cssrrh.exe

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by SwapGSJ, Jun 2, 2008.

  1. SwapGSJ

    SwapGSJ Member

    Joined:
    May 10, 2007
    Messages:
    38
    Likes Received:
    0
    Trophy Points:
    16
    Ongelma siis, windowsissa tulee miljoona ruutua noin sekunnin välein, jossa sanotaan, että "cssrrh.exe on havainnut virheen, ja tuote on suljettava". En ole surffaillut epämääräisillä sivuilla, kone oli muutaman tunnin itsekseen päällä ja yhtäkkiä hullu spämmi.

    F-Securen Virusturva löytyy, AVG anti-spyware ja Ad-Aware ja Spywareblaster.

    Tehtävienhallinta on täynnä cssrrh.exe nimisiä prosesseja. Näyttäisi olevan jotain tekemistä IE:n pluginien kanssa, mutta en käytä IExploreria. Buuttaamiset ja prosessien tappamiset eivät toimi.

    Jos jollain apua tähän ultimaattisen v-mäiseen ongelmaan, apuja please...

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:45:31, on 2.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
    C:\WINDOWS\system32\PnkBstrB.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\DeltTray.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\WinRAR\WinRAR.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Program Files\Internet Explorer\PLUGINS\cssrrh.exe
    C:\WINDOWS\system32\dwwin.exe
    C:\WINDOWS\system32\dwwin.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.soneraplaza.fi
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O4 - HKLM\..\Run: [M-Audio Delta Taskbar Icon] C:\WINDOWS\System32\DeltTray.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
    O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177618467342
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: C:\WINDOWS\sysload32vh.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

    --
    End of file - 7477 bytes
     
    SwapGSJ, Jun 2, 2008
    #1
  2. Hujo

    Hujo Guest

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    ===========


    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Hujo, Jun 2, 2008
    #2
  3. SwapGSJ

    SwapGSJ Member

    Joined:
    May 10, 2007
    Messages:
    38
    Likes Received:
    0
    Trophy Points:
    16
    ComboFix 08-06-01.6 - Möttönen 2008-06-03 15:51:56.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.1393 [GMT 3:00]
    Running from: C:\Documents and Settings\Möttönen\Työpöytä\ComboFix.exe
    * Created a new restore point
    * Resident AV is active


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\regedit.com
    C:\WINDOWS\system32\clauth1.dll
    C:\WINDOWS\system32\clauth2.dll
    C:\WINDOWS\system32\jzn42hj.dll
    C:\WINDOWS\system32\mauwqgfn.ini
    C:\WINDOWS\system32\mjeaemtn.ini
    C:\WINDOWS\system32\prsgrc.dll
    C:\WINDOWS\system32\sghrdxjm.ini
    C:\WINDOWS\system32\ssprs.dll
    C:\WINDOWS\system32\sysdm.exe
    C:\WINDOWS\system32\taskmgr.com
    C:\WINDOWS\system32\uxjklewf.ini
    C:\WINDOWS\system32\xpewtqww.ini
    C:\WINDOWS\system32\ygbreimt.ini

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-05-03 to 2008-06-03 )))))))))))))))))
    .

    2008-06-02 07:05 . 2008-06-02 07:06 <KANSIO> d-------- C:\Documents and Settings\J„rjestelm„nvalvoja
    2008-05-28 21:35 . 2008-05-28 21:35 1,374 --a------ C:\WINDOWS\imsins.BAK
    2008-05-17 13:40 . 2008-05-17 13:40 514 --a------ C:\005.sy1
    2008-05-15 01:52 . 2008-05-15 02:03 742 --a------ C:\WINDOWS\entpack.ini
    2008-05-14 22:58 . 2008-05-14 22:58 <KANSIO> d-------- C:\bblean
    2008-05-14 20:05 . 2008-05-14 20:05 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-05-14 20:04 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
    2008-05-14 20:04 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
    2008-05-14 20:04 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
    2008-05-14 20:04 . 2007-05-16 16:45 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll
    2008-05-14 20:04 . 2008-05-14 20:04 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe
    2008-05-14 20:04 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
    2008-05-14 20:04 . 2007-05-16 16:45 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
    2008-05-14 20:04 . 2008-05-14 20:04 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
    2008-05-14 20:04 . 2008-05-14 20:04 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
    2008-05-08 14:47 . 2008-05-08 14:47 <KANSIO> d-------- C:\Program Files\WinLemm

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-02 04:15 --------- d-----w C:\Program Files\Mozilla Thunderbird
    2008-05-23 16:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser
    2008-05-14 16:54 --------- d-----w C:\Program Files\Electronic Arts
    2008-04-29 19:08 --------- d-----w C:\Program Files\Skype
    2008-04-29 04:17 --------- d-----w C:\Program Files\Unlocker
    2008-04-28 16:13 --------- d-----w C:\Program Files\uTorrent
    2008-04-28 15:21 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-04-28 15:16 --------- d-----w C:\Program Files\Free WMA to MP3 Converter
    2008-04-28 15:15 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
    2008-04-28 15:15 --------- d-----w C:\Program Files\Autodesk
    2008-04-28 15:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
    2008-04-24 17:26 1,024 ----a-w C:\Documents and Settings\All Users\Application Data\1pdfmer.dll
    2008-04-24 17:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\pdf995
    2008-04-22 07:51 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-04-22 07:48 --------- d-----w C:\Program Files\Mathcad
    2008-04-16 08:38 --------- d-----w C:\Program Files\AutoCAD Civil 3D 2008
    2008-04-13 08:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-03-20 19:51 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
    2008-03-10 19:35 9,347,503 ----a-w C:\WINDOWS\Alcohol120_retail_1.9.7.6221.exe
    2008-03-10 19:35 712,704 ----a-w C:\WINDOWS\sysfixmsie36.exe
    2008-03-10 19:35 712,704 ----a-w C:\WINDOWS\jsgjhfekis.exe
    2008-03-10 19:35 4,096 ----a-w C:\WINDOWS\sysload32vh.dll
    2008-02-28 16:12 1,024 ----a-w C:\Documents and Settings\All Users\Application Data\pdfdoc2.dll
    2006-06-23 06:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe
    2007-04-27 10:33 88 --sh--r C:\WINDOWS\system32\170472FE3E.sys
    .

    ------- Sigcheck -------

    2007-06-13 16:22 4919808 eca82e0a7e08ca31d5d3831ea04d5104 C:\WINDOWS\explorer.exe
    2007-06-13 16:10 1033728 fb53c3b1e17f62e8fcb07caaf4c4272e C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
    2001-10-09 15:00 1001472 123c64923213772b84619915dd4ed848 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
    2004-09-14 16:12 1032704 43c0b3d357f319875a51bc111f393147 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
    2007-06-13 16:22 4919808 eca82e0a7e08ca31d5d3831ea04d5104 C:\WINDOWS\ServicePackFiles\i386\explorer.exe
    2007-06-13 16:22 1033728 0f88a5b1ca666754c4c62ad3db4730ef C:\WINDOWS\VCP_SAVE\explorer.exe
    .
    (((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 16:12 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "M-Audio Delta Taskbar Icon"="C:\WINDOWS\System32\DeltTray.exe" [2004-08-26 23:43 56320]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-07-02 18:50 6731312]
    "F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2005-10-26 04:51 122929]
    "F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=C:\WINDOWS\sysload32vh.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.avis"= ff_acm.acm

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "D:\\Pelit\\Medal of Honor Airborne\\UnrealEngine3\\Binaries\\MOHA.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

    R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-10-31 13:01]
    R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2007-12-27 15:43]
    R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2005-08-19 16:37]
    R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-10-06 17:30]
    R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2005-08-19 16:37]

    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-03 15:55:03
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\WINDOWS\system32\ati2evxx.exe
    C:\WINDOWS\system32\ati2evxx.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32.exe
    C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\common\FSMA32.EXE
    C:\Program Files\F-Secure\common\FSMB32.EXE
    C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\F-Secure\common\FCH32.EXE
    C:\Program Files\F-Secure\common\FAMEH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\WINDOWS\system32\PnkBstrB.exe
    C:\Program Files\F-Secure\Anti-Virus\FSRW.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\Program Files\F-Secure\Anti-Virus\FSAV32.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\Program Files\F-Secure\common\FNRB32.exe
    C:\Program Files\F-Secure\FWES\program\fsdfwd.exe
    C:\Program Files\F-Secure\common\FIH32.exe
    C:\Program Files\F-Secure\Anti-Spyware\FSAW.exe
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    .
    **************************************************************************
    .
    Completion time: 2008-06-03 15:56:38 - machine was rebooted [J„rjestelm„nvalvoja]
    ComboFix-quarantined-files.txt 2008-06-03 12:56:35

    Pre-Run: 24,296,493,056 tavua vapaana
    Post-Run: 24,548,401,152 tavua vapaana

    167 --- E O F --- 2008-05-28 18:35:04
     
    SwapGSJ, Jun 3, 2008
    #3
  4. SwapGSJ

    SwapGSJ Member

    Joined:
    May 10, 2007
    Messages:
    38
    Likes Received:
    0
    Trophy Points:
    16

    SDFix: Version 1.187
    Run by J„rjestelm„nvalvoja on 2008-06-03 at 16:06

    Microsoft Windows XP [versio 5.1.2600]
    Running From: C:\SDFix

    Checking Services :


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File

    Rebooting


    Checking Files :

    No Trojan Files Found






    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-03 16:10:05
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
    "s1"=dword:c04cebbb
    "s2"=dword:11c085b7
    "h0"=dword:00000002

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
    "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
    "h0"=dword:00000001
    "ujdew"=hex:bc,37,ee,1a,57,ac,ca,9a,48,9e,04,8c,d6,17,19,de,65,e1,d5,fc,d0,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools\"
    "h0"=dword:00000000
    "khjeh"=hex:10,19,1b,60,e4,65,ad,16,78,ac,db,a7,60,31,39,93,18,e6,2f,3e,a6,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,4d,7b,56,27,0a,21,cc,0c,95,3f,40,d0,1b,ed,c7,c0,b3,..
    "khjeh"=hex:85,6b,d4,a8,cf,80,d2,f6,9c,24,f9,e1,a2,ca,2f,1f,be,72,77,9d,bc,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:d1,1a,6e,5f,88,8a,80,4a,93,0f,c3,dd,c2,b5,5a,f1,c1,95,01,ed,2c,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
    "p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
    "h0"=dword:00000001
    "ujdew"=hex:bc,37,ee,1a,57,ac,ca,9a,48,9e,04,8c,d6,17,19,de,65,e1,d5,fc,d0,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools\"
    "h0"=dword:00000000
    "khjeh"=hex:10,19,1b,60,e4,65,ad,16,78,ac,db,a7,60,31,39,93,18,e6,2f,3e,a6,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,4d,7b,56,27,0a,21,cc,0c,95,3f,40,d0,1b,ed,c7,c0,b3,..
    "khjeh"=hex:85,6b,d4,a8,cf,80,d2,f6,9c,24,f9,e1,a2,ca,2f,1f,be,72,77,9d,bc,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:d1,1a,6e,5f,88,8a,80,4a,93,0f,c3,dd,c2,b5,5a,f1,c1,95,01,ed,2c,..

    scanning hidden registry entries ...

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
    "TracesProcessed"=dword:00000000
    "TracesSuccessful"=dword:00000000
    "LastTraceFailure"=dword:00000000

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0


    Remaining Services :




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "D:\\Pelit\\Medal of Honor Airborne\\UnrealEngine3\\Binaries\\MOHA.exe"="D:\\Pelit\\Medal of Honor Airborne\\UnrealEngine3\\Binaries\\MOHA.exe:*:Enabled:Medal of Honor Airborne"
    "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Messenger (Phone)"
    "C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"="C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe:*:Enabled:F-Secure Automatic Update"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"="C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe:*:Enabled:Crysis_32"
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"="C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32"
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:pnkBstrA"
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:pnkBstrB"
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Messenger (Phone)"
    "C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"="C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe:*:Enabled:F-Secure Automatic Update"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"

    Remaining Files :



    Files with Hidden Attributes :

    Tue 14 Sep 2004 60,416 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe"
    Fri 27 Apr 2007 88 ..SHR --- "C:\WINDOWS\system32\170472FE3E.sys"
    Mon 16 Apr 2007 16 ...H. --- "C:\WINDOWS\system32\g55h542.dll"
    Mon 16 Apr 2007 16 ...H. --- "C:\WINDOWS\system32\h7ph5lq.dll"
    Mon 16 Apr 2007 16 ...H. --- "C:\WINDOWS\system32\imdlmal.dll"
    Thu 8 May 2008 2,516 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
    Mon 16 Apr 2007 16 ...H. --- "C:\WINDOWS\system32\pqtmts7.dll"
    Mon 16 Apr 2007 16 ...H. --- "C:\WINDOWS\system32\tag745r.dll"
    Mon 16 Apr 2007 16 ...H. --- "C:\WINDOWS\system32\tp2yp3v.dll"
    Mon 16 Apr 2007 16 ...H. --- "C:\WINDOWS\system32\x3qd78n.dll"
    Mon 16 Apr 2007 16 ...H. --- "C:\WINDOWS\system32\xrymcjr.dll"
    Tue 24 Apr 2007 77,824 A.SH. --- "C:\Documents and Settings\M”tt”nen\Omat tiedostot\Harkkaty”\~WRL0002.tmp"
    Tue 24 Apr 2007 77,824 A.SH. --- "C:\Documents and Settings\M”tt”nen\Omat tiedostot\Harkkaty”\~WRL0005.tmp"
    Tue 24 Apr 2007 78,848 A.SH. --- "C:\Documents and Settings\M”tt”nen\Omat tiedostot\Harkkaty”\~WRL0689.tmp"
    Thu 8 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\e2cdfda265544b05233b12ad6d933aba\BIT661.tmp"
    Wed 19 Mar 2008 444 ...HR --- "C:\Documents and Settings\M”tt”nen\Application Data\SecuROM\UserData\securom_v7_01.bak"
    Fri 27 Apr 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\4b68f3747273813b8caca916fffc5b50\BIT3F.tmp"

    Finished!

     
    SwapGSJ, Jun 3, 2008
    #4
  5. Hujo

    Hujo Guest

    Lataa TÄSTÄ VundoFix.exe työpöydällesi.

    Tupla-klikkaa VundoFix.exe ajaaksesi sen.
    Klikkaa Scan for Vundo valintaa.
    Kun skannaus on valmis, klikkaa Fix Vundo valintaa.
    Sinulta kysytään haluatko poistaa filut - klikkaa YES.
    Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
    Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
    Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.

    Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
    Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.

    ==========

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.
     
    Hujo, Jun 3, 2008
    #5
  6. SwapGSJ

    SwapGSJ Member

    Joined:
    May 10, 2007
    Messages:
    38
    Likes Received:
    0
    Trophy Points:
    16

    VundoFix V6.7.7

    Checking Java version...

    Scan started at 13:59:58 29.12.2007

    Listing files found while scanning....

    C:\WINDOWS\system32\cqireeho.dll
    C:\WINDOWS\system32\jkkll.dll
    C:\windows\system32\llkkj.ini
    C:\windows\system32\llkkj.ini2
    C:\WINDOWS\system32\nfgqwuam.dll

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\cqireeho.dll
    C:\WINDOWS\system32\cqireeho.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\jkkll.dll
    C:\WINDOWS\system32\jkkll.dll Has been deleted!

    Attempting to delete C:\windows\system32\llkkj.ini
    C:\windows\system32\llkkj.ini Has been deleted!

    Attempting to delete C:\windows\system32\llkkj.ini2
    C:\windows\system32\llkkj.ini2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\nfgqwuam.dll
    C:\WINDOWS\system32\nfgqwuam.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    VundoFix V7.0.5

    Scan started at 20:59:22 2008-06-03

    Listing files found while scanning....

    No infected files were found.




    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:28, on 2008-06-03
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\DeltTray.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\WINDOWS\system32\PnkBstrB.exe
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.soneraplaza.fi
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O4 - HKLM\..\Run: [M-Audio Delta Taskbar Icon] C:\WINDOWS\System32\DeltTray.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
    O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177618467342
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: C:\WINDOWS\sysload32vh.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

    --
    End of file - 7377 bytes


     
    SwapGSJ, Jun 3, 2008
    #6
  7. Hujo

    Hujo Guest

    Nimeä uudelleen
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe <--- skanneri.exe

    =============

    ota uusi combofix ajo
     
    Hujo, Jun 3, 2008
    #7
  8. SwapGSJ

    SwapGSJ Member

    Joined:
    May 10, 2007
    Messages:
    38
    Likes Received:
    0
    Trophy Points:
    16
    Malwarebytes' Anti-Malware 1.14
    Tietokantaversio: 818

    22:04:19 2008-06-03
    mbam-log-6-3-2008 (22-04-19).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
    Tarkistetut kohteet: 175896
    Kulunut aika: 36 minute(s), 38 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)
     
    SwapGSJ, Jun 3, 2008
    #8
  9. Hujo

    Hujo Guest

    Mites kone potkii
     
    Hujo, Jun 3, 2008
    #9
  10. SwapGSJ

    SwapGSJ Member

    Joined:
    May 10, 2007
    Messages:
    38
    Likes Received:
    0
    Trophy Points:
    16
    ComboFix 08-06-01.6 - Möttönen 2008-06-03 22:06:36.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.1298 [GMT 3:00]
    Running from: C:\Documents and Settings\Möttönen\Työpöytä\ComboFix.exe
    * Resident AV is active


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-03 to 2008-06-03 )))))))))))))))))
    .

    2008-06-03 21:26 . 2008-06-03 21:26 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-06-03 21:26 . 2008-06-03 21:26 <KANSIO> d-------- C:\Documents and Settings\Möttönen\Application Data\Malwarebytes
    2008-06-03 21:26 . 2008-06-03 21:26 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-06-03 21:26 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-06-03 21:26 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-06-03 16:03 . 2008-06-03 16:03 <KANSIO> d-------- C:\WINDOWS\ERUNT
    2008-06-03 16:03 . 2008-06-03 16:11 <KANSIO> d-------- C:\SDFix
    2008-06-03 15:56 . 2008-06-03 15:56 <KANSIO> d-------- C:\Documents and Settings\M÷tt÷nen
    2008-06-03 15:56 . 2008-06-03 15:56 <KANSIO> d-------- C:\Documents and Settings\Jõrjestelmõnvalvoja
    2008-06-02 07:06 . 2008-06-02 07:07 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Omat tiedostot
    2008-06-02 07:06 . 2008-06-02 07:07 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Omat tiedostot
    2008-06-02 07:05 . 2007-04-26 23:38 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö
    2008-06-02 07:05 . 2007-04-26 23:38 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö
    2008-06-02 07:05 . 2008-06-03 22:08 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä
    2008-06-02 07:05 . 2008-06-03 22:08 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä
    2008-06-02 07:05 . 2007-04-26 23:38 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö
    2008-06-02 07:05 . 2007-04-26 23:38 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö
    2008-06-02 07:05 . 2008-06-02 07:07 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit
    2008-06-02 07:05 . 2008-06-02 07:07 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit
    2008-06-02 07:05 . 2007-04-26 22:42 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit
    2008-06-02 07:05 . 2007-04-26 22:42 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit
    2008-06-02 07:05 . 2007-04-26 23:38 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko
    2008-06-02 07:05 . 2007-04-26 23:38 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko
    2008-06-02 07:05 . 2008-06-02 07:06 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja
    2008-05-28 21:35 . 2008-05-28 21:35 1,374 --a------ C:\WINDOWS\imsins.BAK
    2008-05-17 13:40 . 2008-05-17 13:40 514 --a------ C:\005.sy1
    2008-05-15 01:52 . 2008-05-15 02:03 742 --a------ C:\WINDOWS\entpack.ini
    2008-05-14 22:58 . 2008-05-14 22:58 <KANSIO> d-------- C:\bblean
    2008-05-14 20:05 . 2008-05-14 20:05 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-05-14 20:05 . 2008-05-14 20:05 22,328 --a------ C:\Documents and Settings\Möttönen\Application Data\PnkBstrK.sys
    2008-05-14 20:04 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
    2008-05-14 20:04 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
    2008-05-14 20:04 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
    2008-05-14 20:04 . 2007-05-16 16:45 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll
    2008-05-14 20:04 . 2008-05-14 20:04 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe
    2008-05-14 20:04 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
    2008-05-14 20:04 . 2007-05-16 16:45 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
    2008-05-14 20:04 . 2008-05-14 20:04 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
    2008-05-14 20:04 . 2008-05-14 20:04 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
    2008-05-08 14:47 . 2008-05-08 14:47 <KANSIO> d-------- C:\Program Files\WinLemm

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-03 18:59 --------- d-----w C:\Documents and Settings\Möttönen\Application Data\Skype
    2008-06-03 15:39 --------- d-----w C:\Documents and Settings\Möttönen\Application Data\skypePM
    2008-06-02 04:15 --------- d-----w C:\Program Files\Mozilla Thunderbird
    2008-05-26 19:06 --------- d-----w C:\Documents and Settings\Möttönen\Application Data\uTorrent
    2008-05-23 16:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser
    2008-05-23 16:44 --------- d-----w C:\Documents and Settings\Möttönen\Application Data\ZoomBrowser EX
    2008-05-14 16:54 --------- d-----w C:\Program Files\Electronic Arts
    2008-05-08 17:50 --------- d-----w C:\Documents and Settings\Möttönen\Application Data\Corel
    2008-05-08 17:43 2,516 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
    2008-04-29 19:08 --------- d-----w C:\Program Files\Skype
    2008-04-29 04:17 --------- d-----w C:\Program Files\Unlocker
    2008-04-28 16:13 --------- d-----w C:\Program Files\uTorrent
    2008-04-28 15:21 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-04-28 15:16 --------- d-----w C:\Program Files\Free WMA to MP3 Converter
    2008-04-28 15:15 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
    2008-04-28 15:15 --------- d-----w C:\Program Files\Autodesk
    2008-04-28 15:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
    2008-04-24 17:26 1,024 ----a-w C:\Documents and Settings\All Users\Application Data\1pdfmer.dll
    2008-04-24 17:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\pdf995
    2008-04-22 07:51 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-04-22 07:51 --------- d-----w C:\Documents and Settings\Möttönen\Application Data\Mathsoft
    2008-04-22 07:48 --------- d-----w C:\Program Files\Mathcad
    2008-04-16 08:55 --------- d-----w C:\Documents and Settings\Möttönen\Application Data\Autodesk
    2008-04-16 08:38 --------- d-----w C:\Program Files\AutoCAD Civil 3D 2008
    2008-04-16 07:56 8,192 ----a-w C:\WINDOWS\system32\x14j9aa.dll
    2008-04-16 07:56 708,608 ----a-w C:\WINDOWS\system32\Resecure60.dll
    2008-04-16 07:56 458,752 ----a-w C:\WINDOWS\system32\LiveUpdate.dll
    2008-04-16 07:56 1,290,240 ----a-w C:\WINDOWS\system32\NGWinSys.dll
    2008-04-13 08:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-04-13 08:39 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
    2008-04-07 11:28 --------- d-----w C:\Documents and Settings\Möttönen\Application Data\SpaceTime 3D
    2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-20 19:51 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-10 19:35 9,347,503 ----a-w C:\WINDOWS\Alcohol120_retail_1.9.7.6221.exe
    2008-03-10 19:35 712,704 ----a-w C:\WINDOWS\sysfixmsie36.exe
    2008-03-10 19:35 712,704 ----a-w C:\WINDOWS\jsgjhfekis.exe
    2008-03-10 19:35 4,096 ----a-w C:\WINDOWS\sysload32vh.dll
    2008-02-28 16:12 1,024 ----a-w C:\Documents and Settings\All Users\Application Data\pdfdoc2.dll
    2006-06-23 06:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe
    2007-04-27 10:33 88 --sh--r C:\WINDOWS\system32\170472FE3E.sys
    .

    ------- Sigcheck -------

    2007-06-13 16:22 4919808 eca82e0a7e08ca31d5d3831ea04d5104 C:\WINDOWS\explorer.exe
    2007-06-13 16:10 1033728 fb53c3b1e17f62e8fcb07caaf4c4272e C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
    2001-10-09 15:00 1001472 123c64923213772b84619915dd4ed848 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
    2004-09-14 16:12 1032704 43c0b3d357f319875a51bc111f393147 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
    2007-06-13 16:22 4919808 eca82e0a7e08ca31d5d3831ea04d5104 C:\WINDOWS\ServicePackFiles\i386\explorer.exe
    2007-06-13 16:22 1033728 0f88a5b1ca666754c4c62ad3db4730ef C:\WINDOWS\VCP_SAVE\explorer.exe
    .
    ((((((((((((((((((((((((((((( snapshot@2008-06-03_15.56.27,04 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-06-03 12:54:49 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-03 15:38:55 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-01 16:12:42 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
    + 2008-06-03 13:04:02 860,160 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
    + 2008-06-03 13:04:02 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
    + 2008-06-01 16:12:42 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
    + 2008-06-03 13:03:51 860,160 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
    + 2008-06-03 13:03:51 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-11-07 16:34 3739672]
    "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 13:48 157592]
    "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 18:22 21898024]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 16:12 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "M-Audio Delta Taskbar Icon"="C:\WINDOWS\System32\DeltTray.exe" [2004-08-26 23:43 56320]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-07-02 18:50 6731312]
    "F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2005-10-26 04:51 122929]
    "F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    F-Secure Automatic Update.lnk - C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe [2007-12-27 15:43:54 32807]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=C:\WINDOWS\sysload32vh.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.avis"= ff_acm.acm

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "D:\\Pelit\\Medal of Honor Airborne\\UnrealEngine3\\Binaries\\MOHA.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

    R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-10-31 13:01]
    R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2007-12-27 15:43]
    R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2005-08-19 16:37]
    R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-10-06 17:30]
    R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2005-08-19 16:37]

    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-03 22:08:04
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    C:\WINDOWS\explorer.exe [9584] 0x883C5020

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-06-03 22:08:59
    ComboFix-quarantined-files.txt 2008-06-03 19:08:53
    ComboFix2.txt 2008-06-03 12:56:39

    Pre-Run: 24,442,789,888 tavua vapaana
    Post-Run: 24,477,704,192 tavua vapaana

    178 --- E O F --- 2008-05-28 18:35:04




    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 22:09:49, on 3.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\DeltTray.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\WINDOWS\system32\PnkBstrB.exe
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\skanneri.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.soneraplaza.fi
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O4 - HKLM\..\Run: [M-Audio Delta Taskbar Icon] C:\WINDOWS\System32\DeltTray.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
    O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177618467342
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: C:\WINDOWS\sysload32vh.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

    --
    End of file - 7409 bytes
     
    SwapGSJ, Jun 3, 2008
    #10
  11. SwapGSJ

    SwapGSJ Member

    Joined:
    May 10, 2007
    Messages:
    38
    Likes Received:
    0
    Trophy Points:
    16
    Hyvin tuntuu potkivan, ei ainakaa enää tule mitään virheilmoituksia etc etc... (ellei jotain piilopöpöjä jäänyt?) Kiitoksia erittäin paljon avusta!!!
     
    SwapGSJ, Jun 3, 2008
    #11
  12. Hujo

    Hujo Guest

    Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

    Tallenna se nimellä CFScript.txt

    Sitten raahaa CFScript ComboFix.exeen kuten alla.
    [​IMG]

    Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
     
    Last edited by a moderator: Jun 3, 2008
    Hujo, Jun 3, 2008
    #12
  13. SwapGSJ

    SwapGSJ Member

    Joined:
    May 10, 2007
    Messages:
    38
    Likes Received:
    0
    Trophy Points:
    16
    Jahas, sen verran täytyy ottaa pakkia että uudelleenkäynnistyksen jälkeen alkoi sama rumba, joten jotain ötököitä tuntuisi vieläkin myllertävän koneen uumenissa...
     
    SwapGSJ, Jun 3, 2008
    #13
  14. SwapGSJ

    SwapGSJ Member

    Joined:
    May 10, 2007
    Messages:
    38
    Likes Received:
    0
    Trophy Points:
    16
    ComboFix 08-06-01.6 - Möttönen 2008-06-03 22:23:56.3 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.1414 [GMT 3:00]
    Running from: C:\Documents and Settings\Möttönen\Työpöytä\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Möttönen\Työpöytä\CFScript.txt
    * Created a new restore point
    * Resident AV is active


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\WINDOWS\sysload32vh.dll
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\sysload32vh.dll

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-05-03 to 2008-06-03 )))))))))))))))))
    .

    2008-06-03 21:26 . 2008-06-03 21:26 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-06-03 21:26 . 2008-06-03 21:26 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-06-03 21:26 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-06-03 21:26 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-06-03 16:03 . 2008-06-03 16:03 <KANSIO> d-------- C:\WINDOWS\ERUNT
    2008-06-03 16:03 . 2008-06-03 16:11 <KANSIO> d-------- C:\SDFix
    2008-06-03 15:56 . 2008-06-03 15:56 <KANSIO> d-------- C:\Documents and Settings\Möttönen
    2008-06-03 15:56 . 2008-06-03 15:56 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja
    2008-06-02 07:05 . 2008-06-02 07:06 <KANSIO> d-------- C:\Documents and Settings\J„rjestelm„nvalvoja
    2008-05-28 21:35 . 2008-05-28 21:35 1,374 --a------ C:\WINDOWS\imsins.BAK
    2008-05-17 13:40 . 2008-05-17 13:40 514 --a------ C:\005.sy1
    2008-05-15 01:52 . 2008-05-15 02:03 742 --a------ C:\WINDOWS\entpack.ini
    2008-05-14 22:58 . 2008-05-14 22:58 <KANSIO> d-------- C:\bblean
    2008-05-14 20:05 . 2008-05-14 20:05 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-05-14 20:04 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
    2008-05-14 20:04 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
    2008-05-14 20:04 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
    2008-05-14 20:04 . 2007-05-16 16:45 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll
    2008-05-14 20:04 . 2008-05-14 20:04 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe
    2008-05-14 20:04 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
    2008-05-14 20:04 . 2007-05-16 16:45 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
    2008-05-14 20:04 . 2008-05-14 20:04 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
    2008-05-14 20:04 . 2008-05-14 20:04 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
    2008-05-08 14:47 . 2008-05-08 14:47 <KANSIO> d-------- C:\Program Files\WinLemm

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-02 04:15 --------- d-----w C:\Program Files\Mozilla Thunderbird
    2008-05-23 16:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser
    2008-05-14 16:54 --------- d-----w C:\Program Files\Electronic Arts
    2008-05-08 17:43 2,516 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
    2008-04-29 19:08 --------- d-----w C:\Program Files\Skype
    2008-04-29 04:17 --------- d-----w C:\Program Files\Unlocker
    2008-04-28 16:13 --------- d-----w C:\Program Files\uTorrent
    2008-04-28 15:21 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-04-28 15:16 --------- d-----w C:\Program Files\Free WMA to MP3 Converter
    2008-04-28 15:15 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
    2008-04-28 15:15 --------- d-----w C:\Program Files\Autodesk
    2008-04-28 15:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
    2008-04-24 17:26 1,024 ----a-w C:\Documents and Settings\All Users\Application Data\1pdfmer.dll
    2008-04-24 17:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\pdf995
    2008-04-22 07:51 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-04-22 07:48 --------- d-----w C:\Program Files\Mathcad
    2008-04-16 08:38 --------- d-----w C:\Program Files\AutoCAD Civil 3D 2008
    2008-04-16 07:56 8,192 ----a-w C:\WINDOWS\system32\x14j9aa.dll
    2008-04-16 07:56 708,608 ----a-w C:\WINDOWS\system32\Resecure60.dll
    2008-04-16 07:56 458,752 ----a-w C:\WINDOWS\system32\LiveUpdate.dll
    2008-04-16 07:56 1,290,240 ----a-w C:\WINDOWS\system32\NGWinSys.dll
    2008-04-13 08:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-04-13 08:39 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
    2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-20 19:51 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-10 19:35 9,347,503 ----a-w C:\WINDOWS\Alcohol120_retail_1.9.7.6221.exe
    2008-03-10 19:35 712,704 ----a-w C:\WINDOWS\sysfixmsie36.exe
    2008-03-10 19:35 712,704 ----a-w C:\WINDOWS\jsgjhfekis.exe
    2008-02-28 16:12 1,024 ----a-w C:\Documents and Settings\All Users\Application Data\pdfdoc2.dll
    2006-06-23 06:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe
    2007-04-27 10:33 88 --sh--r C:\WINDOWS\system32\170472FE3E.sys
    .

    ------- Sigcheck -------

    2007-06-13 16:22 4919808 eca82e0a7e08ca31d5d3831ea04d5104 C:\WINDOWS\explorer.exe
    2007-06-13 16:10 1033728 fb53c3b1e17f62e8fcb07caaf4c4272e C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
    2001-10-09 15:00 1001472 123c64923213772b84619915dd4ed848 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
    2004-09-14 16:12 1032704 43c0b3d357f319875a51bc111f393147 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
    2007-06-13 16:22 4919808 eca82e0a7e08ca31d5d3831ea04d5104 C:\WINDOWS\ServicePackFiles\i386\explorer.exe
    2007-06-13 16:22 1033728 0f88a5b1ca666754c4c62ad3db4730ef C:\WINDOWS\VCP_SAVE\explorer.exe
    .
    ((((((((((((((((((((((((((((( snapshot@2008-06-03_15.56.27,04 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-06-03 12:54:49 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-03 19:26:27 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-01 16:12:42 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
    + 2008-06-03 13:04:02 860,160 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
    + 2008-06-03 13:04:02 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
    + 2008-06-01 16:12:42 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
    + 2008-06-03 13:03:51 860,160 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
    + 2008-06-03 13:03:51 8,192 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
    .
    (((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-11-07 16:34 3739672]
    "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 13:48 157592]
    "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 18:22 21898024]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 16:12 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "M-Audio Delta Taskbar Icon"="C:\WINDOWS\System32\DeltTray.exe" [2004-08-26 23:43 56320]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-07-02 18:50 6731312]
    "F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2005-10-26 04:51 122929]
    "F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.avis"= ff_acm.acm

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "D:\\Pelit\\Medal of Honor Airborne\\UnrealEngine3\\Binaries\\MOHA.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
    "C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

    R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-10-31 13:01]
    R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2007-12-27 15:43]
    R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2005-08-19 16:37]
    R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-10-06 17:30]
    R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2005-08-19 16:37]

    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-03 22:26:59
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\WINDOWS\system32\ati2evxx.exe
    C:\WINDOWS\system32\ati2evxx.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32.exe
    C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\common\FSMA32.EXE
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\F-Secure\common\FSMB32.EXE
    C:\WINDOWS\system32\PnkBstrB.exe
    C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
    C:\Program Files\F-Secure\common\FCH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure\common\FAMEH32.EXE
    C:\WINDOWS\system32\wdfmgr.exe
    C:\Program Files\F-Secure\Anti-Virus\FSRW.exe
    C:\Program Files\F-Secure\Anti-Virus\FSAV32.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\Program Files\F-Secure\common\FNRB32.exe
    C:\Program Files\F-Secure\FWES\program\fsdfwd.exe
    C:\Program Files\F-Secure\common\FIH32.exe
    C:\Program Files\F-Secure\Anti-Spyware\FSAW.exe
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    .
    **************************************************************************
    .
    Completion time: 2008-06-03 22:29:22 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-06-03 19:29:18
    ComboFix2.txt 2008-06-03 19:09:00
    ComboFix3.txt 2008-06-03 12:56:39

    Pre-Run: 24,459,272,192 tavua vapaana
    Post-Run: 24,452,620,288 tavua vapaana

    190 --- E O F --- 2008-05-28 18:35:04


    Nyt ei tullut virheilmoituksia tuon ohjelman aiheuttaman uudelleenkäynnistyksen jälkeen...
     
    SwapGSJ, Jun 3, 2008
    #14
  15. Hujo

    Hujo Guest

    scannaa uusi hjt:n loki
     
    Hujo, Jun 3, 2008
    #15
  16. SwapGSJ

    SwapGSJ Member

    Joined:
    May 10, 2007
    Messages:
    38
    Likes Received:
    0
    Trophy Points:
    16
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 16:48:15, on 4.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\PnkBstrB.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\DeltTray.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\DAEMON Tools\daemon.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\skanneri.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.soneraplaza.fi
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O4 - HKLM\..\Run: [M-Audio Delta Taskbar Icon] C:\WINDOWS\System32\DeltTray.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
    O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177618467342
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

    --
    End of file - 7274 bytes
     
    SwapGSJ, Jun 4, 2008
    #16
  17. Hujo

    Hujo Guest

    Javan päivitys ja välimuistin tyhjennys:

    1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
    2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
    Niissä pitäisi olla seuraava kuva vieressä: [​IMG]

    3. Valitse kaikki entiset Java versiosi ja valitse Poista.
    4. Asenna uusin Java päivitys seuraavasta linkistä..
    5. Käynnistä kone uudelleen asennuksen jälkeen:

    http://java.sun.com/javase/downloads/index.jsp

    Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u6

    Paina Download

    Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.

    6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).

    7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.

    (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
    Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).

    8. Varmista että kaikki kaksi valintaa ovat rastitettuja:

    *Applications and Applets

    *Trace and Log Files

    Ja paina OK -nappia

    9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.

    10. Klikkaa OK jättääksesi Java asetusikkunasi.
     
    Hujo, Jun 4, 2008
    #17

Share This Page