudelleen
ComboFix-quarantined-files.txt 2008-09-17 14:29:49
Pre-Run: 20,558,704,640 tavua vapaana
Post-Run: 20,618,579,968 tavua vapaana
187 --- E O F --- 2008-09-10 14:26:43
|
|
Hujo
Suspended permanently
|
17. syyskuuta 2008 @ 19:02 |
Linkki tähän viestiin
|
|
scannaa uusi hjt:n loki
Voiko tietsikka koskaan toimia?
|
|
AitiKoira
Newbie
|
17. syyskuuta 2008 @ 19:42 |
Linkki tähän viestiin
|
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:41:34, on 17.9.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\VentriloMIX\Ventrilo 2.1.4.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/Ap...ap/PhtPkMSN.cab
O16 - DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} (Windows Live SkyDrive Upload Tool) - https://secure.shared.live.com/Pa6vGqB728AxD-ckvrPc0A/etc/Microsoft.Live.Folders.RichUpload.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.12) - http://www.yougamers.com/systeminfo/MSC3.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{41539730-8FE8-4EC8-988C-3B739F9BB5B7}: NameServer = 192.168.1.1,192.168.2.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll mupect.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
--
End of file - 7006 bytes
|
|
Hujo
Suspended permanently
|
17. syyskuuta 2008 @ 20:11 |
Linkki tähän viestiin
|
|
ajas tuo combofix uudelleen
Voiko tietsikka koskaan toimia?
|
|
AitiKoira
Newbie
|
17. syyskuuta 2008 @ 20:28 |
Linkki tähän viestiin
|
ComboFix 08-09-16.05 - ÄitiKoira 2008-09-17 20:21:32.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.1376 [GMT 3:00]
Sijainti: C:\Lataus loota lol\ComboFix.exe
* Resident AV is active
VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !!
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-08-17 to 2008-09-17 )))))))))))))))))
.
2008-09-17 17:29 . <KANSIO> C:\Documents and Settings\-itiKoira.ATKONE
2008-09-17 16:01 . 2008-09-17 16:01 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-17 16:01 . 2008-09-17 16:01 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-09-17 16:01 . 2008-09-17 16:01 <KANSIO> d-------- C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\Malwarebytes
2008-09-17 16:01 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-17 16:01 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-14 18:17 . 2008-09-14 18:17 <KANSIO> d-------- C:\Program Files\K-Lite Codec Pack417
2008-09-10 23:12 . 2008-09-10 23:25 <KANSIO> d-------- C:\Program Files\mIRC
2008-09-10 23:12 . 2008-09-10 23:27 <KANSIO> d-------- C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\mIRC
2008-09-10 20:39 . 2004-09-14 16:07 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-09-10 20:39 . 2004-09-14 16:07 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-09-10 20:38 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-09-10 20:38 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-08-28 00:03 . 2008-08-28 00:03 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-08-27 21:00 . 2008-08-30 18:59 <KANSIO> d-------- C:\WINDOWS\system32\Adobe
2008-08-27 20:04 . 2008-08-27 20:06 <KANSIO> d-------- C:\WINDOWS\.jagex_cache_32
2008-08-27 20:04 . 2008-08-27 20:29 24 --a------ C:\Documents and Settings\ÄitiKoira.ATKONE\jagex_runescape_preferences.dat
2008-08-27 20:04 . 2008-08-27 20:29 24 --a------ C:\Documents and Settings\ÄitiKoira.ATKONE\jagex_runescape_preferences.dat
2008-08-25 21:09 . 2008-08-25 21:09 <KANSIO> d-------- C:\WINDOWS\system32\drivers\SAMSUNG
2008-08-25 21:09 . 2007-03-01 00:33 172,032 --a------ C:\WINDOWS\system32\SECSNMP.dll
2008-08-25 21:09 . 2006-08-17 23:46 151,552 --a------ C:\WINDOWS\system32\scx530ci.exe
2008-08-25 21:09 . 2006-08-17 23:46 57,344 --a------ C:\WINDOWS\system32\scx530ci.dll
2008-08-25 21:09 . 2006-08-17 23:46 22,663 --a------ C:\WINDOWS\system32\scx530lk.dll
2008-08-25 21:09 . 2006-08-16 19:59 11,502 --------- C:\WINDOWS\Dr. Printer Icon.ico
2008-08-25 21:09 . 2006-08-17 23:46 488 --a------ C:\WINDOWS\system32\scx530lk.smt
2008-08-25 20:47 . 2008-08-25 20:47 <KANSIO> d-------- C:\WINDOWS\Samsung
2008-08-25 20:47 . 2008-08-25 21:09 <KANSIO> d-------- C:\Program Files\Samsung
2008-08-25 20:47 . 2007-02-02 03:44 41,984 --------- C:\WINDOWS\system32\drivers\DgivEcp.sys
2008-08-20 22:04 . 2008-08-20 22:05 <KANSIO> d-------- C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\teamspeak2
2008-08-19 21:01 . 2008-08-19 21:01 <KANSIO> d-------- C:\Program Files\GameSpy
2008-08-19 21:00 . 2008-08-19 21:00 <KANSIO> d-------- C:\WINDOWS\system32\URTTEMP
2008-08-19 20:59 . 2008-08-19 20:59 22,328 --a------ C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\PnkBstrK.sys
2008-08-19 20:58 . 2008-08-19 20:58 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-08-17 14:04 . 2008-08-17 14:04 <KANSIO> d-------- C:\Program Files\DAEMON Tools Toolbar
2008-08-17 14:03 . 2008-08-21 07:11 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-17 15:33 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\avg8
2008-09-16 20:05 --------- d-----w C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\Hamachi
2008-09-16 17:09 --------- d-----w C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\uTorrent
2008-09-14 15:16 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-09-14 15:13 --------- d-----w C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\DivX
2008-09-11 15:53 --------- d-----w C:\Program Files\DivX
2008-09-11 15:02 --------- d-----w C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\Xfire
2008-09-11 12:32 --------- d-----w C:\Program Files\Xfire
2008-09-10 13:30 --------- d-----w C:\Program Files\Steam
2008-09-08 14:13 --------- d-----w C:\Program Files\SpeedFan
2008-08-30 08:15 97,928 ----a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2008-08-25 17:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-20 15:48 --------- d-----w C:\Program Files\Microsoft Games
2008-08-19 20:02 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-08-19 17:59 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-08-19 17:58 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-08-19 17:58 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-08-19 17:52 --------- d-----w C:\Program Files\Electronic Arts
2008-08-07 08:51 --------- d-----w C:\Program Files\Opera
2008-08-07 08:42 --------- d-----w C:\Program Files\PAFPoker
2008-08-07 08:01 --------- d-----w C:\Program Files\PalickSoft
2008-08-02 09:22 --------- d-----w C:\Program Files\MP3Gain
2008-07-29 17:07 --------- d-----w C:\Program Files\Diablo II
2008-07-29 16:30 152,920 ----a-w C:\WINDOWS\system32\vghd.scr
2008-07-28 14:29 --------- d-----w C:\Program Files\Java
2008-07-27 23:06 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-07-27 23:06 --------- d-----w C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\DAEMON Tools
2008-07-25 08:36 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-07-23 16:48 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-07-23 16:48 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-07-23 16:46 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-07-21 09:31 --------- d-----w C:\Program Files\Microsoft SDKs
2008-07-19 11:08 --------- d-----w C:\Program Files\Lavasoft
2008-07-19 11:08 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-07-18 19:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 19:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 19:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 19:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 19:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 19:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 19:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 19:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 19:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 19:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-16 18:51 2,041,363 ----a-w C:\WINDOWS\system32\x264vfw.dll
2008-07-13 13:46 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
2008-07-13 13:46 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
2008-07-13 13:46 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-04 06:33 10,520 ----a-w C:\WINDOWS\system32\avgrsstx.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 15:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll
2008-06-23 15:40 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
2007-12-04 12:56 32 ----a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\ezsid.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-06-12 700416]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 13529088]
"IntelliPoint"="c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 1037736]
"itype"="c:\Program Files\Microsoft IntelliType Pro\itype.exe" [2007-08-31 988584]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-30 1235736]
"CloneCDTray"="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" [2006-09-28 57344]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 86016]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-09-14 C:\WINDOWS\system32\bthprops.cpl]
"RTHDCPL"="RTHDCPL.EXE" [2007-03-21 C:\WINDOWS\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll mupect.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"VIDC.YV12"= yv12vfw.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
"C:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe"=
"C:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"=
"C:\\WINDOWS\\system32\\mmc.exe"=
"C:\\Program Files\\Steam\\steamapps\\4rs0\\source sdk base\\hl2.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"F:\\Battlefield 2\\BF2.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\THQ\\Dawn of War - Soulstorm\\Soulstorm.exe"=
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-30 97928]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-30 875288]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-30 231704]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-04 76040]
S2 SSPORT;SSPORT;C:\WINDOWS\system32\Drivers\SSPORT.sys [ ]
S3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2007-03-15 38656]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f308c26-b6c5-11dc-b84c-001bfc8e9c58}]
\Shell\AutoRun\command - G:\SETUP.EXE
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9f308c27-b6c5-11dc-b84c-001bfc8e9c58}]
\Shell\AutoRun\command - H:\Setup.exe
.
'Ajoitetut tehtävät'-kansion sisältö
.
.
------- Täydentävä tarkistus -------
.
FireFox -: Profile - C:\Documents and Settings\ÄitiKoira.ATKONE\Application Data\Mozilla\Firefox\Profiles\yb7jo285.default\
FF -: plugin - C:\Documents and Settings\Ã?itiKoira.ATKONE\Local Settings\Application Data\Google\Update\1.2.131.11\npGoogleOneClick5.dll
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-17 20:22:45
Windows 5.1.2600 Service Pack 2 NTFS
tarkistaa piilotettuja prosesseja ...
tarkistaa piilotettuja käynnistysarvoja ...
tarkistaa piilotettuja tiedostoja ...
tarkistus on valmis
piilotetut tiedostot: 0
**************************************************************************
.
Valmistumisajankohta: 2008-09-17 20:24:11
ComboFix-quarantined-files.txt 2008-09-17 17:23:19
ComboFix2.txt 2008-09-17 14:29:54
Pre-Run: 24,743,645,184 tavua vapaana
Post-Run: 24,729,563,136 tavua vapaana
195 --- E O F --- 2008-09-10 14:26:43
|
|
Hujo
Suspended permanently
|
17. syyskuuta 2008 @ 20:46 |
Linkki tähän viestiin
|
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 17. syyskuuta 2008 @ 21:01
|
|
AitiKoira
Newbie
|
17. syyskuuta 2008 @ 21:11 |
Linkki tähän viestiin
|
tässä uusi hjt loki google chromen poiston jälkeen:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:07:31, on 17.9.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
c:\Program Files\Microsoft IntelliType Pro\dpupdchk.exe
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\WINDOWS\explorer.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [itype] "c:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/Ap...ap/PhtPkMSN.cab
O16 - DPF: {C9386579-3C0F-4713-82C6-5BA8088C7C8D} (Windows Live SkyDrive Upload Tool) - https://secure.shared.live.com/Pa6vGqB728AxD-ckvrPc0A/etc/Microsoft.Live.Folders.RichUpload.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.12) - http://www.yougamers.com/systeminfo/MSC3.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{41539730-8FE8-4EC8-988C-3B739F9BB5B7}: NameServer = 192.168.1.1,192.168.2.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll mupect.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
--
End of file - 5798 bytes
|
|
Mainos
|
|
|
|
Hujo
Suspended permanently
|
17. syyskuuta 2008 @ 21:35 |
Linkki tähän viestiin
|
Poista vielä tuokin
Running processes:
C:\Documents and Settings\ÄitiKoira.ATKONE\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
aja päälle vielä Ccleaner
Voiko tietsikka koskaan toimia?
|
|
