|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
Combofix herjaa "Findstr: Ei voi avata tiedostoa temp01
|
|
|
smake
Suspended due to non-functional email address
|
21. joulukuuta 2008 @ 02:51 |
Linkki tähän viestiin
|
Eli bittorrent kikkailujen aikaan saannoksena tullut (Ask toolbar) oli sitkeässä...enkä sano varmaksi että poistinko jotain vahigossa. Miksi tuo Combofix herjaa???
ComboFix 08-12-20.03 - Omistaja 2008-12-21 2:20:48.121 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1035.18.1023.668 [GMT 2:00]
Sijainti: c:\documents and settings\Omistaja\Työpöytä\ComboFix.exe
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-11-21 to 2008-12-21 )))))))))))))))))
.
2008-12-21 01:44 . 2008-12-21 01:44 579,072 --a--c--- c:\windows\system32\dllcache\user32.dll
2008-12-21 01:19 . 2008-12-21 02:18 <KANSIO> d-------- c:\program files\Mozilla Firefox 3.1 Beta 2
2008-12-20 22:46 . 2008-12-20 22:46 4,724 --a------ c:\windows\system32\PerfStringBackup.TMP
2008-12-20 22:36 . 2008-12-20 22:36 <KANSIO> d-------- c:\program files\A-Link
2008-12-20 21:37 . 2008-12-20 21:37 <KANSIO> d-------- c:\program files\Common Files\Java(2)
2008-12-20 21:37 . 2008-12-20 21:37 <KANSIO> d-------- c:\program files\Common Files\Java
2008-12-20 21:36 . 2008-12-20 21:36 <KANSIO> d-------- c:\program files\TurnTool
2008-12-20 21:36 . 2008-12-20 21:36 <KANSIO> d-------- c:\program files\DScaler5
2008-12-20 21:34 . 2008-12-20 21:36 <KANSIO> d--hs---- C:\RECYCLER(13)
2008-12-20 18:40 . 2008-12-20 21:37 <KANSIO> d-ahs---- C:\cmdcons(3)
2008-12-20 14:54 . 2008-12-20 21:59 <KANSIO> d--hs---- C:\RECYCLER(12)
2008-12-20 12:23 . 2008-12-20 21:59 <KANSIO> d-------- c:\documents and settings\Omistaja\Application Data\BitTorrent
2008-12-20 12:22 . 2008-12-20 21:59 <KANSIO> d-------- c:\documents and settings\Omistaja\Application Data\DNA
2008-12-17 21:08 . 2008-10-24 13:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-12-17 21:08 . 2008-10-15 18:37 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2008-12-17 21:01 . 2008-12-20 22:00 <KANSIO> d-------- C:\cmdcons(2)
2008-12-17 20:38 . 2008-09-04 19:16 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-12-17 20:02 . 2008-12-20 22:20 <KANSIO> d--hs---- C:\RECYCLER(11)
2008-12-17 19:30 . 2007-10-24 01:47 282,112 --a------ c:\windows\system32\TBDA5.tmp
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-21 00:16 --------- d-----w c:\documents and settings\Omistaja\Application Data\OpenOffice.org2
2008-12-20 21:36 97,928 ----a-w c:\windows\system32\drivers\avgldx86.sys.prepare
2008-12-20 21:36 26,824 ----a-w c:\windows\system32\drivers\avgmfx86.sys.prepare
2008-12-20 20:53 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2008-12-20 20:22 --------- d-----w c:\program files\PartyGaming
2008-12-20 19:36 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-20 10:32 --------- d-----w c:\program files\eMule
2008-12-17 19:15 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-12-17 19:15 --------- d-----w c:\program files\SpywareBlaster
2008-12-03 17:52 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-03 17:52 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 12:38 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-23 12:38 286,720 ----a-w c:\windows\system32\gdi32(2)(3).dll
2008-10-16 12:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 12:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 12:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 12:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 12:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 12:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 12:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 12:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 12:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 12:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 01:01 666,112 ----a-w c:\windows\system32\wininet.dll
2008-10-16 01:01 666,112 ----a-w c:\windows\system32\wininet(3)(2).dll
2008-10-16 01:01 619,008 ----a-w c:\windows\system32\urlmon(3)(2).dll
2008-10-15 16:37 337,408 ----a-w c:\windows\system32\netapi32(2)(2).dll
2008-10-03 10:03 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-09-30 14:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CnxDslTaskBar"="c:\program files\A-Link\RoadRunner 32\CnxDslTb.exe" [2004-02-24 462848]
"SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2002-07-13 106496]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-03-03 335872]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-06-25 49152]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-10-23 233472]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-07-28 188416]
"DeviceDiscovery"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2003-05-21 229437]
"SoundMan"="SOUNDMAN.EXE" [2004-01-09 c:\windows\SOUNDMAN.EXE]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-05 c:\windows\system32\Ati2mdxx.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
c:\documents and settings\Omistaja\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 393216]
c:\documents and settings\All Users\K?ynnist?-valikko\Ohjelmat\K?ynnistys\
BTTray.lnk - c:\program files\Bluetooth\Bluetooth-ohjelmisto\BTTray.exe [2005-09-19 581693]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-05-29 96520]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-05-29 902424]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-05-29 282904]
R2 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-05-29 75272]
R3 CnxEtP;A-Link RoadRunner 32 USB ADSL LAN Adapter Filter Driver;c:\windows\system32\DRIVERS\CnxEtP.sys [2007-10-28 60288]
R3 CnxEtU;A-Link RoadRunner 32 USB ADSL Device Driver;c:\windows\system32\DRIVERS\CnxEtU.sys [2007-10-28 646400]
R3 CnxTgN;A-Link RoadRunner 32 USB ADSL LAN Adapter Driver;c:\windows\system32\DRIVERS\CnxTgN.sys [2007-10-28 103622]
R3 CONAN;CONAN;c:\windows\system32\drivers\o2mmb.sys [2007-10-28 190465]
R3 MbxStby;MbxStby;c:\windows\system32\drivers\MbxStby.sys [2007-10-28 5817]
S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys [2008-08-15 38496]
.
.
------- Täydentävä tarkistus -------
.
uStart Page = hxxp://www.yle.fi/
IE: Lähetä &Bluetooth-laitteeseen - c:\program files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
FF - ProfilePath - c:\documents and settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\40aworiy.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.yle.fi
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101761&gct=&gc=1&q=
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-21 02:22:46
Windows 5.1.2600 Service Pack 3 NTFS
tarkistaa piilotettuja prosesseja ...
tarkistaa piilotettuja käynnistysarvoja ...
tarkistaa piilotettuja tiedostoja ...
tarkistus on valmis
piilotetut tiedostot: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\vsdatant]
"ImagePath"=""
.
Valmistumisajankohta: 2008-12-21 2:24:02
ComboFix-quarantined-files.txt 2008-12-21 00:23:43
Ennen ajoa: 29 429 366 784 tavua vapaana
Ajon jälkeen: 29,418,041,344 tavua vapaana
130 --- E O F --- 2008-12-20 23:39:28
________________
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-21 01:52:59
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
scanning hidden registry entries ...
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000003e
"TracesSuccessful"=dword:00000007
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
___________________
Logfile of random's system information tool 1.05 (written by random/random)
Run by Omistaja at 2008-12-21 02:31:47
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 28 GB (49%) free of 57 GB
Total RAM: 1023 MB (62% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:31:56, on 21.12.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\A-Link\RoadRunner 32\CnxDslTb.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\BTTray.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Omistaja\Työpöytä\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Omistaja.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yle.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\A-Link\RoadRunner 32\CnxDslTb.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsu...b?1193539921796
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
--
End of file - 4950 bytes
======Registry dump======
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"CnxDslTaskBar"=C:\Program Files\A-Link\RoadRunner 32\CnxDslTb.exe [2004-02-24 462848]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2004-01-09 65536]
"SiSUSBRG"=C:\WINDOWS\SiSUSBrg.exe [2002-07-13 106496]
"ATIModeChange"=C:\WINDOWS\system32\Ati2mdxx.exe [2001-09-05 28672]
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2004-03-03 335872]
"HP Software Update"=C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe [2003-06-25 49152]
"HP Component Manager"=C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [2003-10-23 233472]
"HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe [2003-07-28 188416]
"DeviceDiscovery"=C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-05-21 229437]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys
BTTray.lnk - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\BTTray.exe
C:\Documents and Settings\Omistaja\Käynnistä-valikko\Ohjelmat\Käynnistys
OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
Ati2evxx.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDrives"=0
"NoDriveAutoRun"=67108863
"NoDriveTypeAutoRun"=323
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"NoDrives"=
"NoDriveAutoRun"=
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\Windows Media Player\wmplayer.exe"="C:\Program Files\Windows Media Player\wmplayer.exe:*:Enabled:Windows Media Player"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
"C:\Program Files\AVG\AVG8\avgemc.exe"="C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe"
"C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:*:Disabled:Microsoft DirectPlay8 Server"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
======List of files/folders created in the last 1 months======
2008-12-21 02:31:47 ----D---- C:\rsit
2008-12-21 02:25:01 ----SHD---- C:\RECYCLER
2008-12-21 02:24:05 ----D---- C:\WINDOWS\temp
2008-12-21 02:24:04 ----A---- C:\ComboFix.txt
2008-12-21 02:20:21 ----A---- C:\WINDOWS\zip.exe
2008-12-21 02:20:21 ----A---- C:\WINDOWS\VFIND.exe
2008-12-21 02:20:21 ----A---- C:\WINDOWS\SWXCACLS.exe
2008-12-21 02:20:21 ----A---- C:\WINDOWS\SWSC.exe
2008-12-21 02:20:21 ----A---- C:\WINDOWS\SWREG.exe
2008-12-21 02:20:21 ----A---- C:\WINDOWS\sed.exe
2008-12-21 02:20:21 ----A---- C:\WINDOWS\NIRCMD.exe
2008-12-21 02:20:21 ----A---- C:\WINDOWS\grep.exe
2008-12-21 02:20:21 ----A---- C:\WINDOWS\fdsv.exe
2008-12-21 02:20:17 ----D---- C:\Qoobox
2008-12-21 01:24:04 ----RASHD---- C:\cmdcons
2008-12-21 01:19:06 ----D---- C:\Program Files\Mozilla Firefox 3.1 Beta 2
2008-12-21 01:07:33 ----N---- C:\WINDOWS\SchedLgU.Txt
2008-12-20 22:46:21 ----A---- C:\WINDOWS\system32\PerfStringBackup.TMP
2008-12-20 22:36:43 ----D---- C:\Program Files\A-Link
2008-12-20 22:23:30 ----D---- C:\Program Files\Common Files\Services
2008-12-20 21:37:08 ----D---- C:\Program Files\Common Files\Java(2)
2008-12-20 21:37:08 ----D---- C:\Program Files\Common Files\Java
2008-12-20 21:36:56 ----D---- C:\Program Files\DScaler5
2008-12-20 21:36:55 ----D---- C:\Program Files\TurnTool
2008-12-20 21:34:31 ----SHD---- C:\RECYCLER(13)
2008-12-20 18:40:36 ----ASHD---- C:\cmdcons(3)
2008-12-20 14:54:33 ----SHD---- C:\RECYCLER(12)
2008-12-20 12:23:03 ----D---- C:\Documents and Settings\Omistaja\Application Data\BitTorrent
2008-12-20 12:22:41 ----D---- C:\Documents and Settings\Omistaja\Application Data\DNA
2008-12-18 00:40:23 ----HDC---- C:\WINDOWS\$NtUninstallKB960714$
2008-12-17 21:01:26 ----A---- C:\Boot.bak
2008-12-17 21:01:15 ----D---- C:\cmdcons(2)
2008-12-17 20:02:17 ----SHD---- C:\RECYCLER(11)
2008-12-17 19:51:22 ----DC---- C:\WINDOWS\ie7
2008-12-17 19:51:08 ----DC---- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
2008-12-17 19:50:52 ----DC---- C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
2008-12-17 19:30:30 ----A---- C:\WINDOWS\system32\TBDA5.tmp
2008-12-12 03:10:00 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2008-12-12 03:09:46 ----HDC---- C:\WINDOWS\$NtUninstallKB958215$
2008-12-12 03:08:07 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2008-12-12 03:08:01 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2008-12-12 03:07:53 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
======List of files/folders modified in the last 1 months======
2008-12-21 02:24:06 ----D---- C:\WINDOWS\system32
2008-12-21 02:24:05 ----D---- C:\WINDOWS
2008-12-21 02:22:48 ----A---- C:\WINDOWS\system.ini
2008-12-21 02:22:07 ----D---- C:\WINDOWS\system32\drivers
2008-12-21 02:22:05 ----D---- C:\WINDOWS\AppPatch
2008-12-21 02:22:05 ----D---- C:\Program Files\Common Files
2008-12-21 02:16:20 ----D---- C:\Documents and Settings\Omistaja\Application Data\OpenOffice.org2
2008-12-21 02:10:22 ----D---- C:\Documents and Settings
2008-12-21 01:56:08 ----D---- C:\WINDOWS\Debug
2008-12-21 01:52:51 ----D---- C:\WINDOWS\Prefetch
2008-12-21 01:44:28 ----RSHDC---- C:\WINDOWS\system32\dllcache
2008-12-21 01:39:28 ----HD---- C:\WINDOWS\inf
2008-12-21 01:39:21 ----D---- C:\WINDOWS\system32\CatRoot2
2008-12-21 01:37:02 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2008-12-21 01:36:54 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2008-12-21 01:36:36 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2008-12-21 01:36:26 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2008-12-21 01:35:24 ----SHD---- C:\WINDOWS\Installer
2008-12-21 01:35:24 ----HD---- C:\Config.Msi
2008-12-21 01:35:23 ----D---- C:\WINDOWS\WinSxS
2008-12-21 01:31:07 ----D---- C:\WINDOWS\erdnt
2008-12-21 01:24:11 ----RASH---- C:\boot.ini
2008-12-21 01:19:06 ----RD---- C:\Program Files
2008-12-20 23:36:49 ----A---- C:\WINDOWS\system32\avgrsstx.dll.prepare
2008-12-20 22:53:18 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-12-20 22:49:01 ----D---- C:\WINDOWS\system32\CatRoot
2008-12-20 22:42:17 ----D---- C:\WINDOWS\system32\config
2008-12-20 22:42:03 ----D---- C:\WINDOWS\system32\wbem
2008-12-20 22:42:03 ----D---- C:\WINDOWS\Registration
2008-12-20 22:41:26 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2008-12-20 22:41:21 ----HDC---- C:\WINDOWS\$NtUninstallKB956390$
2008-12-20 22:41:00 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2008-12-20 22:41:00 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2008-12-20 22:40:59 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2008-12-20 22:36:44 ----SHD---- C:\RECYCLER(5)
2008-12-20 22:36:18 ----SHD---- C:\RECYCLER(9)
2008-12-20 22:33:38 ----SHD---- C:\RECYCLER(10)
2008-12-20 22:22:10 ----D---- C:\Program Files\PartyGaming
2008-12-20 22:20:09 ----HD---- C:\WINDOWS\$hf_mig$
2008-12-20 22:20:07 ----D---- C:\Program Files\Internet Explorer
2008-12-20 21:36:50 ----D---- C:\Program Files\Common Files\Microsoft Shared
2008-12-20 21:36:47 ----HD---- C:\Program Files\InstallShield Installation Information
2008-12-20 19:55:53 ----D---- C:\WINDOWS\Help
2008-12-20 12:32:02 ----D---- C:\Program Files\eMule
2008-12-17 21:15:49 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2008-12-17 21:15:45 ----D---- C:\Program Files\SpywareBlaster
2008-12-17 20:35:58 ----RSD---- C:\WINDOWS\assembly
2008-12-17 19:53:14 ----D---- C:\WINDOWS\system32\fi-fi
2008-12-17 19:53:03 ----D---- C:\WINDOWS\Media
2008-12-12 19:03:17 ----A---- C:\WINDOWS\system32\mshtml.dll
2008-12-09 15:24:38 ----A---- C:\WINDOWS\system32\MRT.exe
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 AFS2K;AFS2k; C:\WINDOWS\system32\drivers\AFS2K.sys [2007-10-28 82380]
R1 AmdK8;AMD Athlon64 Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2003-11-07 37888]
R1 AvgLdx86;AVG AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2008-05-29 96520]
R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2008-05-29 26184]
R1 wpsdrvnt;wpsdrvnt; \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys []
R2 AvgTdiX;AVG8 Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2008-05-29 75272]
R2 BTSERIAL;Bluetooth Serial Driver; \??\C:\WINDOWS\system32\drivers\btserial.sys []
R2 BTSLBCSP;Bluetooth Port Client Driver; \??\C:\WINDOWS\system32\drivers\btslbcsp.sys []
R2 irda;IrDA-protokolla; C:\WINDOWS\System32\DRIVERS\irda.sys [2008-04-13 88192]
R2 wg3n;SyGate for NT, wg3n; C:\WINDOWS\SYSTEM32\Drivers\wg3n.sys [2004-10-16 14568]
R2 wg4n;SyGate for NT, wg4n; C:\WINDOWS\SYSTEM32\Drivers\wg4n.sys [2004-10-16 14568]
R2 wg5n;SyGate for NT, wg5n; C:\WINDOWS\SYSTEM32\Drivers\wg5n.sys [2004-10-16 14568]
R2 wg6n;SyGate for NT, wg6n; C:\WINDOWS\SYSTEM32\Drivers\wg6n.sys [2004-10-16 14568]
R3 ALCXSENS;Service for WDM 3D Audio Driver; C:\WINDOWS\system32\drivers\ALCXSENS.SYS [2003-12-12 391424]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-01-10 601100]
R3 Arp1394;1394 ARP -asiakasprotokolla; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2004-03-03 679936]
R3 BTKRNL;Bluetooth-väyläluetteloija; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2005-09-20 1342122]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\System32\DRIVERS\CmBatt.sys [2008-04-13 13952]
R3 CnxEtP;A-Link RoadRunner 32 USB ADSL LAN Adapter Filter Driver; C:\WINDOWS\System32\DRIVERS\CnxEtP.sys [2004-01-29 60288]
R3 CnxEtU;A-Link RoadRunner 32 USB ADSL Device Driver; C:\WINDOWS\System32\DRIVERS\CnxEtU.sys [2004-01-29 646400]
R3 CnxTgN;A-Link RoadRunner 32 USB ADSL LAN Adapter Driver; C:\WINDOWS\System32\DRIVERS\CnxTgN.sys [2004-02-24 103622]
R3 CONAN;CONAN; C:\WINDOWS\system32\drivers\o2mmb.sys [2003-10-28 190465]
R3 hidusb;Microsoft HID -luokkaohjain; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 MbxStby;MbxStby; C:\WINDOWS\system32\drivers\MbxStby.sys [2003-08-26 5817]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-18 16128]
R3 mouhid;Hiiren HID-ohjain; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2003-04-25 12160]
R3 Mtlmnt5;Mtlmnt5; C:\WINDOWS\system32\DRIVERS\Mtlmnt5.sys [2003-10-29 226288]
R3 NIC1394;1394-verkko-ohjain; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 NSCIRDA;NSC-infrapunalaiteohjain; C:\WINDOWS\System32\DRIVERS\nscirda.sys [2008-04-13 28672]
R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\System32\DRIVERS\rasirda.sys [2001-08-17 19584]
R3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\System32\DRIVERS\sisnic.sys [2004-08-04 32768]
R3 Slntamr;SmartLink AMR_PCI Driver; C:\WINDOWS\system32\DRIVERS\slntamr.sys [2003-11-09 566256]
R3 SlWdmSup;SlWdmSup; C:\WINDOWS\system32\DRIVERS\SlWdmSup.sys [2003-10-29 15712]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2008-04-13 17152]
S1 kbdhid;Näppäimistön HID-ohjain; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
S3 btaudio;Bluetooth-äänilaite; C:\WINDOWS\system32\drivers\btaudio.sys [2005-09-20 401664]
S3 BTDriver;Bluetooth-näennäistietoliikenneohjain; C:\WINDOWS\system32\DRIVERS\btport.sys [2005-09-19 30363]
S3 BTWDNDIS;Bluetooth-lähiverkkopalvelin; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2005-09-19 148040]
S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2005-09-19 56648]
S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
S3 Mtlstrm;Mtlstrm; C:\WINDOWS\system32\DRIVERS\Mtlstrm.sys [2003-11-05 1299976]
S3 NtMtlFax;NtMtlFax; C:\WINDOWS\system32\DRIVERS\NtMtlFax.sys [2003-10-29 180368]
S3 SlNtHal;SlNtHal; C:\WINDOWS\system32\DRIVERS\Slnthal.sys [2003-10-29 87656]
S3 usbprint;Microsoft USB PRINTER -luokka; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
S4 vsdatant;vsdatant; C:\WINDOWS\system32\drivers\vsdatant.sys []
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-05-29 611664]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2004-03-03 397312]
R2 avg8emc;AVG8 E-mail Scanner; C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-05-29 902424]
R2 avg8wd;AVG8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-05-29 282904]
R2 btwdins;Bluetooth Service; C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe [2005-09-19 258103]
R2 Irmon;Infrapunavalvonta; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 SmcService;Sygate Personal Firewall; C:\Program Files\Sygate\SPF\smc.exe [2004-10-16 2577632]
S2 SLService;SmartLinkService; C:\WINDOWS\system32\slserv.exe [2003-10-29 45056]
S3 aspnet_state;ASP.NET-tilapalvelu; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-04-13 33632]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-04-13 68952]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2006-10-20 36864]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2006-10-30 741376]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Windows Media Playerin verkkojakamispalvelu; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-15 913920]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2006-10-30 122880]
-----------------EOF-----------------
________________
Tuossa Combofix, SDFiks ja RSIT logit
MBAM ja AVG skannaus boottaa koneen, mutta se on lähempänä ominaisuutta kuin vikaa (suora lainaus myyjältä)...
Kiitokset jo etukäteen :)
|
|
smake
Suspended due to non-functional email address
|
21. joulukuuta 2008 @ 02:57 |
Linkki tähän viestiin
|
Hjt unehtu...
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:56:51, on 21.12.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\A-Link\RoadRunner 32\CnxDslTb.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\BTTray.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox 3.1 Beta 2\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yle.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\A-Link\RoadRunner 32\CnxDslTb.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsu...b?1193539921796
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
--
End of file - 4955 bytes
|
|
Hujo
Suspended permanently
|
22. joulukuuta 2008 @ 03:14 |
Linkki tähän viestiin
|
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi
===============
Scannaa koneesi Kaspersky Online Scannerin
Ohjelman käynnistyessä kysytään sallitaanko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.
" Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
" Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
" Klikkaa nyt asetuksia, Scan Settings
" Tarkista asetuksista, että seuraavat ovat valittuina:
o Scan using the following Anti-Virus database:
+ Extended (Jos valittavissa, muuten valitse Standard)
o Scan Options:
+ Scan Archives
+ Scan Mail Bases
" Klikkaa OK
" Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
" Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
" Klikkaa nyt Save as Text-painiketta.
" Tallenna tiedosto työpöydällesi.
" Mikäli haluat jatkaa asian käsittelyä foorumissa niin kopioi tiedoston sisältö viestiisi.
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 22. joulukuuta 2008 @ 03:15
|
|
Mainos
|
 |
|
|
smake
Suspended due to non-functional email address
|
23. joulukuuta 2008 @ 13:10 |
Linkki tähän viestiin
|
Monday, December 22, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, December 22, 2008 17:03:33
Records in database: 1500983
Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes
Scan area My Computer
C:\
D:\
Scan statistics
Files scanned 110300
Threat name 0
Infected objects 0
Suspicious objects 0
Duration of the scan 01:45:51
No malware has been detected. The scan area is clean.
The selected area was scanned.
____________________
Malwarebytes' Anti-Malware 1.31
Tietokantaversio: 1535
Windows 5.1.2600 Service Pack 3
23.12.2008 13:02:32
mbam-log-2008-12-23 (13-02-32).txt
Tarkistustyyppi: Pikatarkistus
Tarkistetut kohteet: 46516
Kulunut aika: 6 minute(s), 27 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)
Tuossa logit, mbam sammuttaa koneen itestään siksi en saa täydestä tarkistuksesta raporttia...kone toimii muuten ihan ok, mutta ComboFix herjaa edelleen?
|
|
