Kone takkuaa hieman + HJT LOGI

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by tocsii, Apr 26, 2008.

  1. tocsii

    tocsii Member

    Joined:
    May 30, 2007
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    11
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:29:07, on 26.4.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
    C:\Program Files\Norman\Npm\Bin\Zanda.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Norman\Npm\bin\ZLH.EXE
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Last.fm\LastFMHelper.exe
    C:\Program Files\Norman\Nvc\BIN\NIP.EXE
    C:\Program Files\Norman\Npf\BIN\npfmsg2.exe
    C:\Program Files\Norman\Npf\BIN\NPFSVICE.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
    C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\PeerGuardian2\pg2.exe
    C:\Program Files\Winamp\winamp.exe
    C:\Program Files\Last.fm\LastFM.exe
    C:\Program Files\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Program Files\Norman\Npm\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [winsock32] C:\WINDOWS\system32:winsock32.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1205274240765
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown owner - C:\Program Files\Norman\Npf\BIN\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

    --
    End of file - 4918 bytes



    Hieman vielä epäilyttää tuommonen winsock32 tiedosto. CCleaner näyttäisi että se käynnistyisi aina tietokoneen käynnistyksen yhdeydessä!
     
    tocsii, Apr 26, 2008
    #1
  2. Hujo

    Hujo Guest

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Hujo, Apr 27, 2008
    #2
  3. tocsii

    tocsii Member

    Joined:
    May 30, 2007
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    11
    Oikein paljon kiitosta sinulle vastauksesta! :). Näyttäisi ainakin omaan silmään paremmalle näitä reportteja ja logeja katsellessa. Ainakin lähti tuo winsock32 pois!

    SDFix reportti olisi tässä:


    SDFix: Version 1.177
    Run by Hesus on to 01.05.2008 at 12:07

    Microsoft Windows XP [versio 5.1.2600]
    Running From: C:\DOCUME~1\Hesus\TYPYT~1\SDFix

    Checking Services :


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File

    Rebooting


    Checking Files :

    No Trojan Files Found






    Removing Temp Files

    ADS Check :


    C:\WINDOWS\system32
    :winsock32.exe 774241
    Total size: 774241 bytes.
    system32: deleted 774241 bytes in 1 streams.

    Checking for remaining Streams

    C:\WINDOWS\system32
    No streams found.


    Final Check :

    catchme 0.3.1353.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-01 12:12:23
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    scanning hidden registry entries ...

    scanning hidden files ...

    C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb0005A.log 131072 bytes

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 1


    Remaining Services :




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
    "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
    "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

    Remaining Files :


    File Backups: - C:\DOCUME~1\Hesus\TYPYT~1\SDFix\backups\backups.zip

    Files with Hidden Attributes :


    Finished!



    Ja tässä olisi HJT Logi:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:19:03, on 1.5.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
    C:\Program Files\Norman\Npm\Bin\Zanda.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Norman\Npf\BIN\NPFSVICE.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Norman\Npm\bin\ZLH.EXE
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\PeerGuardian2\pg2.exe
    C:\Program Files\Last.fm\LastFMHelper.exe
    C:\Program Files\Norman\Npf\BIN\npfmsg2.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Norman\Nvc\BIN\NIP.EXE
    C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Program Files\Norman\Npm\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1205274240765
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\Bin\eLogsvc.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown owner - C:\Program Files\Norman\Npf\BIN\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

    --
    End of file - 4969 bytes
     
    tocsii, May 1, 2008
    #3
  4. Hujo

    Hujo Guest

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, May 1, 2008
    #4
  5. tocsii

    tocsii Member

    Joined:
    May 30, 2007
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    11
    Tässä olis combofixin logi:


    ComboFix 08-04-29.5 - Hesus 2008-05-01 13:27:59.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.625 [GMT 3:00]
    Running from: C:\Documents and Settings\Hesus\Työpöytä\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-04-01 to 2008-05-01 )))))))))))))))))
    .

    2008-05-01 12:23 . 2008-05-01 12:24 1,355 --a------ C:\WINDOWS\imsins.BAK
    2008-05-01 11:59 . 2008-05-01 11:59 <KANSIO> d-------- C:\WINDOWS\ERUNT
    2008-04-26 20:19 . 2008-05-01 13:29 <KANSIO> d-------- C:\Program Files\PeerGuardian2
    2008-04-26 15:50 . 2008-04-26 15:50 <KANSIO> d-------- C:\Program Files\Lavasoft
    2008-04-26 15:50 . 2008-04-26 15:50 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-04-21 21:02 . 2008-04-24 15:20 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-04-21 21:02 . 2008-04-21 21:02 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-04-21 19:51 . 2008-04-21 19:51 <KANSIO> d-------- C:\Program Files\Mopokorttikoulu
    2008-04-14 18:00 . 2008-04-14 18:00 <KANSIO> d-------- C:\Documents and Settings\Hesus\Application Data\Ubisoft
    2008-04-14 16:58 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-04-14 16:57 . 2008-04-14 16:57 <KANSIO> d-------- C:\Program Files\Common Files\Java
    2008-04-14 16:02 . 2008-04-14 16:02 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Ubisoft
    2008-04-14 16:02 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll
    2008-04-14 16:02 . 2007-10-12 15:14 1,374,232 --a------ C:\WINDOWS\system32\D3DCompiler_36.dll
    2008-04-14 16:02 . 2007-07-19 18:14 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll
    2008-04-14 16:02 . 2007-10-02 09:56 444,776 --a------ C:\WINDOWS\system32\d3dx10_36.dll
    2008-04-14 16:02 . 2007-07-19 18:14 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll
    2008-04-14 16:02 . 2007-10-22 03:39 267,272 --a------ C:\WINDOWS\system32\xactengine2_10.dll
    2008-04-14 16:02 . 2007-07-20 00:57 267,112 --a------ C:\WINDOWS\system32\xactengine2_9.dll
    2008-04-13 21:59 . 2008-04-13 22:00 <KANSIO> d-------- C:\WINDOWS\.jagex_cache_32
    2008-04-12 12:50 . 2008-04-12 12:55 <KANSIO> d-------- C:\WINDOWS\.mpr_file_store_32
    2008-04-11 07:43 . 2008-04-11 07:43 <KANSIO> d-------- C:\Documents and Settings\Hesus\Application Data\.BitTornado
    2008-04-10 01:09 . 2008-04-10 01:09 <KANSIO> d-------- C:\Program Files\BitTornado
    2008-04-09 23:22 . 2008-04-09 23:22 <KANSIO> d-------- C:\Documents and Settings\Hesus\Application Data\Media Player Classic
    2008-04-09 22:46 . 2008-04-09 23:01 261 --a------ C:\WINDOWS\maketorrent.ini
    2008-04-09 22:41 . 2008-04-09 22:41 <KANSIO> d-------- C:\Program Files\Maketorrent 2
    2008-04-09 00:21 . 2008-04-09 00:21 <KANSIO> d-------- C:\Program Files\VideoLAN
    2008-04-09 00:21 . 2008-04-09 00:21 <KANSIO> d-------- C:\Documents and Settings\Hesus\Application Data\vlc
    2008-04-06 18:16 . 2008-04-06 18:16 <KANSIO> d-------- C:\Program Files\Axife Mouse Recorder DEMO
    2008-04-05 23:26 . 2008-04-05 23:25 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-04-05 23:25 . 2008-04-05 23:25 107,832 --a------ C:\WINDOWS\system32\PnkBstrB.exe
    2008-04-05 23:25 . 2008-04-05 23:25 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
    2008-04-04 13:08 . 2008-04-04 13:10 <KANSIO> d-------- C:\Program Files\CDex_150

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-05-01 10:16 5 ----a-w C:\NPF_USER.DAT
    2008-05-01 10:15 --------- d-----w C:\Program Files\Norman
    2008-04-30 03:54 --------- d-----w C:\Documents and Settings\Hesus\Application Data\NoNameScript
    2008-04-28 21:24 --------- d-----w C:\Documents and Settings\Hesus\Application Data\uTorrent
    2008-04-26 17:47 --------- d-----w C:\Program Files\Steam
    2008-04-26 17:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\NPF
    2008-04-26 12:49 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-04-21 04:14 --------- d-----w C:\Program Files\iTunes
    2008-04-14 22:01 --------- d-----w C:\Documents and Settings\Hesus\Application Data\Ventrilo
    2008-04-14 13:58 --------- d-----w C:\Program Files\Java
    2008-04-14 12:48 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-04-10 12:50 --------- d-----w C:\Program Files\uTorrent
    2008-04-08 21:21 --------- d-----w C:\Documents and Settings\Hesus\Application Data\vlc
    2008-03-31 20:40 --------- d-----w C:\Documents and Settings\Hesus\Application Data\AccurateRip
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-18 13:25 --------- d-----w C:\Program Files\Music NFO Builder
    2008-03-17 12:45 --------- d-----w C:\Program Files\Audacity
    2008-03-15 19:03 --------- d-----w C:\Program Files\Foxit Reader
    2008-03-15 17:52 --------- d-----w C:\Program Files\Lavalys
    2008-03-15 14:19 --------- d-----w C:\Program Files\Guitar Pro 5
    2008-03-15 12:04 --------- d-----w C:\Program Files\Photoshop
    2008-03-15 12:03 --------- d-----w C:\Program Files\Common Files\Adobe
    2008-03-15 12:01 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
    2008-03-15 12:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems
    2008-03-15 11:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
    2008-03-14 23:47 --------- d-----w C:\Program Files\PowerISO
    2008-03-13 17:30 --------- d-----w C:\Documents and Settings\Hesus\Application Data\mIRC
    2008-03-12 13:40 --------- d-----w C:\Documents and Settings\Hesus\Application Data\Winamp
    2008-03-12 13:20 --------- d-----w C:\Program Files\Windows Live Toolbar
    2008-03-12 05:24 --------- d-----w C:\Program Files\Jakes Alarm Clock
    2008-03-11 22:43 --------- d-----w C:\Program Files\URUSoft
    2008-03-11 22:37 --------- d-----w C:\Program Files\iPod
    2008-03-11 22:37 --------- d-----w C:\Documents and Settings\Hesus\Application Data\Apple Computer
    2008-03-11 22:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-03-11 22:36 --------- d-----w C:\Program Files\QuickTime
    2008-03-11 22:20 --------- d-----w C:\Program Files\Windows Live
    2008-03-11 22:19 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
    2008-03-11 22:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-03-11 22:08 --------- d-----w C:\Program Files\Last.fm
    2008-03-11 22:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Last.fm
    2008-03-11 22:07 --------- d-----w C:\Program Files\ffdshow
    2008-03-11 22:05 --------- d-----w C:\Program Files\CCleaner
    2008-03-11 21:45 --------- d-----w C:\Program Files\Webteh
    2008-03-11 21:33 --------- d-----w C:\Documents and Settings\Hesus\Application Data\Logitech
    2008-03-11 21:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
    2008-03-11 21:25 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
    2008-03-11 21:24 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
    2008-03-11 21:24 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
    2008-03-11 21:24 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
    2008-03-11 21:24 --------- d-----w C:\Program Files\Logitech
    2008-03-11 21:24 --------- d-----w C:\Program Files\Common Files\Logishrd
    2008-03-11 21:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
    2008-03-11 21:17 --------- d-----w C:\Documents and Settings\Hesus\Application Data\InstallShield
    2008-03-11 21:11 --------- d-----w C:\Program Files\Common Files\InstallShield
    2008-03-11 21:09 --------- d-----w C:\Program Files\Winamp
    2008-03-11 21:02 --------- d-----w C:\Program Files\microsoft frontpage
    2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
    2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
    2008-02-16 09:02 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
    "PeerGuardian"="C:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
    "nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920]
    "Norman ZANDA"="C:\Program Files\Norman\Npm\bin\ZLH.exe" [2007-04-27 14:58 183352]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]

    C:\Documents and Settings\Hesus\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2008-03-12 01:08:18 106496]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll 2008-01-09 13:30 72208 c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=

    R0 NDIS_RD;Firewall Engine Type-R2;C:\WINDOWS\system32\drivers\NDIS_RD.sys [2004-12-06 11:18]
    R1 TDI_RD;Firewall Engine Type-R;C:\WINDOWS\system32\drivers\tdi_rd.sys [2004-10-13 23:01]
    R2 Ndiskio;Ndiskio;C:\Program Files\Norman\Nse\bin\NDISKIO.SYS [2007-01-02 10:55]
    R3 NVCScheduler;Norman Virus Control Scheduler;C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE [2007-03-15 12:48]


    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{0DA3B9B7-3DB5-97A1-DA31-969D6950BB42}]
    C:\WINDOWS\system32:winsock32.exe
    .
    **************************************************************************

    catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-01 13:29:37
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-05-01 13:34:44
    ComboFix-quarantined-files.txt 2008-05-01 10:34:39

    Pre-Run: 149,774,811,136 tavua vapaana
    Post-Run: 149,839,032,320 tavua vapaana

    158 --- E O F --- 2008-05-01 09:24:23
     
    tocsii, May 1, 2008
    #5
  6. Hujo

    Hujo Guest

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.
     
    Hujo, May 1, 2008
    #6

Share This Page