|
|
|
Keskustelualueet
Keskustelualueet
|
|
|
hjt loki. löytyisikö apua?
|
|
|
einari25
Newbie
|
8. tammikuuta 2009 @ 18:53 |
Linkki tähän viestiin
|
hei. norman löysi mun koneelta 2 troijalaista ja heitti ne karanteeniin. kone silti ei oo entisensä. katoin malwarebytes anti-malwarella koneen ja kaks troijalaista löysi sekin. poistin ne, mutta ei auta. kahtokaa näkyykö tossa jotain.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:35:22, on 8.1.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal
Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Norman\Npm\bin\ELOGSVC.EXE
C:\Program Files\Norman\Npm\Bin\Zanda.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\PnkBstrB.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Windows\system32\svchost.exe
C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
C:\Program Files\Norman\nse\bin\NSESVC.EXE
C:\Program Files\Norman\Nvc\bin\nvcoas.exe
C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Norman\Npm\Bin\Zlh.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\Norman\Nvc\bin\cclaw.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://yle.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] "C:\Program Files\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: HP-leikekirja - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart -valitse - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O13 - Gopher Prefix:
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\bin\ELOGSVC.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Norman NJeeves - Norman ASA - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
O23 - Service: Norman Scanner Engine Service (nsesvc) - Norman ASA - C:\Program Files\Norman\nse\bin\NSESVC.EXE
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
--
End of file - 8138 bytes
|
|
einari25
Newbie
|
13. tammikuuta 2009 @ 16:59 |
Linkki tähän viestiin
|
|
troijalaiset on edelleen koneella enkä saa niitä pois.
netti on alakanut pätkimään, joutuu käynnistelemään vähä väliä uudestaan ja se hakee aina uudestaan välityspalvelimen asetukset.
auttakaa ny jo ihimeesä.
|
|
Hujo
Suspended permanently
|
13. tammikuuta 2009 @ 17:41 |
Linkki tähän viestiin
|
scannaa hjt:llä merkkaa paina Fix checked
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
=================
Lataa Malwarebytes' Anti-Malware työpöydällesi.
1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi
Voiko tietsikka koskaan toimia?
|
|
einari25
Newbie
|
13. tammikuuta 2009 @ 20:17 |
Linkki tähän viestiin
|
|
malware ei löytäny mitään, mutta aikasemmin norman (norton) löysi 2.
testaan ne vielä myöhemmin.
Malwarebytes' Anti-Malware 1.32
Tietokantaversio: 1648
Windows 6.0.6001 Service Pack 1
13.1.2009 20:10:55
mbam-log-2009-01-13 (20-10-55).txt
Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
Tarkistetut kohteet: 105218
Kulunut aika: 31 minute(s), 32 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)
|
|
Hujo
Suspended permanently
|
14. tammikuuta 2009 @ 00:48 |
Linkki tähän viestiin
|
1.Lataa Combofix.exe työpöydällesi yhdestä linkistä:
Combofix1
Combofix2
älä asenna palautus consolia
2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Voiko tietsikka koskaan toimia?
|
|
einari25
Newbie
|
14. tammikuuta 2009 @ 23:48 |
Linkki tähän viestiin
|
norton löysi taas sen troijalaisen ( w32/Dloader.dam ), mutta ei pysty poistamaan sitä.
se näky ennen tätä combofixin ajoa.
ComboFix 09-01-13.04 - erik 2009-01-14 23:23:25.1 - NTFSx86
Microsoft® Windows Vista? Home Basic 6.0.6001.1.1252.1.1035.18.894.306 [GMT 2:00]
Sijainti: c:\users\erik\Desktop\ComboFix.exe
AV: Norman Virus Control ver. 5.99 *On-access scanning disabled* (Outdated)
* Uusi palautuspiste luotu
* Resident AV is active
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\AutoRun.inf
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-12-14 to 2009-01-14 )))))))))))))))))
.
2009-01-13 23:12 . 2008-12-16 04:42 288,768 --a------ c:\windows\System32\drivers\srv.sys
2009-01-09 16:01 . 2008-07-06 11:12 114,555 --------- c:\windows\hpqins13.dat.temp
2009-01-08 18:32 . 2009-01-08 18:32 <KANSIO> d-------- c:\program files\Trend Micro
2009-01-02 18:46 . 2009-01-02 18:46 <KANSIO> d-------- c:\users\erik\AppData\Roaming\Malwarebytes
2009-01-02 18:46 . 2009-01-04 18:38 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2009-01-02 18:45 . 2009-01-02 18:45 <KANSIO> d-------- c:\users\All Users\Malwarebytes
2009-01-02 18:45 . 2009-01-02 18:45 <KANSIO> d-------- c:\programdata\Malwarebytes
2009-01-02 18:45 . 2009-01-13 19:36 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-02 18:45 . 2009-01-04 18:38 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-14 16:02 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-01-14 16:00 --------- d-----w c:\program files\Norton Security Scan
2009-01-14 10:04 --------- d-----w c:\program files\Norman
2009-01-13 21:21 2,842 ----a-w c:\users\erik\AppData\Roaming\wklnhst.dat
2009-01-13 21:15 --------- d-----w c:\program files\Windows Mail
2009-01-10 16:21 --------- d-----w c:\program files\Google
2009-01-09 21:14 138,384 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-01-09 21:13 187,536 ----a-w c:\windows\System32\PnkBstrB.exe
2008-12-27 15:03 --------- d-----w c:\program files\Common Files\Adobe
2008-12-26 20:49 70,968 ----a-w c:\windows\System32\PnkBstrA.exe
2008-12-08 19:00 410,984 ----a-w c:\windows\System32\deploytk.dll
2008-12-08 19:00 --------- d-----w c:\program files\Java
2008-11-30 16:45 --------- d-----w c:\programdata\Symantec
2008-11-27 08:33 --------- d-----w c:\program files\MSN Messenger
2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:44 28,672 ----a-w c:\windows\System32\Apphlpdm.dll
2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-11-01 01:21 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll
2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe
2008-10-22 03:57 241,152 ----a-w c:\windows\System32\PortableDeviceApi.dll
2008-10-22 01:22 2,048 ----a-w c:\windows\System32\tzres.dll
2008-10-21 05:25 296,960 ----a-w c:\windows\System32\gdi32.dll
2008-10-21 05:25 1,645,568 ----a-w c:\windows\System32\connect.dll
2008-10-16 21:13 1,809,944 ----a-w c:\windows\System32\wuaueng.dll
2008-10-16 21:12 561,688 ----a-w c:\windows\System32\wuapi.dll
2008-10-16 21:09 51,224 ----a-w c:\windows\System32\wuauclt.exe
2008-10-16 21:09 43,544 ----a-w c:\windows\System32\wups2.dll
2008-10-16 21:08 34,328 ----a-w c:\windows\System32\wups.dll
2008-10-16 20:56 1,524,736 ----a-w c:\windows\System32\wucltux.dll
2008-10-16 20:55 83,456 ----a-w c:\windows\System32\wudriver.dll
2008-10-16 12:08 162,064 ----a-w c:\windows\System32\wuwebv.dll
2008-10-16 11:56 31,232 ----a-w c:\windows\System32\wuapp.exe
2008-10-16 04:47 827,392 ----a-w c:\windows\System32\wininet.dll
2008-04-16 18:04 174 --sha-w c:\program files\desktop.ini
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-09 39408]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 219520]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-07-12 90112]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"Norman ZANDA"="c:\program files\Norman\Npm\bin\ZLH.EXE" [2008-06-02 273520]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-08 136600]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-06-02 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-29 c:\windows\RtHDVCpl.exe]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{72C1D0D4-9076-41BD-A2C7-8BA8AE67D14E}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"TCP Query User{63E21B54-25D1-4B36-BA88-370128CA3763}c:\\program files\\novalogic\\delta force black hawk down\\dfbhd.exe"= UDP:c:\program files\novalogic\delta force black hawk down\dfbhd.exe:dfbhd
"UDP Query User{390455C8-3A05-44D7-A824-2EF97070A433}c:\\program files\\novalogic\\delta force black hawk down\\dfbhd.exe"= TCP:c:\program files\novalogic\delta force black hawk down\dfbhd.exe:dfbhd
"TCP Query User{47A82542-0794-479E-983E-32819B446148}c:\\program files\\novalogic\\delta force black hawk down\\update.exe"= UDP:c:\program files\novalogic\delta force black hawk down\update.exe:UPDATE
"UDP Query User{9649E913-D1FE-4D9F-AD1B-3FD7B5288A3C}c:\\program files\\novalogic\\delta force black hawk down\\update.exe"= TCP:c:\program files\novalogic\delta force black hawk down\update.exe:UPDATE
"TCP Query User{F4EA2214-B4A0-44C0-AD84-5DA60FBE3226}c:\\program files\\activision\\call of duty 2\\cod2mp_s.exe"= UDP:c:\program files\activision\call of duty 2\cod2mp_s.exe:CoD2MP_s
"UDP Query User{58C9748F-A807-42FA-87EE-613A2C28698E}c:\\program files\\activision\\call of duty 2\\cod2mp_s.exe"= TCP:c:\program files\activision\call of duty 2\cod2mp_s.exe:CoD2MP_s
"TCP Query User{F445E7B9-20E1-4CE7-AD98-A7966EE3E933}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{957A38B9-FE15-44AF-B927-3313B0A656FA}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{BF404466-AFD2-416B-8623-3DA2259FF773}c:\\users\\erik\\counter-strike\\mspaint.exe\\hl.exe"= UDP:c:\users\erik\counter-strike\mspaint.exe\hl.exe:hl.exe
"UDP Query User{25280A5D-FB81-442D-8D01-CB33EF2AF528}c:\\users\\erik\\counter-strike\\mspaint.exe\\hl.exe"= TCP:c:\users\erik\counter-strike\mspaint.exe\hl.exe:hl.exe
R3 nsesvc;Norman Scanner Engine Service;c:\program files\Norman\Nse\Bin\Nsesvc.exe [2008-06-30 322616]
R3 NvcMFlt;NvcMFlt;c:\windows\System32\drivers\nvcv32mf.sys [2008-09-06 19512]
R3 nvcoas;Norman Virus Control on-access component;c:\program files\Norman\NVC\bin\Nvcoas.exe [2008-01-14 183352]
R3 NVCScheduler;Norman Virus Control Scheduler;c:\program files\Norman\NVC\bin\Nvcsched.exe [2007-05-23 146488]
R4 Ndiskio;Ndiskio;c:\program files\Norman\Nse\Bin\Ndiskio.sys [2007-04-15 20448]
S3 nvcfsr;nvcfsr;c:\program files\Norman\NVC\bin\Nvcfsr.sys [2007-05-02 6712]
S3 nvcoafl4;nvcoafl4;c:\program files\Norman\NVC\bin\Nvcoafl4.sys [2007-05-02 36472]
S3 nvcoaft4;nvcoaft4;c:\program files\Norman\NVC\bin\Nvcoaft4.sys [2007-05-02 104288]
S3 nvcoarc4;nvcoarc4;c:\program files\Norman\NVC\bin\Nvcoarc4.sys [2007-05-02 25528]
--- Muut muistissa olevat ajurit/palvelut ---
*Deregistered* - mchInjDrv
*Deregistered* - sptd
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d0181d03-a9b5-11dc-9d2a-001a9254b1dd}]
\shell\AutoRun\command - g:\setup\rsrc\autorun.exe
\shell\dinstall\command - g:\directx\dxsetup.exe
.
'Ajoitetut tehtävät'-kansion sisältö
2009-01-14 c:\windows\Tasks\Norton Security Scan for erik.job
- c:\program files\Norton Security Scan\Nss.exe [2008-09-19 04:18]
.
.
------- Täydentävä tarkistus -------
.
uStart Page = hxxp://yle.fi/
Trusted Zone: www.adobe.com
.
.
------- Tiedostokytkennät -------
.
vbefile\shell\open2\command="%SystemRoot%\System32\CScript.exe" "%1" %*
vbsfile\shell\open2\command="%SystemRoot%\System32\CScript.exe" "%1" %*
jsefile\shell\open2\command=%SystemRoot%\System32\CScript.exe "%1" %*
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-14 23:28:26
Windows 6.0.6001 Service Pack 1 NTFS
tarkistaa piilotettuja prosesseja ...
tarkistaa piilotettuja käynnistysarvoja ...
tarkistaa piilotettuja tiedostoja ...
tarkistus on valmis
piilotetut tiedostot: 0
**************************************************************************
.
Valmistumisajankohta: 2009-01-14 23:31:31
ComboFix-quarantined-files.txt 2009-01-14 21:31:26
Ennen ajoa: 72 223 784 960 tavua vapaana
Ajon jälkeen: 72,300,957,696 tavua vapaana
151 --- E O F --- 2009-01-13 21:15:36
|
|
Hujo
Suspended permanently
|
15. tammikuuta 2009 @ 02:51 |
Linkki tähän viestiin
|
Nyt tuon alla olevan Kopioit / liität Tyhjään muistioon
käynnistä nappi >apuohjelmat > muistio
Lainaus:
Folder::
c:\program files\Norton Security Scan
c:\program files\Common Files\Symantec Shared
c:\programdata\Symantec
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
combofix työstää tulee sininen taulu paina numeroa 1 ja enter
Laita tuleva loki tänne.
Sammutat ja käynnistät koneen
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 15. tammikuuta 2009 @ 02:55
|
|
einari25
Newbie
|
16. tammikuuta 2009 @ 23:58 |
Linkki tähän viestiin
|
en oo varma menikö tuo combofixin työstö oikein, ku en ehtiny painella 1 ja enter vaan se alako itestään tarkistelemaan.
ComboFix 09-01-16.02 - erik 2009-01-16 23:39:07.2 - NTFSx86
Microsoft® Windows Vista? Home Basic 6.0.6001.1.1252.1.1035.18.894.251 [GMT 2:00]
Sijainti: c:\users\erik\Desktop\ComboFix.exe
Käytetyt komentorivivalitsimet :: c:\users\erik\Desktop\CFScript.txt
AV: Norman Virus Control ver. 5.99 *On-access scanning disabled* (Outdated)
* Uusi palautuspiste luotu
* Resident AV is active
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Common Files\Symantec Shared
c:\program files\Common Files\Symantec Shared\NSSSetup\{3FADAA19-E595-44CA-A072-58B6B0851768}_2_0_0\ccL70U.dll
c:\program files\Common Files\Symantec Shared\NSSSetup\{3FADAA19-E595-44CA-A072-58B6B0851768}_2_0_0\instopts.dat
c:\program files\Common Files\Symantec Shared\NSSSetup\{3FADAA19-E595-44CA-A072-58B6B0851768}_2_0_0\NSSSetup.exe
c:\program files\Common Files\Symantec Shared\NSSSetup\{3FADAA19-E595-44CA-A072-58B6B0851768}_2_0_0\Setup.msi
c:\program files\Common Files\Symantec Shared\NSSSetup\{3FADAA19-E595-44CA-A072-58B6B0851768}_2_0_0\SymHTML.dll
c:\program files\Common Files\Symantec Shared\NSSSetup\{3FADAA19-E595-44CA-A072-58B6B0851768}_2_0_0\SymTheme.dll
c:\program files\Norton Security Scan
c:\program files\Norton Security Scan\ccL70U.dll
c:\program files\Norton Security Scan\ccScanw.dll
c:\program files\Norton Security Scan\ccVrTrst.dll
c:\program files\Norton Security Scan\dec_abi.dll
c:\program files\Norton Security Scan\DefUtDCD.dll
c:\program files\Norton Security Scan\ecmldr32.dll
c:\program files\Norton Security Scan\help.htm
c:\program files\Norton Security Scan\Microsoft.VC80.CRT.manifest
c:\program files\Norton Security Scan\msl.dll
c:\program files\Norton Security Scan\msvcp80.dll
c:\program files\Norton Security Scan\msvcr80.dll
c:\program files\Norton Security Scan\Nss.exe
c:\program files\Norton Security Scan\patch25d.dll
c:\program files\Norton Security Scan\SAUpdt.dll
c:\program files\Norton Security Scan\ScanCore.dll
c:\program files\Norton Security Scan\ScanRes.dll
c:\program files\Norton Security Scan\SKURes.dll
c:\program files\Norton Security Scan\SymHTML.dll
c:\programdata\Symantec
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\CATALOG.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\CCERASER.DLL
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\ECMSVR32.DLL
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\EECTRL.SYS
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\ERASER.GRD
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\ERASER.SIG
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\ERASER.SPM
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\ERASER.SYS
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\ESRDEF.BIN
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\HH
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\hub.scr
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\NAVENG.SYS
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\NAVENG32.DLL
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\NAVEX15.SYS
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\NAVEX32A.DLL
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\NCSACERT.TXT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\SCRAUTH.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\SYMAVENG.CAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\SYMAVENG.INF
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\SYMERASE.CAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\SYMERASE.INF
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\TCDEFS.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\TCSCAN7.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\TCSCAN8.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\TCSCAN9.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\TECHNOTE.TXT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\TINF.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\TINFIDX.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\TINFL.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\TSCAN1.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\TSCAN1HD.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\V.GRD
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\V.SIG
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\WHATSNEW.TXT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\VIRSCAN.INF
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\VIRSCAN1.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\VIRSCAN2.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\VIRSCAN3.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\VIRSCAN4.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\VIRSCAN5.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\VIRSCAN6.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\VIRSCAN7.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\VIRSCAN8.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\VIRSCAN9.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\VIRSCANT.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\vscanmsx.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090113.024\ZDONE.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\CATALOG.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\CCERASER.DLL
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\ECMSVR32.DLL
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\EECTRL.SYS
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\ERASER.GRD
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\ERASER.SIG
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\ERASER.SPM
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\ERASER.SYS
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\ESRDEF.BIN
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\HH
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\hub.scr
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\NAVENG.SYS
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\NAVENG32.DLL
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\NAVEX15.SYS
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\NAVEX32A.DLL
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\NCSACERT.TXT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\SCRAUTH.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\SYMAVENG.CAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\SYMAVENG.INF
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\SYMERASE.CAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\SYMERASE.INF
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\TCDEFS.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\TCSCAN7.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\TCSCAN8.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\TCSCAN9.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\TECHNOTE.TXT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\TINF.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\TINFIDX.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\TINFL.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\TSCAN1.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\TSCAN1HD.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\V.GRD
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\V.SIG
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\WHATSNEW.TXT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\VIRSCAN.INF
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\VIRSCAN1.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\VIRSCAN2.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\VIRSCAN3.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\VIRSCAN4.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\VIRSCAN5.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\VIRSCAN6.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\VIRSCAN7.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\VIRSCAN8.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\VIRSCAN9.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\VIRSCANT.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\vscanmsx.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\20090115.004\ZDONE.DAT
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\catalog.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\cceraser.dll
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\ecmsvr32.dll
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\eeCtrl.sys
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\ERASER.grd
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\ERASER.sig
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\ERASER.spm
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\ERASER.sys
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\esrdef.bin
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\hh
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\naveng.sys
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\naveng32.dll
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\navex15.sys
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\navex32a.dll
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\ncsacert.txt
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\scrauth.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\symaveng.cat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\symaveng.inf
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\SymErase.cat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\SymErase.inf
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\tcdefs.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\tcscan7.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\tcscan8.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\tcscan9.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\technote.txt
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\tinf.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\tinfidx.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\tinfl.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\tscan1.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\tscan1hd.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\v.grd
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\v.sig
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\whatsnew.txt
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\virscan.inf
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\virscan1.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\virscan2.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\virscan3.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\virscan4.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\virscan5.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\virscan6.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\virscan7.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\virscan8.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\virscan9.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\BinHub\zdone.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\definfo.dat
c:\programdata\Symantec\Definitions\SymcData\virusdefs-2.5-e\usage.dat
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-12-16 to 2009-01-16 )))))))))))))))))
.
2009-01-13 23:12 . 2008-12-16 04:42 288,768 --a------ c:\windows\System32\drivers\srv.sys
2009-01-09 16:01 . 2008-07-06 11:12 114,555 --------- c:\windows\hpqins13.dat.temp
2009-01-08 18:32 . 2009-01-08 18:32 <KANSIO> d-------- c:\program files\Trend Micro
2009-01-02 18:46 . 2009-01-02 18:46 <KANSIO> d-------- c:\users\erik\AppData\Roaming\Malwarebytes
2009-01-02 18:46 . 2009-01-04 18:38 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2009-01-02 18:45 . 2009-01-02 18:45 <KANSIO> d-------- c:\users\All Users\Malwarebytes
2009-01-02 18:45 . 2009-01-02 18:45 <KANSIO> d-------- c:\programdata\Malwarebytes
2009-01-02 18:45 . 2009-01-13 19:36 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-02 18:45 . 2009-01-04 18:38 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-16 10:29 2,944 ----a-w c:\users\erik\AppData\Roaming\wklnhst.dat
2009-01-16 09:03 --------- d-----w c:\program files\Norman
2009-01-13 21:15 --------- d-----w c:\program files\Windows Mail
2009-01-10 16:21 --------- d-----w c:\program files\Google
2009-01-09 21:14 138,384 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-01-09 21:13 187,536 ----a-w c:\windows\System32\PnkBstrB.exe
2008-12-27 15:03 --------- d-----w c:\program files\Common Files\Adobe
2008-12-26 20:49 70,968 ----a-w c:\windows\System32\PnkBstrA.exe
2008-12-08 19:00 410,984 ----a-w c:\windows\System32\deploytk.dll
2008-12-08 19:00 --------- d-----w c:\program files\Java
2008-11-27 08:33 --------- d-----w c:\program files\MSN Messenger
2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:44 28,672 ----a-w c:\windows\System32\Apphlpdm.dll
2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-11-01 01:21 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll
2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe
2008-10-22 03:57 241,152 ----a-w c:\windows\System32\PortableDeviceApi.dll
2008-10-22 01:22 2,048 ----a-w c:\windows\System32\tzres.dll
2008-10-21 05:25 296,960 ----a-w c:\windows\System32\gdi32.dll
2008-10-21 05:25 1,645,568 ----a-w c:\windows\System32\connect.dll
2008-10-16 21:13 1,809,944 ----a-w c:\windows\System32\wuaueng.dll
2008-10-16 21:12 561,688 ----a-w c:\windows\System32\wuapi.dll
2008-10-16 21:09 51,224 ----a-w c:\windows\System32\wuauclt.exe
2008-10-16 21:09 43,544 ----a-w c:\windows\System32\wups2.dll
2008-10-16 21:08 34,328 ----a-w c:\windows\System32\wups.dll
2008-10-16 20:56 1,524,736 ----a-w c:\windows\System32\wucltux.dll
2008-10-16 20:55 83,456 ----a-w c:\windows\System32\wudriver.dll
2008-10-16 12:08 162,064 ----a-w c:\windows\System32\wuwebv.dll
2008-10-16 11:56 31,232 ----a-w c:\windows\System32\wuapp.exe
2008-10-16 04:47 827,392 ----a-w c:\windows\System32\wininet.dll
2008-04-16 18:04 174 --sha-w c:\program files\desktop.ini
.
((((((((((((((((((((((((((((( snapshot@2009-01-14_23.29.21,13 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-01-16 21:14:59 10,134 ----a-r c:\windows\Installer\{36FDBE6E-6684-462B-AE98-9A39A1B200CC}\ARPPRODUCTICON.exe
- 2009-01-14 10:04:03 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2009-01-16 09:03:02 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-01-14 10:04:03 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-01-16 09:03:02 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2009-01-14 21:13:31 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2009-01-16 09:05:04 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2009-01-16 09:05:04 262,144 ---ha-w c:\windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2009-01-14 21:13:25 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2009-01-16 09:05:24 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2009-01-16 09:05:24 262,144 ---ha-w c:\windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2009-01-14 10:04:23 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-01-16 21:24:43 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-01-14 10:04:23 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-01-16 21:24:43 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-01-14 10:04:23 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-01-16 21:24:43 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-01-14 21:22:48 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat
+ 2009-01-16 21:38:06 262,144 ----a-w c:\windows\System32\config\systemprofile\ntuser.dat
+ 2007-03-28 11:57:34 274,944 ----a-w c:\windows\System32\spool\prtprocs\w32x86\1_hpzpp5ha.dll
- 2009-01-14 10:12:00 9,262 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1098233164-1175757859-2552283982-1000_UserData.bin
+ 2009-01-16 09:06:23 9,394 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-1098233164-1175757859-2552283982-1000_UserData.bin
- 2009-01-14 10:12:00 67,546 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2009-01-16 09:06:22 67,686 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2009-01-14 10:11:59 36,622 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-01-16 09:06:15 36,654 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-09 39408]
"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 219520]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-07-12 90112]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"Norman ZANDA"="c:\program files\Norman\Npm\bin\ZLH.EXE" [2008-06-02 273520]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-08 136600]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-06-02 81920]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-29 c:\windows\RtHDVCpl.exe]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{72C1D0D4-9076-41BD-A2C7-8BA8AE67D14E}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"TCP Query User{63E21B54-25D1-4B36-BA88-370128CA3763}c:\\program files\\novalogic\\delta force black hawk down\\dfbhd.exe"= UDP:c:\program files\novalogic\delta force black hawk down\dfbhd.exe:dfbhd
"UDP Query User{390455C8-3A05-44D7-A824-2EF97070A433}c:\\program files\\novalogic\\delta force black hawk down\\dfbhd.exe"= TCP:c:\program files\novalogic\delta force black hawk down\dfbhd.exe:dfbhd
"TCP Query User{47A82542-0794-479E-983E-32819B446148}c:\\program files\\novalogic\\delta force black hawk down\\update.exe"= UDP:c:\program files\novalogic\delta force black hawk down\update.exe:UPDATE
"UDP Query User{9649E913-D1FE-4D9F-AD1B-3FD7B5288A3C}c:\\program files\\novalogic\\delta force black hawk down\\update.exe"= TCP:c:\program files\novalogic\delta force black hawk down\update.exe:UPDATE
"TCP Query User{F4EA2214-B4A0-44C0-AD84-5DA60FBE3226}c:\\program files\\activision\\call of duty 2\\cod2mp_s.exe"= UDP:c:\program files\activision\call of duty 2\cod2mp_s.exe:CoD2MP_s
"UDP Query User{58C9748F-A807-42FA-87EE-613A2C28698E}c:\\program files\\activision\\call of duty 2\\cod2mp_s.exe"= TCP:c:\program files\activision\call of duty 2\cod2mp_s.exe:CoD2MP_s
"TCP Query User{F445E7B9-20E1-4CE7-AD98-A7966EE3E933}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{957A38B9-FE15-44AF-B927-3313B0A656FA}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{BF404466-AFD2-416B-8623-3DA2259FF773}c:\\users\\erik\\counter-strike\\mspaint.exe\\hl.exe"= UDP:c:\users\erik\counter-strike\mspaint.exe\hl.exe:hl.exe
"UDP Query User{25280A5D-FB81-442D-8D01-CB33EF2AF528}c:\\users\\erik\\counter-strike\\mspaint.exe\\hl.exe"= TCP:c:\users\erik\counter-strike\mspaint.exe\hl.exe:hl.exe
R3 nsesvc;Norman Scanner Engine Service;c:\program files\Norman\Nse\Bin\Nsesvc.exe [2008-06-30 322616]
R3 NvcMFlt;NvcMFlt;c:\windows\System32\drivers\nvcv32mf.sys [2008-09-06 19512]
R3 nvcoas;Norman Virus Control on-access component;c:\program files\Norman\NVC\bin\Nvcoas.exe [2008-01-14 183352]
R3 NVCScheduler;Norman Virus Control Scheduler;c:\program files\Norman\NVC\bin\Nvcsched.exe [2007-05-23 146488]
R4 Ndiskio;Ndiskio;c:\program files\Norman\Nse\Bin\Ndiskio.sys [2007-04-15 20448]
S3 nvcfsr;nvcfsr;c:\program files\Norman\NVC\bin\Nvcfsr.sys [2007-05-02 6712]
S3 nvcoafl4;nvcoafl4;c:\program files\Norman\NVC\bin\Nvcoafl4.sys [2007-05-02 36472]
S3 nvcoaft4;nvcoaft4;c:\program files\Norman\NVC\bin\Nvcoaft4.sys [2007-05-02 104288]
S3 nvcoarc4;nvcoarc4;c:\program files\Norman\NVC\bin\Nvcoarc4.sys [2007-05-02 25528]
--- Muut muistissa olevat ajurit/palvelut ---
*Deregistered* - mchInjDrv
*Deregistered* - sptd
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d0181d03-a9b5-11dc-9d2a-001a9254b1dd}]
\shell\AutoRun\command - g:\setup\rsrc\autorun.exe
\shell\dinstall\command - g:\directx\dxsetup.exe
.
'Ajoitetut tehtävät'-kansion sisältö
2009-01-16 c:\windows\Tasks\Norton Security Scan for erik.job
- c:\program files\Norton Security Scan\Nss.exe []
.
.
------- Täydentävä tarkistus -------
.
uStart Page = hxxp://yle.fi/
Trusted Zone: www.adobe.com
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-16 23:45:48
Windows 6.0.6001 Service Pack 1 NTFS
tarkistaa piilotettuja prosesseja ...
tarkistaa piilotettuja käynnistysarvoja ...
tarkistaa piilotettuja tiedostoja ...
tarkistus on valmis
piilotetut tiedostot: 0
**************************************************************************
.
Valmistumisajankohta: 2009-01-16 23:48:46
ComboFix-quarantined-files.txt 2009-01-16 21:48:42
ComboFix2.txt 2009-01-14 21:31:33
Ennen ajoa: 70 653 906 944 tavua vapaana
Ajon jälkeen: 70,993,772,544 tavua vapaana
338 --- E O F --- 2009-01-16 09:49:16
|
|
einari25
Newbie
|
17. tammikuuta 2009 @ 00:16 |
Linkki tähän viestiin
|
norman löytää edelleen troijalaisen, mutta ei voi poistaa sitä
Lainaus:
Troijan hevonen W32/DLoader.dam
muisti käyttäjä erik, isäntä ERIK-PC .
Tartunta tiedosto c:\Users\erik\AppData\Local\Temp\000007B4
Tiedostoa W32/DLoader.dam ei voi poistaa.
|
|
Mainos
|
|
|
|
Hujo
Suspended permanently
|
17. tammikuuta 2009 @ 00:34 |
Linkki tähän viestiin
|
Scannaa koneesi Kaspersky Online Scannerin
Ohjelman käynnistyessä kysytään sallitaanko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.
" Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
" Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
" Klikkaa nyt asetuksia, Scan Settings
" Tarkista asetuksista, että seuraavat ovat valittuina:
o Scan using the following Anti-Virus database:
+ Extended (Jos valittavissa, muuten valitse Standard)
o Scan Options:
+ Scan Archives
+ Scan Mail Bases
" Klikkaa OK
" Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
" Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
" Klikkaa nyt Save as Text-painiketta.
" Tallenna tiedosto työpöydällesi.
" Mikäli haluat jatkaa asian käsittelyä foorumissa niin kopioi tiedoston sisältö viestiisi.
=============
Lataa Atribunen ATF Cleaner
Ohjeet;
Tupla-klikkaa ATF-Cleaner.exe käynnistääksesi ohjelman.Main:n alla valitse: Select All
Klikkaa Empty Selected valintaa.
Jos käytät FireFoxia selaimenasi Klikkaa Firefox yläpuolelta ja valitse: Select All
Klikkaa Empty Selected valintaa.
HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
Jos käytät Operaa selaimenasiKlikkaa Opera yläpuolelta ja valitse: Select All
Klikkaa Empty Selected valintaa taas.
HUOMIO: Jos haluaisit pitää tallennetut salasanasi, klikkaa No kun se sitä kysyy.
Klikkaa Exit päävalikosta sulkeaksesi ohjelman.
Teknistä tukea tulee jos tupla-klikkaat sähköpostiosoitetta joka sijaitsee jokaisen menun alapuolella kyseisessä työkalussa. (Huomatkaa että se tuki on sitten englanniksi)
Voiko tietsikka koskaan toimia?
Viestiä on muokattu lähettämisen jälkeen. Viimeisin muokkaus 17. tammikuuta 2009 @ 00:38
|
|
