Kyseessä pari kk vanha läppis & vista. Vähän aikaa sitten tuli sp1 tähän vistaan ja kone asensi sen automaattisesti, sen jälkeen takkuillu. Oli tässä joku viruskin, mutta ilmeisesti avast blokkasi sen ja avg poisti jäämät siitä. Lokia seuraksi; Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:13:35, on 21.4.2008 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: C:\Windows\system32\taskeng.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files\Alwil Software\Avast4\ashDisp.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Users\jakke\AppData\Local\Temp\RtkBtMnt.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fi.intl.acer.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fi.intl.acer.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O1 - Hosts: ::1 localhost O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll (file missing) O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu') O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O13 - Gopher Prefix: O20 - AppInit_DLLs: eNetHook.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - D:\Asennustiedostot\Adaware\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Asennustiedostot\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing) O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\Windows\system32\oodag.exe O23 - Service: O2Micro Flash Memory Card Service (o2flash) - O2Micro International - C:\Program Files\O2Micro Oz128 Driver\o2flash.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
scannaa hjt:llä merkkaa paina Fix checked R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) ============== 1.Lataa combofix.exe työpöydällesi yhdestä linkistä: combofix1 combofix2 2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen. ============ Lataa Malwarebytes' Anti-Malware työpöydällesi. 1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman. 2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish. 3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version. 4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan. 5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset. 6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected. 7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt 8. Lähetä lokin sisältö seuraavassa viestissäsi.
Combofixi; ComboFix 08-04-22.5 - jakke 2008-04-24 20:08:06.1 - NTFSx86 Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1035.18.1448 [GMT 3:00] Running from: C:\Users\jakke\Contacts\Desktop\ComboFix.exe * Created a new restore point . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-03-24 to 2008-04-24 ))))))))))))))))) . 2008-04-24 07:10 . 2008-04-24 07:10 0 --a------ C:\Windows\System32\config.nt 2008-04-23 23:06 . 2008-04-24 19:06 419,814 --a------ C:\Windows\System32\PerfStringBackup.INI 2008-04-23 23:06 . 2006-11-02 12:20 287,440 --a------ C:\Windows\System32\perfi009.dat 2008-04-23 23:06 . 2006-11-02 12:20 30,674 --a------ C:\Windows\System32\perfd009.dat 2008-04-23 23:04 . 2008-04-24 19:06 53,522 --a------ C:\Windows\System32\perfh00B.dat 2008-04-23 23:04 . 2008-04-24 19:06 12,420 --a------ C:\Windows\System32\perfc00B.dat 2008-04-23 22:54 . 2008-04-23 22:54 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf 2008-04-23 22:52 . 2008-04-23 22:52 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf 2008-04-23 22:08 . 2008-04-24 19:00 65,536 --------- C:\Windows\System32\Ikeext.etl 2008-04-21 12:13 . 2008-04-21 12:13 <KANSIO> d-------- C:\Program Files\Trend Micro 2008-04-20 21:26 . 2008-04-20 21:27 235,599,352 --a------ C:\BackupRegistry(20080420).reg 2008-04-20 21:16 . 2008-04-20 21:16 <KANSIO> d-------- C:\Program Files\Webteh 2008-04-20 12:43 . 2008-04-21 15:30 54,156 --ah----- C:\Windows\QTFont.qfn 2008-04-20 12:43 . 2008-04-20 12:43 1,409 --a------ C:\Windows\QTFont.for 2008-04-19 14:40 . 2008-04-19 14:40 <KANSIO> d-------- C:\Users\All Users\Apple Computer 2008-04-19 14:40 . 2008-04-19 14:40 <KANSIO> d-------- C:\ProgramData\Apple Computer 2008-04-19 14:40 . 2008-04-19 14:41 <KANSIO> d-------- C:\Program Files\QuickTime 2008-04-13 13:42 . 2008-02-15 02:19 944,184 --a------ C:\Windows\System32\winload.exe 2008-04-13 13:42 . 2008-02-19 08:10 620,088 --a------ C:\Windows\System32\ci.dll 2008-04-13 13:42 . 2008-02-29 09:39 371,712 --a------ C:\Windows\System32\srcore.dll 2008-04-13 13:42 . 2008-02-29 09:38 313,856 --a------ C:\Windows\System32\rstrui.exe 2008-04-13 13:42 . 2008-02-29 09:39 40,960 --a------ C:\Windows\System32\srclient.dll 2008-04-13 13:42 . 2008-02-29 09:51 19,000 --a------ C:\Windows\System32\kd1394.dll 2008-04-13 13:42 . 2008-02-29 09:38 16,384 --a------ C:\Windows\System32\srdelayed.exe 2008-04-13 13:42 . 2008-02-29 09:34 7,168 --a------ C:\Windows\System32\f3ahvoas.dll 2008-04-13 13:42 . 2008-02-29 09:35 6,656 --a------ C:\Windows\System32\kbd106n.dll 2008-04-13 13:40 . 2008-02-29 07:16 2,027,008 --a------ C:\Windows\System32\win32k.sys 2008-04-13 13:40 . 2008-02-21 07:43 296,448 --a------ C:\Windows\System32\gdi32.dll 2008-04-13 13:39 . 2007-12-16 14:42 83,968 --a------ C:\Windows\System32\dnsrslvr.dll 2008-04-13 13:39 . 2007-12-16 14:41 24,576 --a------ C:\Windows\System32\dnscacheugc.exe 2008-04-05 11:28 . 2008-04-05 11:28 <KANSIO> d-------- C:\Users\All Users\LightScribe 2008-04-05 11:28 . 2008-04-05 11:28 <KANSIO> d-------- C:\ProgramData\LightScribe 2008-03-29 14:53 . 2008-03-29 14:53 <KANSIO> d-------- C:\Sierra 2008-03-29 04:02 . 2008-03-29 04:02 <KANSIO> d-------- C:\Program Files\MSXML 4.0 2008-03-25 19:36 . 2008-04-20 12:55 69 --a------ C:\Windows\NeroDigital.ini 2008-03-24 20:25 . 2008-03-24 20:25 <KANSIO> d-------- C:\Users\jakke\AppData\Roaming\Nero 2008-03-24 20:22 . 2008-03-24 20:22 <KANSIO> d-------- C:\Users\All Users\Nero 2008-03-24 20:22 . 2008-03-24 20:22 <KANSIO> d-------- C:\ProgramData\Nero 2008-03-24 20:22 . 2008-03-24 20:24 <KANSIO> d-------- C:\Program Files\Common Files\Nero 2008-03-24 09:27 . 2008-03-24 09:27 <KANSIO> d-------- C:\Program Files\Valve 2008-03-24 01:19 . 1998-10-02 20:00 327,168 --a------ C:\Windows\IsUninst.exe 2008-03-24 01:00 . 2004-01-27 17:18 640,512 --a------ C:\Windows\system\WONAuth.dll 2008-03-24 00:51 . 2008-03-24 00:51 <KANSIO> d-------- C:\Program Files\MagicDisc 2008-03-24 00:51 . 2008-02-18 18:29 96,256 --a------ C:\Windows\System32\drivers\mcdbus.sys 2008-03-24 00:48 . 2008-03-24 00:48 <KANSIO> d-------- C:\Program Files\MagicISO . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-23 20:06 174 --sha-w C:\Program Files\desktop.ini 2008-04-23 19:57 --------- d-----w C:\Program Files\Windows Sidebar 2008-04-23 19:57 --------- d-----w C:\Program Files\Windows Photo Gallery 2008-04-23 19:57 --------- d-----w C:\Program Files\Windows Mail 2008-04-23 19:57 --------- d-----w C:\Program Files\Windows Journal 2008-04-23 19:57 --------- d-----w C:\Program Files\Windows Defender 2008-04-23 19:57 --------- d-----w C:\Program Files\Windows Collaboration 2008-04-23 19:57 --------- d-----w C:\Program Files\Windows Calendar 2008-04-23 19:02 --------- d-----w C:\ProgramData\Microsoft Help 2008-04-20 18:31 --------- d-----w C:\Users\jakke\AppData\Roaming\BSplayer 2008-04-20 18:09 --------- d-----w C:\Users\jakke\AppData\Roaming\uTorrent 2008-04-09 18:53 --------- d-----w C:\Program Files\DC++ 2008-04-09 18:15 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-03-29 17:32 50,768 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys 2008-03-28 22:52 --------- d-----w C:\Program Files\Java 2008-03-24 17:22 --------- d-----w C:\Program Files\Nero 2008-03-23 19:14 --------- d-----w C:\Users\jakke\AppData\Roaming\BSplayer Pro 2008-03-23 15:59 --------- d-----w C:\Program Files\Alcohol Soft 2008-03-23 15:54 --------- d-----w C:\Program Files\WinISO 2008-03-23 15:41 --------- d-----w C:\Program Files\DAEMON Tools Lite 2008-03-23 15:39 717,296 ----a-w C:\Windows\system32\drivers\sptd.sys 2008-03-23 15:38 --------- d-----w C:\Users\jakke\AppData\Roaming\DAEMON Tools 2008-03-15 12:42 319,456 ----a-w C:\Windows\DIFxAPI.dll 2008-03-15 12:41 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-03-15 12:41 --------- d-----w C:\Program Files\Realtek 2008-03-12 18:59 --------- d-----w C:\Program Files\Common Files\Borland 2008-03-02 15:09 --------- d-----w C:\ProgramData\Bluetooth 2008-03-02 15:07 --------- d-----w C:\Program Files\IVT Corporation 2008-03-01 05:33 --------- d-----w C:\Program Files\Common Files\Adobe 2008-02-21 04:43 826,368 ----a-w C:\Windows\System32\wininet.dll 2008-02-21 04:43 56,320 ----a-w C:\Windows\System32\iesetup.dll 2008-02-21 04:43 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll 2008-02-21 04:43 26,624 ----a-w C:\Windows\System32\ieUnatt.exe 2008-02-15 18:47 194,560 ----a-w C:\Windows\System32\WebClnt.dll 2008-02-15 18:42 3,504,696 ----a-w C:\Windows\System32\ntkrnlpa.exe 2008-02-15 18:42 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe 2008-02-15 18:41 24,064 ----a-w C:\Windows\System32\netcfg.exe 2008-02-15 18:41 22,016 ----a-w C:\Windows\System32\netiougc.exe 2008-02-15 18:41 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll 2008-02-15 18:40 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll 2008-02-15 18:40 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll 2008-02-15 18:40 4,247,552 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll 2008-02-15 18:40 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll 2008-02-15 18:40 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll 2008-02-15 18:40 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll 2008-02-15 18:40 1,686,528 ----a-w C:\Windows\System32\gameux.dll 2008-02-15 18:38 1,244,672 ----a-w C:\Windows\System32\mcmde.dll 2008-02-03 04:04 86,016 ----a-w C:\Windows\System32\icfupgd.dll 2008-02-03 04:04 61,952 ----a-w C:\Windows\System32\cmifw.dll 2008-02-03 04:04 396,800 ----a-w C:\Windows\System32\MPSSVC.dll 2008-02-03 04:04 392,192 ----a-w C:\Windows\System32\FirewallAPI.dll 2008-02-03 04:04 374,456 ----a-w C:\Windows\System32\mcupdate_GenuineIntel.dll 2008-02-03 04:04 178,688 ----a-w C:\Windows\System32\iphlpsvc.dll 2008-02-03 04:04 16,896 ----a-w C:\Windows\System32\wfapigp.dll 2008-02-03 04:03 57,856 ----a-w C:\Windows\System32\SLUINotify.dll 2008-02-03 04:03 566,784 ----a-w C:\Windows\System32\SLCommDlg.dll 2008-02-03 04:03 39,936 ----a-w C:\Windows\System32\slcinst.dll 2008-02-03 04:03 351,232 ----a-w C:\Windows\System32\SLUI.exe 2008-02-03 04:03 33,280 ----a-w C:\Windows\System32\slwmi.dll 2008-02-03 04:03 268,288 ----a-w C:\Windows\System32\mcbuilder.exe 2008-02-03 04:03 223,232 ----a-w C:\Windows\System32\SLC.dll 2008-02-03 04:03 2,605,568 ----a-w C:\Windows\System32\SLsvc.exe 2008-02-03 04:03 186,368 ----a-w C:\Windows\System32\SLLUA.exe 2008-02-03 03:59 87,040 ----a-w C:\Windows\System32\msoert2.dll 2008-02-03 03:59 5,120 ----a-w C:\Windows\System32\wmi.dll 2008-02-03 03:59 49,664 ----a-w C:\Windows\System32\csrsrv.dll 2008-02-03 03:59 39,424 ----a-w C:\Windows\System32\ACCTRES.dll 2008-02-03 03:59 376,320 ----a-w C:\Windows\System32\winsrv.dll 2008-02-03 03:59 36,864 ----a-w C:\Windows\System32\wmdmps.dll 2008-02-03 03:59 311,296 ----a-w C:\Windows\System32\mswmdm.dll 2008-02-03 03:59 31,744 ----a-w C:\Windows\System32\wmdmlog.dll 2008-02-03 03:59 205,824 ----a-w C:\Windows\System32\msoeacct.dll 2008-02-03 03:59 152,576 ----a-w C:\Windows\System32\imagehlp.dll 2008-02-03 03:58 633,856 ----a-w C:\Windows\System32\user32.dll 2008-02-02 13:55 704,000 ----a-w C:\Windows\System32\PhotoScreensaver.scr 2008-02-02 13:55 67,584 ----a-w C:\Windows\System32\wlanhlp.dll 2008-02-02 13:55 542,720 ----a-w C:\Windows\System32\sysmain.dll 2008-02-02 13:55 502,784 ----a-w C:\Windows\System32\wlansvc.dll 2008-02-02 13:55 47,104 ----a-w C:\Windows\System32\wlanapi.dll 2008-02-02 13:55 297,984 ----a-w C:\Windows\System32\wlansec.dll 2008-02-02 13:55 290,816 ----a-w C:\Windows\System32\wlanmsm.dll 2008-02-02 13:55 24,064 ----a-w C:\Windows\System32\wtsapi32.dll 2008-02-02 13:55 2,923,520 ----a-w C:\Windows\explorer.exe 2008-02-02 13:55 14,827 ----a-w C:\Windows\System32\gatherWirelessInfo.vbs 2008-02-02 13:52 8,147,968 ----a-w C:\Windows\System32\wmploc.DLL 2008-02-02 13:52 7,680 ----a-w C:\Windows\System32\spwmp.dll 2008-02-02 13:52 4,096 ----a-w C:\Windows\System32\dxmasf.dll 2008-02-02 13:51 356,864 ----a-w C:\Windows\System32\MediaMetadataHandler.dll 2008-02-02 13:48 8,704 ----a-w C:\Windows\System32\hcrstco.dll 2008-02-02 13:48 8,704 ----a-w C:\Windows\System32\hccoin.dll 2008-02-02 13:48 2,048 ----a-w C:\Windows\System32\msxml3r.dll 2008-02-02 13:48 1,191,936 ----a-w C:\Windows\System32\msxml3.dll 2008-02-02 13:47 1,327,104 ----a-w C:\Windows\System32\quartz.dll 2008-02-02 13:46 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL 2008-02-02 13:46 223,232 ----a-w C:\Windows\System32\WMASF.DLL 2008-02-02 13:46 2,048 ----a-w C:\Windows\System32\asferror.dll 2008-02-02 13:45 2,048 ----a-w C:\Windows\System32\msxml6r.dll 2008-02-02 13:45 1,335,296 ----a-w C:\Windows\System32\msxml6.dll 2008-02-02 13:44 61,440 ----a-w C:\Windows\System32\ntprint.exe 2008-02-02 13:44 269,824 ----a-w C:\Windows\System32\schannel.dll . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-09-20 16:35 202024] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-02-02 16:42 1232896] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 20:37 79224] "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 10:51 1836328] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-10-23 22:00 815104] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "RtHDVCpl"="RtHDVCpl.exe" [2007-04-23 16:51 4435968 C:\Windows\RtHDVCpl.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "PromptOnSecureDesktop"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe "WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe "ehTray.exe"=C:\Windows\ehome\ehTray.exe "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background "MSMSGS"="C:\Program Files\Messenger\Msmsgs.exe" /background "Acer Tour Reminder"=C:\Acer\AcerTour\Reminder.exe "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe "Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe -hide "RtHDVCpl"=RtHDVCpl.exe "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" "LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" "Adobe Reader Speed Launcher"="c:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" "eDataSecurity Loader"=C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe "LManager"=C:\PROGRA~1\LAUNCH~1\LManager.exe "WarReg_PopUp"=C:\Acer\WR_PopUp\WarReg_PopUp.exe "Skytel"=Skytel.exe "eRecoveryService"= "Acer Tour Reminder"=C:\Acer\AcerTour\Reminder.exe "NeroFilterCheck"=C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UacDisableNotify"=dword:00000001 "InternetSettingsDisableNotify"=dword:00000001 "AutoUpdateDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{71D75F7D-C7F3-48F3-8861-BD8D1B381E6C}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook "{3BDD7AFF-B453-47C4-9619-C0406DF55D9C}"= C:\Program Files\CyberLink\PowerDVD\PowerDVD.EXE:CyberLink PowerDVD "{32365688-6BE6-4130-9C75-426F5495C845}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{046ECC35-8EC0-4A76-888C-1971EA607C79}"= UDP:C:\Program Files\FirstClass\fcc32.exe:FirstClass "{43E9FCBD-35EC-42B0-ADDF-85BF1391F9AC}"= TCP:C:\Program Files\FirstClass\fcc32.exe:FirstClass "{11D1F375-2219-420B-9633-656FFD7406A0}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent "{415478EB-FD4A-460E-BC05-43D63708E656}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent "TCP Query User{F20E8134-A0AF-45B7-955A-BC003FE20C1B}C:\\program files\\dc++\\dcplusplus.exe"= UDP:C:\program files\dc++\dcplusplus.exeC++ "UDP Query User{0E39683A-8CDE-4BDC-8E55-BC0FC04D88A2}C:\\program files\\dc++\\dcplusplus.exe"= TCP:C:\program files\dc++\dcplusplus.exeC++ "TCP Query User{70BDE4E8-55AD-4B5E-BB2A-2678DFC983D5}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{0DF9319C-24DD-4ECF-B602-675DC3CBFEA6}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox "{EF1B383C-DEB9-4C09-A50B-E6D915745133}"= UDP:C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:BlueSoleil "{01A3F828-65E8-4FA6-81EE-08CC6537804E}"= TCP:C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:BlueSoleil "{9DF3E3F5-28CB-42E1-92D7-9AAFB179CDA4}"= UDP:C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:BlueSoleil "{4CE73463-7F66-497E-BD80-36FD3EBD4C19}"= TCP:C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:BlueSoleil "TCP Query User{5ED251A3-4C49-49CA-A2CA-E6698B751D88}C:\\program files\\messenger\\msmsgs.exe"= UDP:C:\Program Files\Messenger\Msmsgs.exe:Windows Messenger "UDP Query User{AB7000F7-AD84-4083-85E2-9B3B8B3EAD23}C:\\program files\\messenger\\msmsgs.exe"= TCP:C:\Program Files\Messenger\Msmsgs.exe:Windows Messenger "TCP Query User{291D40FF-3D1D-4C41-98D1-994D0BC22B94}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{3ECFA540-F1AB-4808-979F-7C1ACEAD1792}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox "{E5822E07-0EED-4321-9ADE-F10DEA4B244B}"= UDP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent "{A66C1209-53E2-4953-96EF-17FD528B83B8}"= TCP:C:\Program Files\uTorrent\uTorrent.exe:µTorrent "TCP Query User{FE7BE31C-5C26-405F-97FC-B527F5D01B38}C:\\program files\\messenger\\msmsgs.exe"= UDP:C:\program files\messenger\msmsgs.exe:Windows Messenger "UDP Query User{0B46B2A3-4903-4060-898D-543DFAA3B5AC}C:\\program files\\messenger\\msmsgs.exe"= TCP:C:\program files\messenger\msmsgs.exe:Windows Messenger "{8277A90E-AAFD-4E07-9540-7BC2570CE94A}"= UDP:4000:dc "TCP Query User{AAC09036-21C7-44F3-BD53-0112D1533E6D}C:\\program files\\dc++\\dcplusplus.exe"= UDP:C:\program files\dc++\dcplusplus.exeC++ "UDP Query User{0AD5F335-A64D-4925-9460-28069E2F261E}C:\\program files\\dc++\\dcplusplus.exe"= TCP:C:\program files\dc++\dcplusplus.exeC++ "{08DBB9A0-D8C1-49C2-B817-AB343EC11652}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "TCP Query User{61D5B778-5A7E-474E-93F5-9C5B4005E432}C:\\program files\\valve\\half-life\\hl.exe"= UDP:C:\program files\valve\half-life\hl.exe:Half-Life Launcher "UDP Query User{B5506BFC-124D-4C75-8846-813F2279BE72}C:\\program files\\valve\\half-life\\hl.exe"= TCP:C:\program files\valve\half-life\hl.exe:Half-Life Launcher "TCP Query User{2CEB3971-794A-4605-9834-3D452010F217}D:\\pelit\\empire earth\\empire earth.exe"= UDP:\pelit\empire earth\empire earth.exe:Empire Earth "UDP Query User{302B712E-A298-45E5-A2C2-67885A3A59EB}D:\\pelit\\empire earth\\empire earth.exe"= TCP:\pelit\empire earth\empire earth.exe:Empire Earth "TCP Query User{B90AE7F7-A528-47A0-AF9C-7927AC087A81}C:\\program files\\valve\\half-life\\hl.exe"= UDP:C:\program files\valve\half-life\hl.exe:Half-Life Launcher "UDP Query User{A336AAE2-9E82-452D-B5AC-DC47E5B174BA}C:\\program files\\valve\\half-life\\hl.exe"= TCP:C:\program files\valve\half-life\hl.exe:Half-Life Launcher "{55844D8F-9424-406B-A5B3-AF0DFD3D944D}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System] "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic| R0 O2MDRDR;O2MDRDR;C:\Windows\system32\DRIVERS\o2media.sys [2007-04-03 20:04] R0 O2SDRDR;O2SDRDR;C:\Windows\system32\DRIVERS\o2sd.sys [2007-04-03 02:11] R0 PSDFilter;PSDFilter;C:\Windows\system32\DRIVERS\psdfilter.sys [2007-04-12 18:43] R0 PSDNServ;PSDNSERVER;C:\Windows\system32\drivers\PSDNServ.sys [2007-04-12 18:43] R0 psdvdisk;psdvdisk;C:\Windows\system32\drivers\psdvdisk.sys [2007-04-12 18:43] R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-03-29 20:31] R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};C:\Program Files\CyberLink\PowerDVD\000.fcl [2006-11-02 17:51] R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-03-29 20:35] R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-03-29 20:32] R2 BcmSqlStartupSvc;Business Contact Managerin SQL Server -käynnistyspalvelu;"C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe" [2008-01-16 12:16] R2 eDataSecurity Service;eDSService.exe;"C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe" [2007-04-12 18:43] R2 eNet Service;eNet Service;C:\Acer\Empowering Technology\eNet\eNet Service.exe [2007-04-17 20:36] R2 eSettingsService;eSettings Service;C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe [2007-06-28 19:50] R2 MobilityService;MobilityService;C:\Acer\Mobility Center\MobilityService.exe [2006-11-24 13:57] R2 SQLWriter;SQL Server VSS Writer;"C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [2007-02-10 06:29] R2 WMIService;ePower Service;C:\Acer\Empowering Technology\ePower\ePowerSvc.exe [2007-06-13 12:23] R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2006-08-05 19:39] R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-07-28 10:36] R3 Cam5607;Acer Crystal Eye webcam;C:\Windows\system32\Drivers\BisonC07.sys [2007-06-12 03:59] R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\system32\DRIVERS\yk60x86.sys [2007-12-06 10:51] S3 athr;Atheros Extensible Wireless LAN device driver;C:\Windows\system32\DRIVERS\athr.sys [2006-11-02 10:30] S3 BCM43XV;Broadcom Extensible 802.11 Network Adapter Driver;C:\Windows\system32\DRIVERS\bcmwl6.sys [2006-12-19 23:18] S3 flash;flash;C:\Windows\system32\drivers\flash.sys [2005-11-17 16:36] S3 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);"C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sMSSMLBIZ [] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bthsvcs REG_MULTI_SZ BthServ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{660eb9db-f8ef-11dc-85e0-000000000000}] \shell\AutoRun\command - F:\AUTORUN.EXE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{76996462-f91b-11dc-a859-000000000000}] \shell\AutoRun\command - F:\AUTORUN.EXE *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-24 20:10:41 Windows 6.0.6000 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-04-24 20:12:08 ComboFix-quarantined-files.txt 2008-04-24 17:11:51 Pre-Run: 48,710,295,552 tavua vapaana Post-Run: 48,469,082,112 tavua vapaana 292 --- E O F --- 2008-04-20 10:27:46 Malwarebytes loki; Malwarebytes' Anti-Malware 1.11 Tietokantaversio: 677 Tarkistustyyppi: Täysi tarkistus (C:\|D:\|) Tarkistetut kohteet: 146467 Kulunut aika: 46 minute(s), 11 second(s) Saastuneita muistiprosesseja: 0 Saastuneita muistimoduuleja: 0 Saastuneita rekisteriavaimia: 0 Saastuneita rekisteriarvoja: 0 Saastuneita rekisterikohteita: 0 Saastuneita hakemistoja: 0 Saastuneita tiedostoja: 1 Saastuneita muistiprosesseja: (Haitallisia kohteita ei löydetty) Saastuneita muistimoduuleja: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriavaimia: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriarvoja: (Haitallisia kohteita ei löydetty) Saastuneita rekisterikohteita: (Haitallisia kohteita ei löydetty) Saastuneita hakemistoja: (Haitallisia kohteita ei löydetty) Saastuneita tiedostoja: D:\Lataukset\Yamicsoft.Vista.Manager.v1.4.Incl.Keymaker-CORE\CORE10k.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
