HJT-Logi (Vakavaa?)

Eli joo, tänään hain erään ohjelman koneelleni kaverin antamasta osoitteesta. Ohjelma oli vähän pienemmän yhtiön tekemä, ja se liittyi makroihin.

Ohjelman haettuani ja .exen käynnistettyäni, alkoi ruudulla hyppiä komentoikkunoita jossa oli C -ja D-asemia availtu, joku tiedostokin oli kopioitu...

Nyt minun ruudulle pomppii vähän väliä englanninkielisiä viestejä (käyttöjärjestelmäni on suomeksi), joissa varoitetaan lyhyesti sanoen mm.
" Tietokoneella, viruksia, poista ne painamalla kyllä. "
" Sulje internet-yhteys, vaara. "
" Koneellasi voi olla spambot, paina kyllä niin poistamme sen. "
" Tiedostoja on voinut korruptoitua, paina kyllä niin korjaamme ne. "

Toivon pikaista vastausta, kiitos!

HJT-LOGI


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:10:57, on 24.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\Sys23E.exe
C:\WINDOWS\system32\CAPRPCSK.EXE
C:\Windows\Sys240.exe
C:\Windows\Sys241.exe
C:\Windows\Sys242.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\WhatPulse\WhatPulse.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Documents and Settings\Teemu\Local Settings\Application Data\Google\Update\1.1.25.0\GoogleUpdate.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPPSWK.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPPSWK.EXE
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Samurize\Client.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Documents and Settings\Teemu\Local Settings\Application Data\YouTube\Uploader\youtubeuploader.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Alwil Software\Avast4\setup\setup.ovr
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemonsearch.com/intl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O2 - BHO: (no name) - {663656df-6bae-460c-a612-8133df519346} - C:\WINDOWS\system32\byXOgeFw.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {c7106140-54d0-461b-a56f-fef2a5717ddf} - C:\WINDOWS\system32\efcYPjIc.dll
O3 - Toolbar: vrmdtneg - {46F332C7-D5E7-42BB-88FC-25CA1AB9BA20} - C:\WINDOWS\vrmdtneg.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe
O4 - HKLM\..\Run: [CAPON] C:\WINDOWS\system32\Spool\Drivers\w32x86\3\CAPONN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [Sys23E.exe] C:\Windows\Sys23E.exe
O4 - HKLM\..\Run: [Sys240.exe] C:\Windows\Sys240.exe
O4 - HKLM\..\Run: [Sys241.exe] C:\Windows\Sys241.exe
O4 - HKLM\..\Run: [Sys242.exe] C:\Windows\Sys242.exe
O4 - HKLM\..\Run: [6482bfd6] rundll32.exe "C:\WINDOWS\system32\wcrsswqb.dll",b
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WhatPulse] C:\Program Files\WhatPulse\WhatPulse.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Teemu\Local Settings\Application Data\Google\Update\1.1.25.0\GoogleUpdate.exe" /lang en
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Client Default.lnk = C:\Program Files\Samurize\Client.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Startup: YouTube Uploader.lnk = C:\Documents and Settings\Teemu\Local Settings\Application Data\YouTube\Uploader\youtubeuploader.exe
O4 - Global Startup: Canon LBP-800 Status Window.LNK = C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPPSWK.EXE
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.9.24.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1194637121703
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: byxogefw - byXOgeFw.dll (file missing)
O20 - Winlogon Notify: winctrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll
O21 - SSODL: xvorfwbd - {4745257F-4C1F-42E4-9876-C2B9F329CC66} - C:\WINDOWS\xvorfwbd.dll
O23 - Service: avast! iAVS4 Control Service (aswupdsv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus (avast! antivirus) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner (avast! mail scanner) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner (avast! web scanner) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Suojattu tallennuspaikka ProtectedStorageDcomLaunch (protectedstoragedcomlaunch) - Unknown owner - C:\WINDOWS\system32\amstreamc.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 11889 bytes

 

1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

==========

Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

Tallenna se nimellä CFScript.txt

Sitten raahaa CFScript ComboFix.exeen kuten alla.


Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

=========

scannaa hjt:llä merkkaa paina Fix checked

O2 - BHO: (no name) - {663656df-6bae-460c-a612-8133df519346} - C:\WINDOWS\system32\byXOgeFw.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {c7106140-54d0-461b-a56f-fef2a5717ddf} - C:\WINDOWS\system32\efcYPjIc.dll
O3 - Toolbar: vrmdtneg - {46F332C7-D5E7-42BB-88FC-25CA1AB9BA20} - C:\WINDOWS\vrmdtneg.dll
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [6482bfd6] rundll32.exe "C:\WINDOWS\system32\wcrsswqb.dll",b
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Teemu\Local Settings\Application Data\Google\Update\1.1.25.0\GoogleUpdate.exe" /lang en
O20 - Winlogon Notify: byxogefw - byXOgeFw.dll (file missing)
O20 - Winlogon Notify: winctrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll
O21 - SSODL: xvorfwbd - {4745257F-4C1F-42E4-9876-C2B9F329CC66} - C:\WINDOWS\xvorfwbd.dll

===============

Lataa SmitfraudFix (c) S!Ri
Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
Postita ponnahtava rapport – muistion sisältö viestiketjuusi.
Löytyy myös C:\rapport.txt

Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat
(AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja.
A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä,
silloin ne saattavat varoittaa käyttäjää.

===============

Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

Käynnistä koneesi vikasietotilaan:

sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä

Jossakin koneissa hakataan F8:sin sijasta F5:tä

" Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
" Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
" Paina Y käynnistääksesi skriptin.
" Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
" Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
" Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
" Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
" Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
" Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

 

Dump*

 

ComboFix.txt

(kerron lisää kunhan suoritan muutkin vaiheet)

ComboFix 08-06-20.4 - Teemu 2008-06-24 16:51:38.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.406 [GMT 3:00]
Running from: C:\Documents and Settings\Teemu\Omat tiedostot\Downloads\ComboFix.exe
Command switches used :: C:\Documents and Settings\Teemu\Omat tiedostot\Downloads\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\byXOgeFw.dll
C:\WINDOWS\system32\efcYPjIc.dll
C:\WINDOWS\system32\wcrsswqb.dll
C:\WINDOWS\SYSTEM32\WinCtrl32.dll
C:\WINDOWS\vrmdtneg.dll
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\wcrsswqb.dll

.
((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-05-24 to 2008-06-24 )))))))))))))))))
.

2008-06-24 16:25 . 2008-06-24 16:31 354 ---hs---- C:\WINDOWS\system32\bqwssrcw.ini
2008-06-24 15:10 . 2008-06-24 15:10 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-06-24 12:38 . 2008-06-21 11:35 3,262 --a------ C:\WINDOWS\system32\sex2.ico
2008-06-24 12:34 . 2008-06-21 11:35 32,256 --a------ C:\WINDOWS\Sys2.exe
2008-06-24 12:34 . 2008-06-21 11:35 31,744 --a------ C:\WINDOWS\Sys3.exe
2008-06-24 12:34 . 2008-06-21 11:35 30,720 --a------ C:\WINDOWS\Sys5.exe
2008-06-24 12:34 . 2008-06-21 11:35 30,208 --a------ C:\WINDOWS\Sys4.exe
2008-06-24 12:30 . 2008-06-24 07:13 81,920 --a------ C:\WINDOWS\neltabxw.exe
2008-06-24 12:30 . 2008-06-21 11:35 32,256 --a------ C:\WINDOWS\Sys23E.exe
2008-06-24 12:30 . 2008-06-21 11:35 31,744 --a------ C:\WINDOWS\Sys240.exe
2008-06-24 12:30 . 2008-06-21 11:35 30,720 --a------ C:\WINDOWS\Sys242.exe
2008-06-24 12:30 . 2008-06-21 11:35 30,208 --a------ C:\WINDOWS\Sys241.exe
2008-06-24 12:30 . 2008-06-21 11:35 3,262 --a------ C:\WINDOWS\system32\sex1.ico
2008-06-24 12:29 . 2008-06-24 12:29 <KANSIO> d-------- C:\Program Files\Common Files\Network Automation
2008-06-24 12:29 . 2008-06-24 12:29 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Network Automation
2008-06-24 12:29 . 2008-06-24 12:29 677,203 --a------ C:\WINDOWS\system32\scnaam32.cpc
2008-06-24 12:29 . 2008-06-24 12:29 490,865 --a------ C:\WINDOWS\system32\amnau32.dll
2008-06-24 12:29 . 2008-06-24 16:58 63,920 --a------ C:\WINDOWS\system32\drivers\4c00a5c1.sys
2008-06-24 12:29 . 2008-06-24 12:29 37,888 -r-hs---- C:\WINDOWS\system32\amstreamc.exe
2008-06-24 12:29 . 2008-06-24 12:29 32 --a-s---- C:\WINDOWS\system32\1227635570.dat
2008-06-24 12:21 . 2008-06-24 12:29 <KANSIO> d-------- C:\WINDOWS\86273A7C9524433A867A281D02E92B04.TMP
2008-06-23 03:07 . 2008-06-23 03:07 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-23 03:07 . 2008-06-23 03:07 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-22 02:20 . 2008-06-22 02:20 151 --a------ C:\WINDOWS\PhotoSnapViewer.INI
2008-06-21 02:01 . 2008-06-21 02:01 <KANSIO> d-------- C:\WINDOWS\system32\fi-fi
2008-06-21 01:56 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll
2008-06-15 14:08 . 2008-06-15 14:35 <KANSIO> d-------- C:\Documents and Settings\Teemu\Application Data\gtk-2.0
2008-06-15 14:08 . 2008-06-15 14:08 <KANSIO> d-------- C:\Documents and Settings\Teemu\.thumbnails
2008-06-14 14:06 . 2008-06-24 12:50 45 --a------ C:\TEST.XML
2008-06-10 22:55 . 2008-06-10 22:55 <KANSIO> d-------- C:\Program Files\foobar2000
2008-06-08 22:27 . 2008-06-09 12:35 <KANSIO> d-------- C:\WINDOWS\system32\Adobe
2008-06-07 01:52 . 2008-06-07 01:52 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Last.fm
2008-06-07 01:51 . 2008-06-07 01:51 <KANSIO> d-------- C:\Program Files\Last.fm
2008-06-06 11:38 . 2008-06-15 14:46 <KANSIO> d-------- C:\Documents and Settings\Teemu\.gimp-2.4
2008-06-06 11:33 . 2008-06-06 11:33 <KANSIO> d-------- C:\Program Files\GIMP-2.0
2008-06-01 13:16 . 2008-06-01 13:16 <KANSIO> d-------- C:\Documents and Settings\Teemu\Application Data\ImgBurn
2008-06-01 13:10 . 2008-06-01 13:10 <KANSIO> d-------- C:\Program Files\ImgBurn
2008-05-29 13:13 . 2008-05-29 13:13 <KANSIO> d-------- C:\Program Files\Alcohol Soft
2008-05-29 09:01 . 2008-05-29 09:01 278,728 --a------ C:\WINDOWS\system32\drivers\atksgt.sys
2008-05-29 09:01 . 2008-05-29 09:01 25,416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys
2008-05-29 08:56 . 2008-05-29 08:56 <KANSIO> d-------- C:\Program Files\Ubisoft

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-24 13:58 --------- d-----w C:\Program Files\Steam
2008-06-24 13:28 --------- d-----w C:\Documents and Settings\Teemu\Application Data\OpenOffice.org2
2008-06-24 12:08 --------- d-----w C:\Documents and Settings\Teemu\Application Data\Xfire
2008-06-24 09:28 --------- d-----w C:\Documents and Settings\Teemu\Application Data\uTorrent
2008-06-24 09:21 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-06-23 00:04 --------- d-----w C:\Documents and Settings\Teemu\Application Data\foobar2000
2008-06-22 21:55 --------- d-----w C:\Program Files\SpeedFan
2008-06-22 21:51 38,400 ----a-w C:\WINDOWS\Internet Logs\xDBF.tmp
2008-06-22 21:51 2,776,576 ----a-w C:\WINDOWS\Internet Logs\xDB10.tmp
2008-06-22 21:23 3,056,128 ----a-w C:\WINDOWS\Internet Logs\xDBD.tmp
2008-06-22 21:23 2,776,064 ----a-w C:\WINDOWS\Internet Logs\xDBE.tmp
2008-06-13 23:27 --------- d-----w C:\Program Files\Audacity
2008-06-10 14:59 2,713,600 ----a-w C:\WINDOWS\Internet Logs\xDBC.tmp
2008-06-10 14:58 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-06-10 14:58 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-06-10 14:54 2,713,088 ----a-w C:\WINDOWS\Internet Logs\xDBB.tmp
2008-06-10 14:40 --------- d-----w C:\Documents and Settings\Teemu\Application Data\mIRC
2008-06-08 16:35 --------- d-----w C:\Program Files\U-Torrent2
2008-06-02 19:36 --------- d-----w C:\Documents and Settings\Teemu\Application Data\Ahead
2008-05-30 17:13 --------- d-----w C:\Program Files\World of Warcraft
2008-05-29 11:48 --------- d-----w C:\Program Files\mIRC
2008-05-29 10:02 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-05-29 05:56 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-22 16:02 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-05-22 16:02 --------- d-----w C:\Documents and Settings\Teemu\Application Data\SystemRequirementsLab
2008-05-19 20:11 --------- d-----w C:\Program Files\Common Files\Totem Shared
2008-05-15 14:57 2,403,328 ----a-w C:\WINDOWS\Internet Logs\xDBA.tmp
2008-05-15 13:38 --------- d-----w C:\Program Files\Rockstar Games
2008-05-15 13:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-15 10:55 --------- d-----w C:\Program Files\FiXiT
2008-05-15 10:41 --------- d-----w C:\Program Files\FileSubmit
2008-05-15 10:07 --------- d-----w C:\Program Files\TGTSoft
2008-05-15 09:56 --------- d-----w C:\Program Files\Logon Loader
2008-05-15 03:35 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-05-12 10:14 --------- d-----w C:\Program Files\SMF
2008-05-08 10:37 1,990,201 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
2008-05-08 09:52 3,102,720 ----a-w C:\WINDOWS\Internet Logs\xDB8.tmp
2008-05-08 09:52 2,299,904 ----a-w C:\WINDOWS\Internet Logs\xDB9.tmp
2008-05-02 20:54 --------- d-----w C:\Program Files\ImTOO
2008-05-02 20:47 --------- d-----w C:\Program Files\QuickTime
2008-04-09 15:08 2,918,912 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2008-04-09 15:08 2,277,888 ----a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2008-03-29 07:39 95,232 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2008-03-29 07:39 2,250,240 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2008-03-29 06:45 3,091,968 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-03-29 06:45 2,246,656 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-03-27 16:17 2,243,072 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2007-12-01 12:31 22,328 ----a-w C:\Documents and Settings\Teemu\Application Data\PnkBstrK.sys
2007-11-14 15:41 67,262 ----a-w C:\Documents and Settings\VentriloMIX\Uninstal.exe
2005-07-23 16:33 266,240 ----a-w C:\Documents and Settings\VentriloMIX\VentriloMIX.exe
2005-07-14 10:47 933,888 ----a-w C:\Documents and Settings\VentriloMIX\Ventrilo 2.3.0.exe
2004-06-03 06:52 15,360 ----a-w C:\Documents and Settings\VentriloMIX\KeyPress.dll
2004-03-16 15:17 630,784 ----a-w C:\Documents and Settings\VentriloMIX\Ventrilo 2.2.0.exe
2003-12-22 15:36 581,632 ----a-w C:\Documents and Settings\VentriloMIX\Ventrilo 2.1.4.exe
2003-09-22 11:41 180,224 ----a-w C:\Documents and Settings\VentriloMIX\ventrilo_srv.exe
2003-09-22 11:37 69,632 ----a-w C:\Documents and Settings\VentriloMIX\ventrilo_status.exe
2003-09-22 11:37 57,344 ----a-w C:\Documents and Settings\VentriloMIX\ventrilo_svc.exe
2003-08-29 15:13 1,436,160 ----a-w C:\Documents and Settings\VentriloMIX\TeamSpeakRC2 2.0.32.60.exe
2003-04-17 10:06 172,032 ----a-w C:\Documents and Settings\VentriloMIX\hvdi.dll
2003-04-17 08:56 151,552 ----a-w C:\Documents and Settings\VentriloMIX\libspeex.dll
.

------- Sigcheck -------

2006-04-20 14:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\$hf_mig$\KB917953\SP2GDR\tcpip.sys
2006-04-20 15:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2006-04-20 14:38 340480 b8158e2a6112c0a5ca67bc158fc70218 C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
2004-08-04 09:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
2003-04-25 15:00 332928 244a2f9816bc9b593957281ef577d976 C:\WINDOWS\$NtUninstallKB917953_0$\tcpip.sys
2004-08-04 09:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
2006-04-20 14:51 359808 021415ad071ef3944c27dc9597ed2214 C:\WINDOWS\system32\dllcache\tcpip.sys
2006-04-20 14:51 359808 021415ad071ef3944c27dc9597ed2214 C:\WINDOWS\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((( snapshot@2008-06-24_16.31.23.75 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-24 13:24:53 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-24 13:56:03 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-24 13:56:11 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_798.dat
.
(((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{46F332C7-D5E7-42BB-88FC-25CA1AB9BA20}"= "C:\WINDOWS\vrmdtneg.dll" [ ]

[HKEY_CLASSES_ROOT\clsid\{46f332c7-d5e7-42bb-88fc-25ca1ab9ba20}]
[HKEY_CLASSES_ROOT\vrmdtneg.1]
[HKEY_CLASSES_ROOT\TypeLib\{747547D7-5963-4F47-AE6B-38CFB7FA8198}]
[HKEY_CLASSES_ROOT\vrmdtneg]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184]
"WhatPulse"="C:\Program Files\WhatPulse\WhatPulse.exe" [2006-08-21 20:48 665600]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-18 17:16 171464]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-01 11:21 153136]
"Google Update"="C:\Documents and Settings\Teemu\Local Settings\Application Data\Google\Update\1.1.25.0\GoogleUpdate.exe" [2008-05-31 19:09 51184]
"Steam"="C:\Program Files\Steam\Steam.exe" [2008-03-29 09:47 1271032]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 00:06 2321600]
"AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-03-20 19:46 217544]
"STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 21:31 1372160]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SkyTel"="SkyTel.EXE" [2006-05-16 13:04 2879488 C:\WINDOWS\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-13 15:05 16239616 C:\WINDOWS\RTHDCPL.exe]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-07 03:05 200704]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 16:57 153136]
"SecurDisc"="C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe" [2007-06-01 11:06 1629744]
"InCD"="C:\Program Files\Nero\Nero 7\InCD\InCD.exe" [2007-06-01 11:05 1057328]
"CAPON"="C:\WINDOWS\system32\Spool\Drivers\w32x86\3\CAPONN.EXE" [2000-04-20 01:00 22528]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 04:06 40048]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-16 01:54 37376]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 03:17 55824 C:\WINDOWS\KHALMNPR.Exe]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 17:05 919016]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 13:17 61440]
"Sys23E.exe"="C:\Windows\Sys23E.exe" [2008-06-21 11:35 32256]
"Sys240.exe"="C:\Windows\Sys240.exe" [2008-06-21 11:35 31744]
"Sys241.exe"="C:\Windows\Sys241.exe" [2008-06-21 11:35 30208]
"Sys242.exe"="C:\Windows\Sys242.exe" [2008-06-21 11:35 30720]
"6482bfd6"="C:\WINDOWS\system32\wcrsswqb.dll" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 02:12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"xvorfwbd"= {4745257F-4C1F-42E4-9876-C2B9F329CC66} - C:\WINDOWS\xvorfwbd.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxogefw]
byXOgeFw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll 2008-01-09 13:30 72208 c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"VIDC.YV12"= yv12vfw.dll
"msacm.divxa32"= divxa32.acm
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\winee72.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wineu83.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\VentriloMIX\\ventrilo_srv.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Ubisoft\\THE SETTLERS - Rise of an Empire\\base\\bin\\Settlers6.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Rockstar Games\\GTA San Andreas\\samp.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"11738:TCP"= 11738:TCP:BitCometBeta 11738 TCP
"11738:UDP"= 11738:UDP:BitCometBeta 11738 UDP

R1 aswsp;avast! Self Protection;C:\WINDOWS\system32\drivers\aswsp.sys [2008-05-16 02:20]
R2 aswfsblk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
R2 RapidPort;RapidPort;C:\WINDOWS\system32\Drivers\CAPLPTN.SYS [2000-04-20 01:00]
S0 winee72;winee72;C:\WINDOWS\system32\Drivers\Winee72.sys []
S0 wineu83;wineu83;C:\WINDOWS\system32\Drivers\Wineu83.sys []
S2 protectedstoragedcomlaunch;Suojattu tallennuspaikka ProtectedStorageDcomLaunch;C:\WINDOWS\system32\amstreamc.exe [2008-06-24 12:29]

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-24 16:56:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\CAPRPCSK.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPPSWK.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPPSWK.EXE
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Samurize\Client.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
C:\Documents and Settings\Teemu\Local Settings\Application Data\YouTube\Uploader\youtubeuploader.exe
.
**************************************************************************
.
Completion time: 2008-06-24 17:02:53 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-24 14:02:48
ComboFix2.txt 2008-06-24 13:31:50

Pre-Run: 68,762,689,536 tavua vapaana
Post-Run: 68,737,204,224 tavua vapaana

278 --- E O F --- 2007-11-27 05:00:45






EDIT:

En löytänyt seuraavia kohtia jotka piti merkata " Fix Checked " -raksilla.

EDIT2:

Painanko " Add checked to ignorelist " -nappulaa sen jälkeen kun kaikki tarvittava listasta valittu?
Ekaa kertaa HJT:tä käyttelen...

Ja onko huono asia ellei noita edellä mainittuja listasta löydy? Olen katsonut sen huolellisesti läpi jo muutaman kerran, eikä noita löytynyt.

 

hjt:ssä painetaan Fix checked

ne mitä tuolla ylhäällä on laitettu ja niiten edessä sitä pikusta neliöö klikkatu tulee siihen merkki.
kun kaikissa on merkki paintetaan Fix checked
sitten sammutat käynnistät

 

Juu, noihan se olikin.

Mutta edelleenkään ole löytynyt noita viime postissani mainitsemiani kohtia, joten toistan kysymykseni:

Onko väliä vaikka kaikkia ei löytyisikään jota mainitsit?

 

jatka listaa vain alaspäin

 

SmitFraudFix v2.328

Scan done at 19:30:57,63, ti 24.06.2008
Run from C:\Program Files\Mozilla Firefox\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\CAPRPCSK.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe
C:\Program Files\Nero\Nero 7\InCD\InCD.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Windows\Sys23E.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\Sys240.exe
C:\Windows\Sys241.exe
C:\Windows\Sys242.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\WhatPulse\WhatPulse.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPPSWK.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\CAPPSWK.EXE
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Samurize\Client.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Documents and Settings\Teemu\Local Settings\Application Data\YouTube\Uploader\youtubeuploader.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\neltabxw.exe FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Teemu


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Teemu\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Teemu\Suosikit


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Realtek RTL8139 Family PCI Fast Ethernet NIC - Paketinajoituksen miniportti
DNS Server Search Order: 193.229.0.40
DNS Server Search Order: 193.229.0.42

HKLM\SYSTEM\CCS\Services\Tcpip\..\{AEBE4C68-274E-4648-A602-4F6A872142A4}: DhcpNameServer=193.229.0.40 193.229.0.42
HKLM\SYSTEM\CS1\Services\Tcpip\..\{AEBE4C68-274E-4648-A602-4F6A872142A4}: DhcpNameServer=193.229.0.40 193.229.0.42
HKLM\SYSTEM\CS3\Services\Tcpip\..\{AEBE4C68-274E-4648-A602-4F6A872142A4}: DhcpNameServer=193.229.0.40 193.229.0.42
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=193.229.0.40 193.229.0.42
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=193.229.0.40 193.229.0.42
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=193.229.0.40 193.229.0.42


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

 

Printtaa ohjeet ulos

Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi.

Vikasietotilaan:

sammuta ja käynnistä
käynnistyksen yhteydessä hakkaa F8 nappia
valitse nuolinäppäimellä vikasietotila
paina enter ja enter
valitse käyttäjätilisi
paina kyllä

Jossakin koneissa hakataan F8:sin sijasta F5:tä

Kun vikasietotilassa, avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
Valitse optio #2 - Clean kirjoittamalla 2 ja painamalla "Enter" poistaaksesi tarttuneet tiedostot.

Sinulta kysytään: "Registry cleaning - Do you want to clean the registry ?"; vastaa "Yes" kirjoittamalla Y ja paina "Enter" poistaaksesi työpöydän taustakuvan ja puhdistaaksesi tarttuneet rekisteriavaimet.

Työkalu tarkistaa jos wininet.dll on tarttunut. Sinua saatetaan pyytää korvaamaan tarttunut .dll (jos löytyy); vastaa "Yes" kirjoittamalla Y ja painamalla "Enter".

Työkalun saattaa tarvita käynnistää kone uudelleen; jos ei tee niin, käynnistä normaaliin Windowsiin.
Tekstitiedosto ilmestyy, puhdistusprosessin jäljiltä; kopioi & liitä tämän raportin tulokset vastaukseesi.
Raportti löytyy paikalliselta levyltäsi, useimmiten C:\rapport.txt.

Varoitus : Ajamalla optio 2:n EI-tarttuneessa tietokoneessa, poistaa sinun työpöytäsi taustakuvan.

 

Tein juuri hetki sitten saman jonka äsken selitit, paitsi, vaihtoehdolla 1, eli Search.

Pistän rapsan tähän kuitenkin, meen nyt varmaa tekemään tuon toisen vaiheen.


SDFix: Version 1.196
Run by Teemu on ti 24.06.2008 at 20:25

Microsoft Windows XP [versio 5.1.2600]
Running From: C:\DOCUME~1\Teemu\TYPYT~1\SDFix

Checking Services :

Name :
4c00a5c1

Path :
\SystemRoot\System32\drivers\4c00a5c1.sys

4c00a5c1 - Deleted



Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\system32\sex1.ico - Deleted
C:\WINDOWS\system32\sex2.ico - Deleted
C:\WINDOWS\neltabxw.exe - Deleted
C:\WINDOWS\system32\drivers\4c00a5c1.sys - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-24 20:37:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000001
"ujdew"=hex:52,74,98,3b,f9,22,b3,65,f1,9c,14,d1,2c,71,c4,ee,09,a9,ca,2e,2f,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:7a,24,44,08,84,cf,19,16,63,97,67,69,fc,2e,da,a9,a8,3c,e8,dd,11,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,8b,9a,4c,10,a0,c7,c3,2e,07,92,ac,53,cd,fb,98,ca,9d,..
"khjeh"=hex:38,82,54,a7,31,e5,df,ac,98,a0,3d,57,08,3d,28,a0,4a,1f,c1,09,9d,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:e7,9a,9d,98,ea,58,df,8e,67,2a,3a,48,3a,02,20,21,6c,8f,a4,ae,e5,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:8d,8a,27,2f,97,0e,49,87,f9,b6,14,fe,64,7c,1b,7d,18,41,9c,51,2b,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:b2,24,59,33,17,fe,5a,62,6e,a4,82,c0,14,be,8a,ad,39,07,2b,54,ae,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:9b,49,72,59,a1,29,34,cc,c7,47,f3,f7,72,ec,3f,f6,26,c8,b0,8d,a4,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000001
"ujdew"=hex:52,74,98,3b,f9,22,b3,65,f1,9c,14,d1,2c,71,c4,ee,09,a9,ca,2e,2f,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:7a,24,44,08,84,cf,19,16,63,97,67,69,fc,2e,da,a9,a8,3c,e8,dd,11,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,8b,9a,4c,10,a0,c7,c3,2e,07,92,ac,53,cd,fb,98,ca,9d,..
"khjeh"=hex:38,82,54,a7,31,e5,df,ac,98,a0,3d,57,08,3d,28,a0,4a,1f,c1,09,9d,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:e7,9a,9d,98,ea,58,df,8e,67,2a,3a,48,3a,02,20,21,6c,8f,a4,ae,e5,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:8d,8a,27,2f,97,0e,49,87,f9,b6,14,fe,64,7c,1b,7d,18,41,9c,51,2b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
"khjeh"=hex:b2,24,59,33,17,fe,5a,62,6e,a4,82,c0,14,be,8a,ad,39,07,2b,54,ae,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf43]
"khjeh"=hex:9b,49,72,59,a1,29,34,cc,c7,47,f3,f7,72,ec,3f,f6,26,c8,b0,8d,a4,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:000000b5
"TracesSuccessful"=dword:00000009

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe"="C:\\Program Files\\EA GAMES\\Battlefield 2\\BF2.exe:*:Enabled:Battlefield 2"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:EnablednkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:EnablednkBstrB"
"C:\\Program Files\\VentriloMIX\\ventrilo_srv.exe"="C:\\Program Files\\VentriloMIX\\ventrilo_srv.exe:*:Enabled:ventrilo_srv"
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) "
"C:\\Program Files\\Ubisoft\\THE SETTLERS - Rise of an Empire\\base\\bin\\Settlers6.exe"="C:\\Program Files\\Ubisoft\\THE SETTLERS - Rise of an Empire\\base\\bin\\Settlers6.exe:*:Enabled:THE SETTLERS - Rise of an Empire"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000"
"C:\\Program Files\\Rockstar Games\\GTA San Andreas\\samp.exe"="C:\\Program Files\\Rockstar Games\\GTA San Andreas\\samp.exe:*:Enabled:San Andreas Multiplayer"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabledxpsp3res.dll,-20000"

Remaining Files :


File Backups: - C:\DOCUME~1\Teemu\TYPYT~1\SDFix\backups\backups.zip

Files with Hidden Attributes :

Tue 24 Jun 2008 37,888 ..SHR --- "C:\WINDOWS\system32\amstreamc.exe"
Wed 14 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b7e6c7771d289926881287eb0ecc2a85\BIT2.tmp"

Finished!

 

Noin, nyt tein sen toisenkin, mutta yhä noita englanninkielisiä hämäriä ilmoituksia.

Onko vielä jotain tehtävissä, vai oliko siinä kaikki, seuraavaksi formatoimaan jos jokin vielä vaivaa?

--------------

SmitFraudFix v2.328

Scan done at 21:42:40,98, ti 24.06.2008
Run from C:\Documents and Settings\Teemu\Omat tiedostot\Downloads\SmitfraudFix
OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{AEBE4C68-274E-4648-A602-4F6A872142A4}: DhcpNameServer=193.229.0.40 193.229.0.42
HKLM\SYSTEM\CS1\Services\Tcpip\..\{AEBE4C68-274E-4648-A602-4F6A872142A4}: DhcpNameServer=193.229.0.40 193.229.0.42
HKLM\SYSTEM\CS3\Services\Tcpip\..\{AEBE4C68-274E-4648-A602-4F6A872142A4}: DhcpNameServer=193.229.0.40 193.229.0.42


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

 

Lataa Malwarebytes' Anti-Malware työpöydällesi.

1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.

 

Malwarebytes' Anti-Malware 1.18
Tietokantaversio: 889

13:22:08 25.6.2008
mbam-log-6-25-2008 (13-22-08).txt

Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
Tarkistetut kohteet: 136113
Kulunut aika: 30 minute(s), 19 second(s)

Saastuneita muistiprosesseja: 1
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 7
Saastuneita rekisteriarvoja: 1
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 46

Saastuneita muistiprosesseja:
C:\WINDOWS\Sys23E.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriavaimia:
HKEY_CLASSES_ROOT\Interface\{98f33be4-fcbc-4704-a26c-863a6c0b175c} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{747547d7-5963-4f47-ae6b-38cfb7fa8198} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{70dfbef5-dc3d-4468-a262-c23beb5813ed} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{8911f1b1-5ab7-42db-b750-0d9af843c831} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d466187f-b666-4ea5-bb43-e6854b102e4c} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\vrmdtneg.bfdv (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\vrmdtneg.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Saastuneita rekisteriarvoja:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sys23E.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)

Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)

Saastuneita tiedostoja:
C:\WINDOWS\Sys23E.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\edla.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\Sys1.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\efcYPjIc.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\wcrsswqb.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP296\A0065409.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP296\A0065410.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP296\A0065411.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP296\A0065429.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP296\A0065438.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP296\A0065439.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP296\A0065440.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP297\A0065454.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP297\A0065458.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP297\A0065459.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP297\A0065477.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP297\A0065482.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP297\A0065483.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP297\A0065484.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP297\A0065537.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP297\A0065538.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP297\A0065539.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP297\A0065540.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP298\A0065556.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP298\A0065573.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP298\A0065578.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP298\A0065579.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP298\A0065580.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP298\A0066579.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP298\A0066584.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP298\A0066585.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP298\A0066667.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP298\A0066668.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP298\A0066669.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F0D9F09C-6864-4E49-85A1-A9A18A66B814}\RP298\A0066707.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\Sys1.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\Sys17.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\Sys19.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\Sys2.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Sys240.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Sys241.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\Sys242.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Sys3.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\Sys4.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Sys5.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

EDIT:

Jee, nyt nuo viimeisetkin perättömät varotukset katos tuolt kellon luota.

Tässä taisi nyt olla sitten kaikki tällä kertaa ?

Kiitos avusta.

 

1. Klikkaa käynnistä > Oma tietokone oikean puoleisella hiiren napilla
2. Valitse ominaisuudet
3. Valitse järjestelmän palauttaminen välilehti
4. Ruksi eteen ¤ poista järjestelmän palauttaminen kaikissa asemissa
5. Paina Käytä
6. Paina ok
7. Sammuta ja käynnistä
8. Ota ruksi pois ¤ poista järjestelmän palauttaminen kaikissa asemissa
9. Käytä ja OK

==============

scannaa vielä uusi combofix loki
ja hjt:n loki uusi