Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:28:24, on 7.2.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe C:\WINDOWS\CTHELPER.EXE C:\WINDOWS\system32\CTXFIHLP.EXE C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\WINDOWS\SYSTEM32\CTXFISPI.EXE C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\TuneUp Utilities 2008\Integrator.exe C:\Program Files\CCleaner\CCleaner.exe C:\Documents and Settings\Matti\Työpöytä\HiJackThis_v2.0.2.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll" O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15034/CTPID.cab O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe -- End of file - 8898 bytes
1.Lataa combofix.exe työpöydällesi jommastakummasta linkistä: combofix1 combofix2 2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
ComboFix 08-02-11.2 - Matti 2008-02-11 18:45:31.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.1482 [GMT 2:00] Running from: C:\Documents and Settings\Matti\Työpöytä\ComboFix(2).exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-01-11 to 2008-02-11 ))))))))))))))))) . 2008-02-10 19:35 . 2008-02-10 19:36 <KANSIO> d-------- C:\Program Files\HijackThis 2008-02-08 15:54 . 2008-02-08 15:54 0 --a------ C:\WINDOWS\Irremote.ini 2008-02-08 13:52 . 2008-02-08 15:51 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-02-07 16:29 . 2008-02-07 16:29 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\teamspeak2 2008-02-07 15:48 . 2008-02-07 15:48 <KANSIO> d-------- C:\Program Files\Spybot - Search & Destroy 2008-02-07 15:48 . 2008-02-07 16:01 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-02-07 15:38 . 2008-02-07 15:38 <KANSIO> d-------- C:\Program Files\MSXML 4.0 2008-02-07 00:15 . 2008-02-07 00:19 <KANSIO> d-------- C:\Program Files\TuneUp Utilities 2008 2008-02-07 00:15 . 2008-02-07 00:15 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\TuneUp Software 2008-02-07 00:15 . 2008-02-07 00:15 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software 2008-02-07 00:15 . 2008-02-07 00:18 306,432 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe 2008-02-07 00:15 . 2007-12-20 10:41 29,440 --a------ C:\WINDOWS\system32\uxtuneup.dll 2008-02-07 00:00 . 2008-02-07 00:00 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet 2008-02-06 22:51 . 2008-02-06 23:59 <KANSIO> d-------- C:\Program Files\Adobe 2008-02-06 22:50 . 2008-02-06 22:50 <KANSIO> d-------- C:\Program Files\Common Files\Macrovision Shared 2008-02-06 22:26 . 2008-02-06 22:26 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\Nero 2008-02-06 22:20 . 2008-02-06 22:20 <KANSIO> d-------- C:\Program Files\Nero 2008-02-06 22:20 . 2008-02-08 15:55 <KANSIO> d-------- C:\Program Files\Common Files\Nero 2008-02-06 22:20 . 2008-02-08 15:55 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Nero 2008-02-06 22:09 . 2008-02-06 23:39 <KANSIO> d-------- C:\Program Files\Bonjour 2008-02-06 22:06 . 2006-03-31 12:40 2,388,176 --a------ C:\WINDOWS\system32\d3dx9_30.dll 2008-02-06 22:06 . 2005-12-05 18:09 2,323,664 --a------ C:\WINDOWS\system32\d3dx9_28.dll 2008-02-06 20:23 . 2008-02-06 23:33 <KANSIO> d-------- C:\Program Files\Common Files\Adobe 2008-02-06 19:02 . 2008-02-06 19:02 <KANSIO> d-------- C:\Program Files\AdVantage 2008-02-06 19:01 . 2008-02-06 19:19 <KANSIO> d-------- C:\Program Files\DAEMON Tools Lite 2008-02-06 18:44 . 2008-02-06 18:44 <KANSIO> d-------- C:\Program Files\BSplayerPro 2008-02-06 18:44 . 2008-02-06 19:23 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\BSplayer PRO 2008-02-05 15:01 . 2004-09-14 16:12 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2008-02-04 22:21 . 2008-02-04 22:23 <KANSIO> d-------- C:\Program Files\Winamp 2008-02-04 22:21 . 2008-02-04 22:29 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\Winamp 2008-02-04 00:02 . 2008-02-04 00:02 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2008-02-04 00:01 . 2008-02-04 00:01 <KANSIO> dr-h----- C:\Documents and Settings\Matti\Application Data\SecuROM 2008-02-04 00:00 . 2008-02-04 00:00 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2008-02-04 00:00 . 2008-02-04 00:00 22,328 --a------ C:\Documents and Settings\Matti\Application Data\PnkBstrK.sys 2008-02-03 23:51 . 2008-02-04 15:09 <KANSIO> d-------- C:\WINDOWS\SxsCaPendDel 2008-02-03 23:51 . 2008-02-03 23:51 <KANSIO> d-------- C:\Program Files\Electronic Arts 2008-02-03 23:49 . 2008-02-03 23:49 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\DAEMON Tools 2008-02-03 22:07 . 2008-02-03 22:07 716,272 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2008-01-31 23:19 . 2008-02-10 20:03 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\NoNameScript 2008-01-31 17:08 . 2008-01-31 17:09 <KANSIO> d-------- C:\Program Files\NVIDIA nTune Performance Application 2008-01-31 14:39 . 2008-01-31 14:41 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\fretsonfire 2008-01-31 14:38 . 2008-01-31 14:40 <KANSIO> d-------- C:\Program Files\Frets on Fire 2008-01-31 14:07 . 2008-01-02 10:21 17,642,616 --a------ C:\WINDOWS\system32\MRT.exe 2008-01-31 14:02 . 2008-01-31 14:02 <KANSIO> d-------- C:\Program Files\uTorrent 2008-01-31 14:02 . 2008-02-11 07:49 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\uTorrent 2008-01-29 06:42 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-01-29 06:42 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-01-29 06:42 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-01-29 00:29 . 2008-01-29 00:29 268 --ah----- C:\sqmdata00.sqm 2008-01-29 00:29 . 2008-01-29 00:29 244 --ah----- C:\sqmnoopt00.sqm 2008-01-28 22:38 . 2008-01-29 00:29 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\X-Chat 2 2008-01-28 22:35 . 2008-02-10 18:49 <KANSIO> d-------- C:\Program Files\mIRC 2008-01-28 22:30 . 2008-01-31 22:36 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\mIRC 2008-01-28 22:24 . 2008-01-28 22:24 <KANSIO> d-------- C:\WINDOWS\Sun 2008-01-28 22:24 . 2007-09-24 23:31 139,264 --a------ C:\WINDOWS\system32\javaws.exe 2008-01-28 22:24 . 2007-09-24 22:30 135,168 --a------ C:\WINDOWS\system32\javaw.exe 2008-01-28 22:24 . 2007-09-24 22:30 135,168 --a------ C:\WINDOWS\system32\java.exe 2008-01-28 22:24 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-01-28 22:23 . 2008-01-28 22:24 <KANSIO> d-------- C:\Program Files\Java 2008-01-28 22:22 . 2008-01-28 22:22 <KANSIO> d-------- C:\Program Files\Common Files\Java 2008-01-28 15:43 . 2008-01-28 15:44 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\Ventrilo 2008-01-28 13:43 . 2007-07-09 15:11 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll 2008-01-28 13:36 . 2008-01-29 00:29 <KANSIO> d-------- C:\Documents and Settings\Matti\Contacts 2008-01-28 13:15 . 2008-01-28 13:35 <KANSIO> d-------- C:\Program Files\Windows Live 2008-01-28 13:15 . 2008-01-28 13:35 <KANSIO> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller 2008-01-28 13:15 . 2008-01-28 13:32 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-01-28 13:05 . 2008-01-28 13:05 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\Logitech 2008-01-28 13:05 . 2008-01-28 13:05 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\LogiShrd 2008-01-28 13:04 . 2007-11-15 10:06 301,656 --a------ C:\WINDOWS\system32\BtCoreIf.dll 2008-01-28 13:04 . 2007-11-15 10:07 170,512 --a------ C:\WINDOWS\system32\kemutb.dll 2008-01-28 13:04 . 2007-11-15 10:07 141,840 --a------ C:\WINDOWS\system32\KemUtil.dll 2008-01-28 13:04 . 2007-11-15 10:07 117,264 --a------ C:\WINDOWS\system32\KemWnd.dll 2008-01-28 13:04 . 2007-11-15 10:07 76,304 --a------ C:\WINDOWS\system32\KemXML.dll 2008-01-28 13:04 . 2008-01-28 13:04 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-01-28 13:04 . 2008-01-28 13:04 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf 2008-01-28 13:03 . 2008-01-28 13:13 <KANSIO> d-------- C:\Program Files\Logitech 2008-01-28 13:03 . 2008-01-28 13:04 <KANSIO> d-------- C:\Program Files\Common Files\Logishrd 2008-01-28 13:03 . 2008-01-28 13:03 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\InstallShield 2008-01-28 13:03 . 2008-01-28 13:13 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Logitech 2008-01-28 13:02 . 2008-01-29 08:00 <KANSIO> d--h----- C:\WINDOWS\$hf_mig$ 2008-01-28 06:56 . 2008-01-28 06:56 <KANSIO> d-------- C:\Program Files\Lavalys 2008-01-28 06:55 . 2008-02-11 18:38 <KANSIO> d-------- C:\Program Files\Steam 2008-01-28 06:55 . 2008-01-28 06:55 <KANSIO> d-------- C:\Program Files\CCleaner 2008-01-28 06:53 . 2008-01-28 06:53 <KANSIO> d-------- C:\Program Files\VentriloMIX 2008-01-28 06:53 . 2008-01-28 06:53 <KANSIO> d-------- C:\Program Files\Ventrilo 2008-01-28 06:53 . 2008-02-07 00:15 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-01-28 06:53 . 2008-01-28 06:53 <KANSIO> d-------- C:\Fraps 2008-01-28 06:46 . 2008-01-28 06:46 1,158 --a------ C:\WINDOWS\mozver.dat 2008-01-28 06:45 . 2008-02-11 18:38 <KANSIO> d-------- C:\Program Files\Mozilla Firefox 2008-01-28 06:45 . 2008-01-28 06:45 <KANSIO> d-------- C:\Documents and Settings\Matti\Application Data\Talkback 2008-01-28 06:45 . 2008-01-28 06:45 0 --a------ C:\WINDOWS\nsreg.dat 2008-01-28 06:37 . 2008-02-11 18:36 64,900 --a------ C:\WINDOWS\system32\DVCState-{00000001-00000000-0000000A-00001102-00000005-00311102}.rfx 2008-01-28 06:37 . 2008-02-11 18:36 54,524 --a------ C:\WINDOWS\system32\BMXStateBkp-{00000001-00000000-0000000A-00001102-00000005-00311102}.rfx 2008-01-28 06:37 . 2008-02-11 18:36 54,524 --a------ C:\WINDOWS\system32\BMXState-{00000001-00000000-0000000A-00001102-00000005-00311102}.rfx 2008-01-28 06:37 . 2003-06-12 23:25 7,062 --a------ C:\WINDOWS\system32\audiopid.vxd 2008-01-28 06:37 . 2008-02-11 18:36 1,080 --a------ C:\WINDOWS\system32\settingsbkup.sfm 2008-01-28 06:37 . 2008-02-11 18:36 1,080 --a------ C:\WINDOWS\system32\settings.sfm 2008-01-28 06:36 . 2000-05-22 10:58 647,872 --------- C:\WINDOWS\system32\Mscomct2.ocx 2008-01-28 06:36 . 1999-10-10 19:00 41,984 --------- C:\WINDOWS\Ctregrun.exe 2008-01-28 06:35 . 2000-05-11 01:00 90,112 --------- C:\WINDOWS\Updreg.EXE . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-11 16:37 2,145,386,496 --sha-w C:\pagefile.sys 2008-02-04 20:23 --------- d-----w C:\Program Files\Windows Media Player 2008-02-03 22:00 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe 2008-02-03 21:59 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe 2008-02-03 21:59 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe 2008-01-28 14:42 --------- d-----w C:\Program Files\Outlook Express 2008-01-28 14:42 --------- d-----w C:\Program Files\Common Files\System 2008-01-28 14:39 --------- d-----w C:\Program Files\Internet Explorer 2008-01-28 04:34 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll 2008-01-28 04:34 409,600 ----a-w C:\WINDOWS\system32\wrap_oal.dll 2008-01-28 03:52 8,972 ----a-w C:\WINDOWS\PCHEALTH\HELPCTR\Config\Cntstore.bin 2008-01-28 03:51 --------- d-----w C:\Program Files\NetMeeting 2008-01-28 03:50 47,564 --sha-r C:\NTDETECT.COM 2008-01-28 01:11 0 --sha-r C:\MSDOS.SYS 2008-01-28 01:11 0 --sha-r C:\IO.SYS 2008-01-28 01:11 0 ----a-w C:\CONFIG.SYS 2008-01-28 01:11 0 ----a-w C:\AUTOEXEC.BAT 2008-01-28 01:11 --------- d-----w C:\Program Files\xerox 2008-01-28 01:11 --------- d-----w C:\Program Files\microsoft frontpage 2008-01-28 01:09 --------- d-----w C:\Program Files\Common Files\Services 2008-01-28 01:08 --------- d-----w C:\Program Files\MSN 2008-01-28 01:08 --------- d-----w C:\Program Files\ComPlus Applications 2007-12-05 00:53 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE 2007-12-04 23:41 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll 2007-12-04 23:41 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll 2007-12-04 23:41 8,523,776 ----a-w C:\WINDOWS\system32\nvcpl.dll 2007-12-04 23:41 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe 2007-12-04 23:41 6,901,760 ----a-w C:\WINDOWS\system32\nvoglnt.dll 2007-12-04 23:41 6,549,504 ----a-w C:\WINDOWS\system32\nvdisps.dll 2007-12-04 23:41 5,773,568 ----a-w C:\WINDOWS\system32\nv4_disp.dll 2007-12-04 23:41 5,611,520 ----a-w C:\WINDOWS\system32\nvdispsr.dll 2007-12-04 23:41 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll 2007-12-04 23:41 458,752 ----a-w C:\WINDOWS\system32\nvmccssr.dll 2007-12-04 23:41 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll 2007-12-04 23:41 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe 2007-12-04 23:41 425,984 ----a-w C:\WINDOWS\system32\keystone.exe 2007-12-04 23:41 385,024 ----a-w C:\WINDOWS\system32\nvapi.dll 2007-12-04 23:41 35,328 ----a-w C:\WINDOWS\system32\nvcodins.dll 2007-12-04 23:41 35,328 ----a-w C:\WINDOWS\system32\nvcod.dll 2007-12-04 23:41 335,872 ----a-w C:\WINDOWS\system32\nvwrses.dll 2007-12-04 23:41 335,872 ----a-w C:\WINDOWS\system32\nvwrsel.dll 2007-12-04 23:41 327,680 ----a-w C:\WINDOWS\system32\nvwrsfr.dll 2007-12-04 23:41 327,680 ----a-w C:\WINDOWS\system32\nvwrsesm.dll 2007-12-04 23:41 327,680 ----a-w C:\WINDOWS\system32\nvrshe.dll 2007-12-04 23:41 327,680 ----a-w C:\WINDOWS\system32\nvrsar.dll 2007-12-04 23:41 323,584 ----a-w C:\WINDOWS\system32\nvwrspt.dll 2007-12-04 23:41 323,584 ----a-w C:\WINDOWS\system32\nvwrsit.dll 2007-12-04 23:41 319,488 ----a-w C:\WINDOWS\system32\nvwrsptb.dll 2007-12-04 23:41 319,488 ----a-w C:\WINDOWS\system32\nvwrsnl.dll 2007-12-04 23:41 315,392 ----a-w C:\WINDOWS\system32\nvwrsru.dll 2007-12-04 23:41 315,392 ----a-w C:\WINDOWS\system32\nvwrshu.dll 2007-12-04 23:41 311,296 ----a-w C:\WINDOWS\system32\nvwrsde.dll 2007-12-04 23:41 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll 2007-12-04 23:41 303,104 ----a-w C:\WINDOWS\system32\nvwrstr.dll 2007-12-04 23:41 303,104 ----a-w C:\WINDOWS\system32\nvwrssl.dll 2007-12-04 23:41 303,104 ----a-w C:\WINDOWS\system32\nvwrsfi.dll 2007-12-04 23:41 3,715,072 ----a-w C:\WINDOWS\system32\nvvitvsr.dll 2007-12-04 23:41 3,710,976 ----a-w C:\WINDOWS\system32\nvvitvs.dll 2007-12-04 23:41 3,420,160 ----a-w C:\WINDOWS\system32\nvgames.dll 2007-12-04 23:41 3,334,144 ----a-w C:\WINDOWS\system32\nvgamesr.dll 2007-12-04 23:41 299,008 ----a-w C:\WINDOWS\system32\nvwrssk.dll 2007-12-04 23:41 299,008 ----a-w C:\WINDOWS\system32\nvwrsno.dll 2007-12-04 23:41 294,912 ----a-w C:\WINDOWS\system32\nvwrssv.dll 2007-12-04 23:41 294,912 ----a-w C:\WINDOWS\system32\nvwrspl.dll 2007-12-04 23:41 294,912 ----a-w C:\WINDOWS\system32\nvwrsda.dll 2007-12-04 23:41 290,816 ----a-w C:\WINDOWS\system32\nvwrsth.dll 2007-12-04 23:41 286,720 ----a-w C:\WINDOWS\system32\nvwrseng.dll 2007-12-04 23:41 286,720 ----a-w C:\WINDOWS\system32\nvwrscs.dll 2007-12-04 23:41 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll 2007-12-04 23:41 282,624 ----a-w C:\WINDOWS\system32\nvwrsar.dll 2007-12-04 23:41 282,624 ----a-w C:\WINDOWS\system32\nvrsfr.dll 2007-12-04 23:41 282,624 ----a-w C:\WINDOWS\system32\nvrses.dll 2007-12-04 23:41 282,624 ----a-w C:\WINDOWS\system32\nvrsel.dll 2007-12-04 23:41 278,528 ----a-w C:\WINDOWS\system32\nvwrshe.dll 2007-12-04 23:41 278,528 ----a-w C:\WINDOWS\system32\nvrsit.dll 2007-12-04 23:41 278,528 ----a-w C:\WINDOWS\system32\nvrsde.dll 2007-12-04 23:41 274,432 ----a-w C:\WINDOWS\system32\nvrspt.dll 2007-12-04 23:41 274,432 ----a-w C:\WINDOWS\system32\nvrsnl.dll 2007-12-04 23:41 274,432 ----a-w C:\WINDOWS\system32\nvrsesm.dll 2007-12-04 23:41 270,336 ----a-w C:\WINDOWS\system32\nvrsru.dll 2007-12-04 23:41 266,240 ----a-w C:\WINDOWS\system32\nvrsptb.dll 2007-12-04 23:41 266,240 ----a-w C:\WINDOWS\system32\nvrsja.dll 2007-12-04 23:41 258,048 ----a-w C:\WINDOWS\system32\nvrstr.dll 2007-12-04 23:41 258,048 ----a-w C:\WINDOWS\system32\nvrssl.dll 2007-12-04 23:41 258,048 ----a-w C:\WINDOWS\system32\nvrssk.dll 2007-12-04 23:41 258,048 ----a-w C:\WINDOWS\system32\nvrsko.dll 2007-12-04 23:41 258,048 ----a-w C:\WINDOWS\system32\nvrshu.dll 2007-12-04 23:41 253,952 ----a-w C:\WINDOWS\system32\nvrsth.dll 2007-12-04 23:41 253,952 ----a-w C:\WINDOWS\system32\nvrssv.dll 2007-12-04 23:41 253,952 ----a-w C:\WINDOWS\system32\nvrspl.dll 2007-12-04 23:41 253,952 ----a-w C:\WINDOWS\system32\nvrsno.dll 2007-12-04 23:41 253,952 ----a-w C:\WINDOWS\system32\nvrsda.dll 2007-12-04 23:41 249,856 ----a-w C:\WINDOWS\system32\nvrsfi.dll 2007-12-04 23:41 249,856 ----a-w C:\WINDOWS\system32\nvrscs.dll 2007-12-04 23:41 245,760 ----a-w C:\WINDOWS\system32\nvrseng.dll 2007-12-04 23:41 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll 2007-12-04 23:41 225,280 ----a-w C:\WINDOWS\system32\nvrszhc.dll 2007-12-04 23:41 212,992 ----a-w C:\WINDOWS\system32\nvwrsja.dll 2007-12-04 23:41 2,854,912 ----a-w C:\WINDOWS\system32\nvmoblsr.dll 2007-12-04 23:41 2,519,040 ----a-w C:\WINDOWS\system32\nvwssr.dll . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 19:25 81920] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.exe" [2007-05-25 15:12 183208] "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 15:11 740208] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776] "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920] "VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-07-13 14:11 122880] "AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 18:07 49152] "CTHelper"="CTHELPER.EXE" [2006-05-24 06:20 17920 C:\WINDOWS\CTHELPER.EXE] "CTxfiHlp"="CTXFIHLP.EXE" [2006-05-24 06:20 18944 C:\WINDOWS\system32\CTXFIHLP.EXE] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 01:00 90112] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 03:10 55824 C:\WINDOWS\KHALMNPR.Exe] "Launch LCDMon"="C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-12-13 17:43 2051096] "Launch LGDCore"="C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-12-13 17:57 2095640] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-14 16:12 15360] C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\ Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-01-28 13:03:58 784912] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn] c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll 2007-11-15 10:10 72208 c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] --a------ 2008-01-28 06:55 1266936 C:\Program Files\Steam\Steam.exe R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-01-28 06:19] R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2007-05-25 15:12] R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-09-14 16:12] R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 15:08] R3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2006-05-24 05:40] S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-02-07 00:18] S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 15:09] S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 15:09] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp . 'Ajoitetut tehtävät'-kansion sisältö "2008-02-08 15:17:11 C:\WINDOWS\Tasks\1-Click Maintenance.job" - C:\Program Files\TuneUp Utilities 2008\OneClick.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-11 18:47:02 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** .
Lataa VundoFix.exe työpöydällesi. Tupla-klikkaa VundoFix.exe ajaaksesi sen. Klikkaa Scan for Vundo valintaa. Kun skannaus on valmis, klikkaa Remove Vundo valintaa. Sinulta kysytään haluatko poistaa filut - klikkaa YES. Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa. Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK. Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö. Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan. Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä. ================= Tarkista koneesi F-Securen online skannerilla http://support.f-secure.fi/fin/home/ols.shtml Huom, skanneri toimii vain Internet Explorer selaimella * Lue sivun ohjeet huolella läpi * Klikkaa Start scanning * Mikäli saat Internet Explorer -suojausvaroituksen, klikkaa Asenna * Klikkaa Accept * Klikkaa Custom Scan * Säädä asetukset seuraavasti o "Virus Scan Option" kohdasta valitse Scan whole system o "Other Scan Option" kohdasta valitse Scan All Files o Valitse Scan whole system for rootkits o Valitse Scan whole system for spyware o Laita ruksi kohtaan Scan inside archives o Varmista että Use advanced heuristics on valittuna * Klikkaa Start * Skannaus käynnistyy kun tarvittavat tiedostot/päivitykset on ladattu * Odota kärsivällisesti * Kun sakannaus on suoritettu, klikkaa Automatic cleaning * Klikkaa Show Report * Raportti aukeaa selaimessa, kopioi teksti kokonaan * Liitä kopioitu teksti esim. muistioon tai Wordiin ja tallenna työpöydälle * Voit sulkea skannerin * Lähetä raportti viestiketjuusi anna toimia rauhassa jos hiplaa aiheuttaa koneen jumiutumisen
Vundofix ei löytänyt mitään, ja mulla on itellä f-secure 2008. tarkistin koneen eilen sillä ja se ei löytänyt mitään.
lataa startuplite tallena tiedosto työpöydälle. Tuplalikkaa StartUpLitenn.exe:ä sitten voi valita mitä jätät käynnistyviin ja paina sitten continue. =========== Lataa: RegSeeker.zip työpöydälle: Pura zip C:\RegSeeker\ kansioon. Sieltä käynnistät RegSeeker.exe ohjelman. Oikeasa yläkulmassa on Languages.... linkki, josta valitset Suomenkielen. Vasemmasta alakulmasta ruksit Luo vrmuuskopio ja sitten linkki Puhdista rekisteri Ruksit kaikkiin muihin kohtiin paitsi "Käyttökelvottomat.." sitten "OK" (odotat hetken). Ruutuun ilmestyy lista epäkelvoista rekisterimerkinnöistä, jotka alapalkista Valitse kohdasta klikkaat Valitse kaikki jolloin valitut saavat keltaisen pohjavärin. Alapalkin Toiminnot linkistä klikkaat Poista valitut kohteet Ponnahdusikkunaan "Kaikki valitut kohteet poistetaan ? vastaat "OK". Seuraavaan Ponnahdusikkunaan "Varmuuskopiot" vastaat "OK". Klikaa vasemmalta Lopeta RegSeeker ja käynnistä koneesi uudelleen. ============== Lataa OTMoveIt OTMoveIt ja tallenna se työpöydällesi. Tuplaklikkaa OTMoveIt.exe. Klikkaa CleanUp!. Valitse Yes kun kysytään "Begin cleanup Process?". Jos pyydetään, että saako koneen käynnistää uudeelleen, valitse Yes.OTMoveIt poistaa itsensä kun se on valmis, jos näin ei käy poista se itse. HUOM: Jos palomuurisi tai joku muu tietoturvaohjelma varoittaa, että OTMoveIt yrittää päästä nettin, niin anna sen päästä sinne.
