Kone kaatuilee, viimeisin viittaus fastfat.sys tiedostoon

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by dvee, May 8, 2008.

  1. dvee

    dvee Member

    Joined:
    May 8, 2008
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    Morjens!

    Apu olis tarpeen, kone tuntuu hitaammalta käynnistää, kaatunut jokusen kertaa tuottaen blue screenin, viimeksi viittasi ongelman olevan fastfat.sys tiedostossa, page_fault_in_nonpaged_area.

    Kun Google ei oikein auttanut, niin josko mestarit.


    Seuraavana HijackThis logi:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:53:49, on 8.5.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Norman\Npm\bin\ELOGSVC.EXE
    C:\Norman\Npm\Bin\Zanda.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Abaqus\Documentation\monitor.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\Abaqus\Documentation\monitor.exe
    C:\Norman\Nvc\BIN\NVCSCHED.EXE
    C:\Norman\Npm\bin\NJEEVES.EXE
    C:\Norman\Nvc\bin\nvcoas.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\WINDOWS\system32\UMonit.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Norman\Npm\bin\ZLH.EXE
    C:\Program Files\Apoint2K\Apoint.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Power Manager\PM.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\WINDOWS\sm56hlpr.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Norman\Nvc\BIN\NIP.EXE
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Norman\Nvc\bin\cclaw.exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.iltalehti.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [UMonit] C:\WINDOWS\system32\UMonit.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\Npm\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [PowerManager] C:\Program Files\Power Manager\PM.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Norman\Npm\bin\ELOGSVC.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\Npm\bin\NJEEVES.EXE
    O23 - Service: Norman ZANDA - Norman ASA - C:\Norman\Npm\Bin\Zanda.exe
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Norman\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    O23 - Service: Texis Monitor - Expansion Programs International, Inc. - C:\Abaqus\Documentation\monitor.exe

    --
    End of file - 9114 bytes
     
    dvee, May 8, 2008
    #1
  2. Hujo

    Hujo Guest

    Javan päivitys ja välimuistin tyhjennys:

    1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
    2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
    Niissä pitäisi olla seuraava kuva vieressä: [​IMG]

    3. Valitse kaikki entiset Java versiosi ja valitse Poista.
    4. Asenna uusin Java päivitys seuraavasta linkistä..
    5. Käynnistä kone uudelleen asennuksen jälkeen:

    http://java.sun.com/javase/downloads/index.jsp

    Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u5

    Paina Download

    Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.

    6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).

    7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.

    (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
    Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).

    8. Varmista että kaikki kaksi valintaa ovat rastitettuja:

    *Applications and Applets

    *Trace and Log Files

    Ja paina OK -nappia

    9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.

    10. Klikkaa OK jättääksesi Java asetusikkunasi.

    =============

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Hujo, May 8, 2008
    #2
  3. dvee

    dvee Member

    Joined:
    May 8, 2008
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    SDFix report:


    SDFix: Version 1.180
    Run by FSC Amilo A1655 on to 08.05.2008 at 23:11

    Microsoft Windows XP [versio 5.1.2600]
    Running From: C:\Documents and Settings\FSC Amilo A1655\Ty”p”yt„\SDFix

    Checking Services :


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File

    Rebooting


    Checking Files :

    No Trojan Files Found






    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1359.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-08 23:49:50
    Windows 5.1.2600 Service Pack 2 FAT NTAPI

    scanning hidden processes ...

    IPC error: 2 Määritettyä tiedostoa ei löydy.
    scanning hidden services ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    UMonit = C:\WINDOWS\system32\UMonit.exe?Vid_0????Pid_0712????????2&PID437????B\?O???????????? Q???????Q?????w????????DP??X?!????????|p??|????m??|d??w???????????????w???????????????? Q??????????@???0Q??????\Q?????w????????P?!?X?!??????R??A7!?P?!?X?!??!"??????R?????

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0


    Remaining Services :




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\Messenger\\MSMSGS.EXE"="C:\\Program Files\\Messenger\\MSMSGS.EXE:*:Enabled:Windows Messenger"
    "C:\\Program Files\\Kerio\\Personal Firewall 4\\kpf4gui.exe"="C:\\Program Files\\Kerio\\Personal Firewall 4\\kpf4gui.exe:*:Enabled:Kerio Personal Firewall 4 - GUI"
    "C:\\Program Files\\WASTE\\WASTE.exe"="C:\\Program Files\\WASTE\\WASTE.exe:*:Disabled:Waste Secure Network"
    "C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"
    "C:\\Program Files\\uTorrent\\utorrent.exe"="C:\\Program Files\\uTorrent\\utorrent.exe:*:Enabled:æTorrent"
    "C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CommonFiles\\intel\\AnsysWBU.exe"="C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CommonFiles\\intel\\AnsysWBU.exe:*:Enabled:AnsysWBU.exe"
    "C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CommonFiles\\Solving\\intel\\ANSYS.exe"="C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CommonFiles\\Solving\\intel\\ANSYS.exe:*:Enabled:AWP ANSYS.exe"
    "C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CAD Integration\\intel\\ActivePIMgrU.exe"="C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CAD Integration\\intel\\ActivePIMgrU.exe:*:Enabled:ActivePIMgrU.exe"
    "C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CAD Integration\\intel\\ReaderHostU.exe"="C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CAD Integration\\intel\\ReaderHostU.exe:*:Enabled:ReaderHostU.exe"
    "C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CE\\intel\\CEExeServerU.exe"="C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CE\\intel\\CEExeServerU.exe:*:Enabled:CEExeServerU.exe"
    "C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CE\\intel\\JMServiceU.exe"="C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CE\\intel\\JMServiceU.exe:*:Enabled:JMServiceU.exe"
    "C:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\TCL\\bin\\intel\\tclsh.exe"="C:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\TCL\\bin\\intel\\tclsh.exe:*:Enabled:AWP tclsh.exe"
    "C:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\TCL\\bin\\intel\\wish.exe"="C:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\TCL\\bin\\intel\\wish.exe:*:Enabled:AWP wish.exe"
    "C:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\CATIAV5\\intel\\code\\bin\\ReaderHostCAT5U.exe"="C:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\CATIAV5\\intel\\code\\bin\\ReaderHostCAT5U.exe:*:Enabled:ReaderHostCAT5U.exe"
    "C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"="C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe:*:Enabled:Sunbelt Firewall GUI"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
    "C:\\Documents and Settings\\FSC Amilo A1655\\Ty”p”yt„\\utorrent.exe"="C:\\Documents and Settings\\FSC Amilo A1655\\Ty”p”yt„\\utorrent.exe:*:Enabled:æTorrent"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CommonFiles\\intel\\AnsysWBU.exe"="C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CommonFiles\\intel\\AnsysWBU.exe:*:Enabled:AnsysWBU.exe"
    "C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CommonFiles\\Solving\\intel\\ANSYS.exe"="C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CommonFiles\\Solving\\intel\\ANSYS.exe:*:Enabled:AWP ANSYS.exe"
    "C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CAD Integration\\intel\\ActivePIMgrU.exe"="C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CAD Integration\\intel\\ActivePIMgrU.exe:*:Enabled:ActivePIMgrU.exe"
    "C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CAD Integration\\intel\\ReaderHostU.exe"="C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CAD Integration\\intel\\ReaderHostU.exe:*:Enabled:ReaderHostU.exe"
    "C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CE\\intel\\CEExeServerU.exe"="C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CE\\intel\\CEExeServerU.exe:*:Enabled:CEExeServerU.exe"
    "C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CE\\intel\\JMServiceU.exe"="C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CE\\intel\\JMServiceU.exe:*:Enabled:JMServiceU.exe"
    "C:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\TCL\\bin\\intel\\tclsh.exe"="C:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\TCL\\bin\\intel\\tclsh.exe:*:Enabled:AWP tclsh.exe"
    "C:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\TCL\\bin\\intel\\wish.exe"="C:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\TCL\\bin\\intel\\wish.exe:*:Enabled:AWP wish.exe"
    "C:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\CATIAV5\\intel\\code\\bin\\ReaderHostCAT5U.exe"="C:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\CATIAV5\\intel\\code\\bin\\ReaderHostCAT5U.exe:*:Enabled:ReaderHostCAT5U.exe"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

    Remaining Files :


    File Backups: - C:\DOCUME~1\FSCAMI~1\Ty”p”yt„\SDFix\backups\backups.zip

    Files with Hidden Attributes :

    Mon 28 Jan 2008 1,404,240 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
    Mon 28 Jan 2008 5,146,448 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
    Mon 28 Jan 2008 2,097,488 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
    Sun 18 Jun 2006 542,720 A..H. --- "C:\Koulu\Betonitekniikka\~WRL0459.tmp"
    Mon 19 Jun 2006 1,562,624 A..H. --- "C:\Koulu\Betonitekniikka\~WRL1976.tmp"
    Sun 22 Apr 2007 248,832 A..H. --- "C:\Koulu\Pitk„aikaiskest„vyys\~WRL2742.tmp"
    Wed 16 May 2007 479,744 A..H. --- "C:\Koulu\Pitk„aikaiskest„vyys\~WRL2351.tmp"
    Wed 16 May 2007 480,768 A..H. --- "C:\Koulu\Pitk„aikaiskest„vyys\~WRL0878.tmp"
    Wed 16 May 2007 481,792 A..H. --- "C:\Koulu\Pitk„aikaiskest„vyys\~WRL2378.tmp"
    Sun 18 Jun 2006 542,720 A..H. --- "C:\Cruzer\Betonitekniikka\~WRL0459.tmp"
    Wed 30 Aug 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
    Tue 9 Oct 2007 178,688 ...H. --- "C:\Ty”t\E-halli\Ty”turvallisuus\~WRL0900.tmp"
    Sat 10 Nov 2007 475,648 ...H. --- "C:\Ty”t\E-halli\Ty”turvallisuus\~WRL2594.tmp"
    Sat 10 Nov 2007 155,648 ...H. --- "C:\Ty”t\E-halli\Ty”turvallisuus\~WRL2566.tmp"
    Thu 8 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\e2cdfda265544b05233b12ad6d933aba\BIT3.tmp"
    Sun 19 Aug 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
    Wed 26 Sep 2007 238,592 ...H. --- "C:\Documents and Settings\FSC Amilo A1655\Application Data\Microsoft\Word\~WRL0823.tmp"
    Wed 30 Aug 2006 20 A..H. --- "C:\Documents and Settings\FSC Amilo A1655\Omat tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv1lic.bak"
    Wed 30 Aug 2006 4,348 ...H. --- "C:\Documents and Settings\FSC Amilo A1655\Omat tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv1key.bak"
    Tue 21 Mar 2006 312 A.SH. --- "C:\Documents and Settings\FSC Amilo A1655\Omat tiedostot\Omat musiikkitiedostot\K„ytt”oikeuden varmuuskopio\drmv2key.bak"

    Finished!



    HijackThis logi:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 23:58:49, on 8.5.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Norman\Npm\bin\ELOGSVC.EXE
    C:\Norman\Npm\Bin\Zanda.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Abaqus\Documentation\monitor.exe
    C:\Abaqus\Documentation\monitor.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\Norman\Npm\bin\NJEEVES.EXE
    C:\Norman\Nvc\BIN\NVCSCHED.EXE
    C:\Norman\Nvc\bin\nvcoas.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\WINDOWS\system32\UMonit.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Norman\Npm\bin\ZLH.EXE
    C:\Program Files\Apoint2K\Apoint.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Norman\Nvc\BIN\NIP.EXE
    C:\Program Files\Power Manager\PM.exe
    C:\Norman\Nvc\bin\cclaw.exe
    C:\WINDOWS\sm56hlpr.exe
    C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.iltalehti.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [UMonit] C:\WINDOWS\system32\UMonit.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [EPSON Stylus DX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.EXE /P26 "EPSON Stylus DX3800 Series" /O6 "USB001" /M "Stylus DX3800"
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\Npm\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [PowerManager] C:\Program Files\Power Manager\PM.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
    O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Norman\Npm\bin\ELOGSVC.EXE
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\Npm\bin\NJEEVES.EXE
    O23 - Service: Norman ZANDA - Norman ASA - C:\Norman\Npm\Bin\Zanda.exe
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Norman\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    O23 - Service: Texis Monitor - Expansion Programs International, Inc. - C:\Abaqus\Documentation\monitor.exe

    --
    End of file - 9085 bytes


    Kiitos jo nyt.
     
    dvee, May 8, 2008
    #3
  4. Hujo

    Hujo Guest

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, May 8, 2008
    #4
  5. dvee

    dvee Member

    Joined:
    May 8, 2008
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    No pornot se ainakin poisti, liekö muuta.


    ComboFix 08-05-08.1 - FSC Amilo A1655 2008-05-09 10:49:03.1 - FAT32x86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.338 [GMT 3:00]
    Running from: C:\Documents and Settings\FSC Amilo A1655\Työpöytä\ComboFix.exe
    * Created a new restore point
    * Resident AV is active


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\RECYCLER\21Sextury - Alexa Weix - Portfolio.avi
    C:\RECYCLER\21Sextury Alexa May.avi
    C:\RECYCLER\794.mpg
    C:\RECYCLER\809.avi
    C:\RECYCLER\Agatha Meirelles [JAM-HOT.com].avi
    C:\RECYCLER\Alissa -2 Deep.mpg
    C:\RECYCLER\Anal Sex - Perfect Ass.mpg
    C:\RECYCLER\Asstraffic - Natasha And Ana.wmv
    C:\RECYCLER\Awesome Anal & Deep Throat Facial Cum Shot and Gagging.mpg
    C:\RECYCLER\Barely_Legal_20_VCD - complete - Huge tits - puppy, ass, xxx, lesbian, hot, sex, porno, teen, asian, bbw.mpg .mpg
    C:\RECYCLER\Cheerleader porno part16.asf
    C:\RECYCLER\Exploited teens - Professional Porn - Swedish Maria 19 Years Old from Skane Threesome (Full Scene).mpg
    C:\RECYCLER\Faith fusks her new boss.asf
    C:\RECYCLER\GGW - Sex in public - beach fuckfest - LOTS of spectators.mpg
    C:\RECYCLER\IntheVip.com.Kitty.Christmas.Party.DT.mpg
    C:\RECYCLER\Jennas Provocateur_Sophia Rossi XXX-Dvdrip-Vivid.avi
    C:\RECYCLER\Just.18.Pussycat.Teens.[English].XXX.DVDRip.XVID-[WwW.TorrentesX.CoM].avi
    C:\RECYCLER\Lovers.Guide.To.Sexual.Positions.DVDRip.XviD-SUG(1).avi
    C:\RECYCLER\NR_DPR_02_Naomi.avi
    C:\RECYCLER\Penthouse.Letters.Dirty.Little.Secrets.[English].XXX.DVDRip.XVID-[WwW.TorrentesX.CoM].avi
    C:\RECYCLER\Shyla Stylez [JAM-HOT.com].avi
    C:\RECYCLER\Stacy Valentine - in pink G-string.avi
    C:\RECYCLER\super hot blonde brazillian.avi
    C:\RECYCLER\Virginie Gervais.avi
    C:\RECYCLER\XXX.-.La.Sulfureuse.(Clara.Morgane,.Delfynn.Delage,.Dita,.Monica.Sweetheart,.Rebecca,..Sonia,.Tiffany.Ho.avi
    C:\RECYCLER\Young.Hot.And.Horny.Girls.2.XXX.DVDRip.kik.avi

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-04-09 to 2008-05-09 )))))))))))))))))
    .

    2008-05-08 23:05 . 2008-05-08 23:05 <KANSIO> d-------- C:\WINDOWS\ERUNT
    2008-05-08 22:41 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-05-08 22:40 . 2008-05-08 22:40 <KANSIO> d-------- C:\Program Files\Java
    2008-05-08 22:40 . 2008-05-08 22:40 <KANSIO> d-------- C:\Program Files\Common Files\Java
    2008-05-08 21:53 . 2008-05-08 21:53 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-05-08 21:11 . 2008-05-08 21:11 <KANSIO> d-------- C:\Program Files\Security Task Manager
    2008-05-08 21:11 . 2008-05-08 21:11 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\SecTaskMan
    2008-04-28 22:12 . 2008-04-28 22:12 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-04-23 12:11 . 2008-04-23 12:11 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-04-23 12:11 . 2008-04-23 12:11 1,409 --a------ C:\WINDOWS\QTFont.for

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-05-08 20:02 4,230 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
    2008-03-15 21:09 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
    2008-03-03 17:37 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
    2008-03-01 15:31 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
    2008-02-29 08:56 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe
    2008-02-29 08:55 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
    2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
    2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll
    2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
    2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
    2008-02-20 05:38 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
    2008-02-15 05:44 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
    2008-02-10 13:29 691,545 ----a-w C:\WINDOWS\unins000.exe
    2006-09-25 18:56 59,893 ----a-w C:\Program Files\memt32.zip
    2006-09-04 19:18 22 ----a-w C:\Program Files\mpc2kxp6490.zip
    2006-08-29 08:27 5,037,072 ----a-w C:\Program Files\spybotsd14.exe
    2006-06-20 17:09 3,511,317 ----a-w C:\Program Files\DCPlusPlus-0.691.exe
    2006-06-16 15:15 7,575,084 ----a-w C:\Program Files\KERIO413.EXE
    2006-06-16 14:08 13,707,176 ----a-w C:\Program Files\zlsSetup_65_714_000_en.exe
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [ ]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 12:00 15360]
    "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "UMonit"="C:\WINDOWS\system32\UMonit.exe" [2005-08-25 13:48 237568]
    "RTHDCPL"="RTHDCPL.EXE" [2005-07-13 10:37 14679552 C:\WINDOWS\RTHDCPL.EXE]
    "EPSON Stylus DX3800 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.exe" [2005-02-08 07:00 98304]
    "Norman ZANDA"="C:\Norman\Npm\bin\ZLH.exe" [2007-05-08 13:32 183352]
    "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2005-04-16 00:08 172032]
    "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-03-10 13:01 28160 C:\WINDOWS\KHALMNPR.Exe]
    "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 21:05 344064]
    "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 15:21 61952 C:\WINDOWS\system32\HdAShCut.exe]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
    "PowerManager"="C:\Program Files\Power Manager\PM.exe" [2005-09-16 09:38 31744]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-06-05 20:13 98304]
    "SMSERIAL"="sm56hlpr.exe" [2005-07-06 04:47 544768 C:\WINDOWS\sm56hlpr.exe]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 12:00 15360]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2006-06-20 17:04:14 438272]
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.divxa32"= DivXa32.acm

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CommonFiles\\intel\\AnsysWBU.exe"=
    "C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CAD Integration\\intel\\ActivePIMgrU.exe"=
    "C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CAD Integration\\intel\\ReaderHostU.exe"=
    "C:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\TCL\\bin\\intel\\tclsh.exe"=
    "C:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\TCL\\bin\\intel\\wish.exe"=
    "C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\MSN Messenger\\livecall.exe"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "C:\\Documents and Settings\\FSC Amilo A1655\\Työpöytä\\utorrent.exe"=

    R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21]
    R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21]
    R2 AdobeActiveFileMonitor;Adobe Active File Monitor;C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-20 04:47]
    R2 Ndiskio;Ndiskio;C:\Norman\Nse\bin\NDISKIO.SYS [2007-01-02 10:55]
    R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [2007-04-26 10:21]
    R2 Texis Monitor;Texis Monitor;C:\Abaqus\Documentation\monitor.exe [2003-04-29 21:02]
    R3 EKBfltr;ENE Keyboard Controller;C:\WINDOWS\system32\DRIVERS\EKBfltr.sys [2005-07-28 10:53]
    R3 NvcMFlt;NvcMFlt;C:\WINDOWS\system32\DRIVERS\nvcw32mf.sys [2008-02-11 14:56]
    R3 nvcoas;Norman Virus Control on-access component;C:\Norman\Nvc\bin\nvcoas.exe [2007-12-12 11:45]
    R3 NVCScheduler;Norman Virus Control Scheduler;C:\Norman\Nvc\BIN\NVCSCHED.EXE [2007-05-23 13:23]
    S3 fixustor;fixustor;C:\WINDOWS\system32\drivers\fixustor.sys [2005-08-17 19:25]
    S3 nvcfsr;nvcfsr;C:\Norman\Nvc\bin\nvcfsr.sys [2007-01-09 15:25]
    S3 nvcoafl51;nvcoafl51;C:\Norman\Nvc\bin\nvcoafl51.sys [2007-01-09 15:25]
    S3 nvcoaft51;nvcoaft51;C:\Norman\Nvc\bin\nvcoaft51.sys [2007-01-09 15:25]
    S3 nvcoarc51;nvcoarc51;C:\Norman\Nvc\bin\nvcoarc51.sys [2007-01-09 15:25]
    S3 usb20l;USB 2.0 10/100 Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\usb20l.SYS [2003-07-23 03:53]

    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-05-09 07:30:16 C:\WINDOWS\Tasks\SyncBack Synkkaus.job"
    - C:\Program Files\2BrightSparks\SyncBack\SyncBack.exe
    "2008-05-08 11:35:34 C:\WINDOWS\Tasks\SyncBack Koulu.job"
    - C:\Program Files\2BrightSparks\SyncBack\SyncBack.exe
    "2008-05-08 11:35:34 C:\WINDOWS\Tasks\SyncBack Töiden synkkaus.job"
    - C:\Program Files\2BrightSparks\SyncBack\SyncBack.exe
    "2008-05-09 07:32:38 C:\WINDOWS\Tasks\SyncBack Kuvat.job"
    - C:\Program Files\2BrightSparks\SyncBack\SyncBack.exe
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-09 10:55:36
    Windows 5.1.2600 Service Pack 2 FAT NTAPI

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    UMonit = C:\WINDOWS\system32\UMonit.exe?Vid_0????Pid_0712????????2&PID437????B\?O???????????? Q???????Q?????w????????DP??X?!????????|p??|????m??|d??w???????????????w???????????????? Q??????????@???0Q??????\Q?????w????????P?!?X?!??????R??A7!?P?!?X?!??!"??????R?????

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-05-09 10:57:46
    ComboFix-quarantined-files.txt 2008-05-09 07:57:40

    Pre-Run: 9,257,123,840 tavua vapaana
    Post-Run: 9,337,208,832 tavua vapaana

    163 --- E O F --- 2008-04-17 19:50:10
     
    dvee, May 9, 2008
    #5
  6. Hujo

    Hujo Guest

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.
     
    Hujo, May 9, 2008
    #6
  7. dvee

    dvee Member

    Joined:
    May 8, 2008
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    Liekö kone kunnossa kun mitään ei löytynyt?


    Malwarebytes' Anti-Malware 1.12
    Tietokantaversio: 739

    Tarkistustyyppi: Täysi tarkistus (C:\|)
    Tarkistetut kohteet: 182593
    Kulunut aika: 1 hour(s), 10 minute(s), 35 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)
     
    dvee, May 11, 2008
    #7
  8. Hujo

    Hujo Guest

    ajas tuo combofix uudelleen

    ==============

    Lataa SmitfraudFix (c) S!Ri
    Pura sisältö (kansio nimeltä SmitfraudFix) työpöydällesi:

    Avaa SmitfraudFix kansio ja tupla-klikkaa smitfraudfix.cmd
    Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
    Postita ponnahtava rapport – muistion sisältö viestiketjuusi.
    Löytyy myös C:\rapport.txt

    Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat
    (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja.
    A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä,
    silloin ne saattavat varoittaa käyttäjää.
     
    Last edited by a moderator: May 12, 2008
    Hujo, May 12, 2008
    #8
  9. dvee

    dvee Member

    Joined:
    May 8, 2008
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    Ensin ComboFix

    ComboFix 08-05-08.1 - FSC Amilo A1655 2008-05-13 16:26:47.2 - FAT32x86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.292 [GMT 3:00]
    Running from: C:\Documents and Settings\FSC Amilo A1655\Työpöytä\ComboFix.exe
    * Resident AV is active


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-04-13 to 2008-05-13 )))))))))))))))))
    .

    2008-05-11 12:36 . 2008-05-11 12:36 <KANSIO> d-------- C:\Documents and Settings\FSC Amilo A1655\Application Data\Malwarebytes
    2008-05-11 12:35 . 2008-05-11 12:35 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-05-11 12:35 . 2008-05-11 12:35 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-05-11 12:35 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-05-11 12:35 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-05-08 23:05 . 2008-05-08 23:05 <KANSIO> d-------- C:\WINDOWS\ERUNT
    2008-05-08 22:41 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-05-08 22:40 . 2008-05-08 22:40 <KANSIO> d-------- C:\Program Files\Java
    2008-05-08 22:40 . 2008-05-08 22:40 <KANSIO> d-------- C:\Program Files\Common Files\Java
    2008-05-08 21:53 . 2008-05-08 21:53 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-05-08 21:11 . 2008-05-08 21:11 <KANSIO> d-------- C:\Program Files\Security Task Manager
    2008-05-08 21:11 . 2008-05-08 21:11 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\SecTaskMan
    2008-04-28 22:12 . 2008-04-28 22:12 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-04-23 12:11 . 2008-04-23 12:11 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-04-23 12:11 . 2008-04-23 12:11 1,409 --a------ C:\WINDOWS\QTFont.for

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-05-08 20:02 4,230 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
    2008-03-15 21:09 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
    2008-03-03 17:37 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
    2008-03-01 15:31 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
    2008-02-29 08:56 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe
    2008-02-29 08:55 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
    2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
    2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll
    2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
    2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll
    2008-02-20 05:38 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
    2008-02-15 05:44 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
    2006-09-25 18:56 59,893 ----a-w C:\Program Files\memt32.zip
    2006-09-04 19:18 22 ----a-w C:\Program Files\mpc2kxp6490.zip
    2006-08-29 08:27 5,037,072 ----a-w C:\Program Files\spybotsd14.exe
    2006-06-20 17:09 3,511,317 ----a-w C:\Program Files\DCPlusPlus-0.691.exe
    2006-06-16 15:15 7,575,084 ----a-w C:\Program Files\KERIO413.EXE
    2006-06-16 14:08 13,707,176 ----a-w C:\Program Files\zlsSetup_65_714_000_en.exe
    .

    ((((((((((((((((((((((((((((( snapshot@2008-05-09_10.56.30,01 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-05-09 07:20:12 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-05-13 12:59:40 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [ ]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 12:00 15360]
    "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "UMonit"="C:\WINDOWS\system32\UMonit.exe" [2005-08-25 13:48 237568]
    "RTHDCPL"="RTHDCPL.EXE" [2005-07-13 10:37 14679552 C:\WINDOWS\RTHDCPL.EXE]
    "EPSON Stylus DX3800 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACE.exe" [2005-02-08 07:00 98304]
    "Norman ZANDA"="C:\Norman\Npm\bin\ZLH.exe" [2007-05-08 13:32 183352]
    "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2005-04-16 00:08 172032]
    "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-03-10 13:01 28160 C:\WINDOWS\KHALMNPR.Exe]
    "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46 57344]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 21:05 344064]
    "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 15:21 61952 C:\WINDOWS\system32\HdAShCut.exe]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
    "PowerManager"="C:\Program Files\Power Manager\PM.exe" [2005-09-16 09:38 31744]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-06-05 20:13 98304]
    "SMSERIAL"="sm56hlpr.exe" [2005-07-06 04:47 544768 C:\WINDOWS\sm56hlpr.exe]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 12:00 15360]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2006-06-20 17:04:14 438272]
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.divxa32"= DivXa32.acm

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CommonFiles\\intel\\AnsysWBU.exe"=
    "C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CAD Integration\\intel\\ActivePIMgrU.exe"=
    "C:\\Program Files\\ANSYS Inc\\v100\\AISOL\\CAD Integration\\intel\\ReaderHostU.exe"=
    "C:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\TCL\\bin\\intel\\tclsh.exe"=
    "C:\\Program Files\\ANSYS Inc\\v100\\CommonFiles\\TCL\\bin\\intel\\wish.exe"=
    "C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\MSN Messenger\\livecall.exe"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "C:\\Documents and Settings\\FSC Amilo A1655\\Työpöytä\\utorrent.exe"=

    R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21]
    R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21]
    R2 AdobeActiveFileMonitor;Adobe Active File Monitor;C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-20 04:47]
    R2 Ndiskio;Ndiskio;C:\Norman\Nse\bin\NDISKIO.SYS [2007-01-02 10:55]
    R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [2007-04-26 10:21]
    R2 Texis Monitor;Texis Monitor;C:\Abaqus\Documentation\monitor.exe [2003-04-29 21:02]
    R3 EKBfltr;ENE Keyboard Controller;C:\WINDOWS\system32\DRIVERS\EKBfltr.sys [2005-07-28 10:53]
    R3 NvcMFlt;NvcMFlt;C:\WINDOWS\system32\DRIVERS\nvcw32mf.sys [2008-02-11 14:56]
    R3 nvcoas;Norman Virus Control on-access component;C:\Norman\Nvc\bin\nvcoas.exe [2007-12-12 11:45]
    R3 NVCScheduler;Norman Virus Control Scheduler;C:\Norman\Nvc\BIN\NVCSCHED.EXE [2007-05-23 13:23]
    S3 fixustor;fixustor;C:\WINDOWS\system32\drivers\fixustor.sys [2005-08-17 19:25]
    S3 nvcfsr;nvcfsr;C:\Norman\Nvc\bin\nvcfsr.sys [2007-01-09 15:25]
    S3 nvcoafl51;nvcoafl51;C:\Norman\Nvc\bin\nvcoafl51.sys [2007-01-09 15:25]
    S3 nvcoaft51;nvcoaft51;C:\Norman\Nvc\bin\nvcoaft51.sys [2007-01-09 15:25]
    S3 nvcoarc51;nvcoarc51;C:\Norman\Nvc\bin\nvcoarc51.sys [2007-01-09 15:25]
    S3 usb20l;USB 2.0 10/100 Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\usb20l.SYS [2003-07-23 03:53]

    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-05-11 09:47:18 C:\WINDOWS\Tasks\SyncBack Synkkaus.job"
    - C:\Program Files\2BrightSparks\SyncBack\SyncBack.exe
    "2008-05-11 09:56:44 C:\WINDOWS\Tasks\SyncBack Koulu.job"
    - C:\Program Files\2BrightSparks\SyncBack\SyncBack.exe
    "2008-05-11 09:56:44 C:\WINDOWS\Tasks\SyncBack Töiden synkkaus.job"
    - C:\Program Files\2BrightSparks\SyncBack\SyncBack.exe
    "2008-05-11 09:49:44 C:\WINDOWS\Tasks\SyncBack Kuvat.job"
    - C:\Program Files\2BrightSparks\SyncBack\SyncBack.exe
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-13 16:32:49
    Windows 5.1.2600 Service Pack 2 FAT NTAPI

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    UMonit = C:\WINDOWS\system32\UMonit.exe?Vid_0????Pid_0712????????2&PID437????B\?O???????????? Q???????Q?????w????????DP??X?!????????|p??|????m??|d??w???????????????w???????????????? Q??????????@???0Q??????\Q?????w????????P?!?X?!??????R??A7!?P?!?X?!??!"??????R?????

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-05-13 16:35:21
    ComboFix-quarantined-files.txt 2008-05-13 13:35:10
    ComboFix2.txt 2008-05-09 07:57:52

    Pre-Run: 12,581,863,424 tavua vapaana
    Post-Run: 12,780,994,560 tavua vapaana

    143 --- E O F --- 2008-04-17 19:50:10


    Sitten SmitFraudFix

    SmitFraudFix v2.320

    Scan done at 16:41:41,20, ti 13.05.2008
    Run from C:\Documents and Settings\FSC Amilo A1655\Ty”p”yt„\SmitfraudFix
    OS: Microsoft Windows XP [versio 5.1.2600] - Windows_NT
    The filesystem type is FAT32
    Fix run in normal mode

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Norman\Npm\bin\ELOGSVC.EXE
    C:\Norman\Npm\Bin\Zanda.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Abaqus\Documentation\monitor.exe
    C:\Abaqus\Documentation\monitor.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\Norman\Nvc\BIN\NVCSCHED.EXE
    C:\Norman\Npm\bin\NJEEVES.EXE
    C:\Norman\Nvc\bin\nvcoas.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\UMonit.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Norman\Npm\bin\ZLH.EXE
    C:\Program Files\Apoint2K\Apoint.exe
    C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\Program Files\Power Manager\PM.exe
    C:\WINDOWS\sm56hlpr.exe
    C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
    C:\Norman\Nvc\BIN\NIP.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Norman\Nvc\bin\cclaw.exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\system32\cmd.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    »»»»»»»»»»»»»»»»»»»»»»»» C:\


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\FSC Amilo A1655


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\FSC Amilo A1655\Application Data


    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu


    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\FSCAMI~1\SUOSIKIT


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="Nykyinen kotisivu"


    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
    !!!Attention, following keys are not inevitably infected!!!

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» VACFix
    !!!Attention, following keys are not inevitably infected!!!

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
    !!!Attention, following keys are not inevitably infected!!!

    404Fix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
    "System"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Rustock



    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: Realtek RTL8139 Family PCI Fast Ethernet NIC - Paketinajoituksen miniportti
    DNS Server Search Order: 192.168.254.254
    DNS Server Search Order: 192.168.254.254

    Description: Broadcom 802.11g Verkkoadapteri - Paketinajoituksen miniportti
    DNS Server Search Order: 195.148.49.100
    DNS Server Search Order: 192.168.0.1

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{D8090B33-9FE7-4708-AC5B-852AC109338B}: DhcpNameServer=195.148.49.100 192.168.0.1
    HKLM\SYSTEM\CCS\Services\Tcpip\..\{E0AA5E3D-C314-4209-8450-1011BAB944FB}: DhcpNameServer=192.168.254.254 192.168.254.254
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{D8090B33-9FE7-4708-AC5B-852AC109338B}: DhcpNameServer=195.148.49.100 192.168.0.1
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{E0AA5E3D-C314-4209-8450-1011BAB944FB}: DhcpNameServer=192.168.254.254 192.168.254.254
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{D8090B33-9FE7-4708-AC5B-852AC109338B}: DhcpNameServer=195.148.49.100 192.168.0.1
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{E0AA5E3D-C314-4209-8450-1011BAB944FB}: DhcpNameServer=192.168.254.254 192.168.254.254
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.254.254 192.168.254.254
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.254.254 192.168.254.254
    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.254.254 192.168.254.254


    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


    »»»»»»»»»»»»»»»»»»»»»»»» End
     
    dvee, May 13, 2008
    #9

Share This Page