Koneessani on Trojan.Win32.Patched.aa HJT-log

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by AkAntA, May 21, 2008.

  1. AkAntA

    AkAntA Member

    Joined:
    Oct 15, 2007
    Messages:
    58
    Likes Received:
    0
    Trophy Points:
    16
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:18:20, on 21.5.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    D:\WINDOWS\System32\smss.exe
    D:\WINDOWS\system32\winlogon.exe
    D:\WINDOWS\system32\services.exe
    D:\WINDOWS\system32\lsass.exe
    D:\WINDOWS\system32\svchost.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\system32\spoolsv.exe
    D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    D:\WINDOWS\ATKKBService.exe
    D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
    D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
    D:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
    D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
    D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
    D:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
    D:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
    D:\WINDOWS\system32\nvsvc32.exe
    D:\WINDOWS\system32\svchost.exe
    D:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
    D:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
    D:\Program Files\Sonera Tietoturva\Anti-Virus\fsrw.exe
    D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
    D:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\system32\WgaTray.exe
    D:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
    D:\WINDOWS\Explorer.EXE
    D:\WINDOWS\htpatch.exe
    D:\WINDOWS\system32\RunDll32.exe
    D:\Program Files\TW-IA300C ADSL\CnxDslTb.exe
    D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe
    D:\PROGRA~1\SONERA~1\ANTI-S~1\fsaw.exe
    D:\WINDOWS\system32\wuauclt.exe
    D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    K:\Hewlett\Digital Imaging\Unload\hpqcmon.exe
    K:\Hewlett\HP Share-to-Web\hpgs2wnd.exe
    D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    D:\WINDOWS\system32\RUNDLL32.EXE
    D:\Program Files\QuickTime\QTTask.exe
    D:\WINDOWS\system32\ctfmon.exe
    K:\valve\steam\steam.exe
    D:\Program Files\Sonera Tietoturva\FSGUI\fsguidll.exe
    D:\Program Files\MSN Messenger\MsnMsgr.Exe
    K:\Hewlett\HP Share-to-Web\hpgs2wnf.exe
    D:\Program Files\redline\gameutil.exe
    D:\Program Files\HotKey\HotKey.exe
    D:\Program Files\Logitech\SetPoint\SetPoint.exe
    D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
    K:\mIRC\mirc.exe
    D:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
    D:\Program Files\Mozilla Firefox\firefox.exe
    K:\jtn\fasdfadsfdas\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O4 - HKLM\..\Run: [HTpatch] D:\WINDOWS\htpatch.exe
    O4 - HKLM\..\Run: [SiSUSBRG] D:\WINDOWS\SiSUSBrg.exe
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [CnxDslTaskBar] "D:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [ScanRegistry] D:\W
    O4 - HKLM\..\Run: [F-Secure Manager] "D:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "D:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [News Service] "D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [RedLine Taskbar] D:\Program Files\RedLine\Taskbar.exe
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "D:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [CamMonitor] K:\Hewlett\Digital Imaging\\Unload\hpqcmon.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] K:\Hewlett\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [j2291439] rundll32 D:\WINDOWS\system32\j2291439.dll sook
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] K:\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Steam] "k:\valve\steam\steam.exe" -silent
    O4 - HKCU\..\Run: [ProBNC] "D:\Documents and Settings\Jani\Työpöytä\arkku\Arkku IP Updater\sysupdate.exe"
    O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [FTPUploader] F:\ftpuploader\FTPUploader.exe /s
    O4 - HKCU\..\Run: [Free Download Manager] F:\Free Download Manager\fdm.exe -autorun
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (User 'Default user')
    O4 - Startup: mIRC.lnk = K:\mIRC\mirc.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: DllCmd32.lnk = C:\jetsuite\DLLCMD32.EXE
    O4 - Global Startup: gameutil.exe.lnk = ?
    O4 - Global Startup: HotKey Driver.lnk = D:\Program Files\HotKey\HotKey.exe
    O4 - Global Startup: HP LaserJet 3100 Status.lnk = C:\jetsuite\JETSTAT.EXE
    O4 - Global Startup: Logitech SetPoint.lnk = D:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Sonera Tietoturva.lnk = D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
    O8 - Extra context menu item: &Estä tämä kohoikkuna - D:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - D:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - D:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
    O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab
    O16 - DPF: {861FDA2A-2B57-4BDA-8B8B-305C9D5D8604} (_Multimedia Player) - http://stream.pussyharem.com/stream/mmp2.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
    O20 - Winlogon Notify: abbaeeea - D:\WINDOWS\system32\abbaeeea.dll (file missing)
    O21 - SSODL: JxuZgsR - {31451BE6-9BEF-B14C-E3AC-AEAC623890C5} - D:\WINDOWS\System32\ddloa.dll (file missing)
    O23 - Service: Apple Mobile Device - Apple, Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - D:\WINDOWS\ATKKBService.exe
    O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
    O23 - Service: fsbwsys - F-Secure Corp. - D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Process Monitor (LVPrcSrv) - Unknown owner - d:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe (file missing)
    O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - D:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - K:\sissari\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe
    O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - K:\sissari\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe
    O23 - Service: ServiceLayer - Nokia. - D:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - D:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
    O24 - Desktop Component 0: (no name) - file:///D:/DOCUME~1/Jani/LOCALS~1/Temp/msohtml1/05/clip_image001.jpg
    O24 - Desktop Component 2: (no name) - file://localhost/D:/Documents%20and%20Settings/Jani/Työpöytä/countdown.html
    O24 - Desktop Component 3: sieni.us - Lyhyitä ja hauskoja flasheja, epileptikkojen paratiisi! - http://sieni.us/?id=6

    --
    End of file - 12143 bytes
     
    AkAntA, May 21, 2008
    #1
  2. Hujo

    Hujo Guest

    Lataa TÄSTÄ VundoFix.exe työpöydällesi.

    Tupla-klikkaa VundoFix.exe ajaaksesi sen.
    Klikkaa Scan for Vundo valintaa.
    Kun skannaus on valmis, klikkaa Fix Vundo valintaa.
    Sinulta kysytään haluatko poistaa filut - klikkaa YES.
    Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
    Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
    Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.

    Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
    Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.

    ==============

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.

    ===============

    Javan päivitys ja välimuistin tyhjennys:

    1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
    2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
    Niissä pitäisi olla seuraava kuva vieressä: [​IMG]

    3. Valitse kaikki entiset Java versiosi ja valitse Poista.
    4. Asenna uusin Java päivitys seuraavasta linkistä..
    5. Käynnistä kone uudelleen asennuksen jälkeen:

    http://java.sun.com/javase/downloads/index.jsp

    Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u6

    Paina Download

    Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.

    6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).

    7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.

    (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
    Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).

    8. Varmista että kaikki kaksi valintaa ovat rastitettuja:

    *Applications and Applets

    *Trace and Log Files

    Ja paina OK -nappia

    9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.

    10. Klikkaa OK jättääksesi Java asetusikkunasi.
     
    Last edited by a moderator: May 21, 2008
    Hujo, May 21, 2008
    #2
  3. AkAntA

    AkAntA Member

    Joined:
    Oct 15, 2007
    Messages:
    58
    Likes Received:
    0
    Trophy Points:
    16
    Vundosta ei logia.

    Malwarebytes' Anti-Malware log:

    Malwarebytes' Anti-Malware 1.12
    Tietokantaversio: 722

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|F:\|G:\|H:\|K:\|)
    Tarkistetut kohteet: 253529
    Kulunut aika: 2 hour(s), 28 minute(s), 43 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 19
    Saastuneita rekisteriarvoja: 1
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 4
    Saastuneita tiedostoja: 8

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    HKEY_CLASSES_ROOT\mywebsearch.htmlpanel (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.htmlpanel.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\asearchassist.adefaultsearch.1 (Adware.Accoona) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\abar.abarband.1 (Adware.Accoona) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\aldd (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Juan (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\CAC (Malware.Trace) -> Quarantined and deleted successfully.

    Saastuneita rekisteriarvoja:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{376719f4-5fb2-4b1d-9859-b3864a1648a9} (Trojan.Vundo) -> Quarantined and deleted successfully.

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    D:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    D:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    D:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    D:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Saastuneita tiedostoja:
    H:\Documents and Settings\Tomi\Local Settings\Temp\GLK16.tmp (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
    H:\Documents and Settings\Tomi\Local Settings\Temp\GLK1E.tmp (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
    H:\Documents and Settings\Tomi\Local Settings\Temp\GLKE.tmp (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
    D:\Program Files\MyWebSearch\bar\History\search2 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    D:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    D:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    D:\WINDOWS\SVCHOST.0XE (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
    D:\WINDOWS\system32\WINLOGON.EXE.$DIS (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
     
    AkAntA, May 22, 2008
    #3
  4. Hujo

    Hujo Guest

    Vundofix lokin pitäs löytyä tuolta
    C:\vundofix.txt

    ==============

    Poista lisää poista sovelutuksesta

    MyWebSearch <--- jos tuo sieltä löytyy

    Poista vikasiedossa kansio

    D:\Program Files\MyWebSearch

    ==============

    Uudelleen nimeäminen

    1. Klikkaa hiiren oikealla painikkeella HijackThis ikonia.

    [​IMG]
    2. Valitse Uudelleennineä/ Rename.
    [​IMG]
    3. Kirjoita scanner.exe
    [​IMG]

    =========

    scannaa uusi hjt:n loki
     
    Last edited by a moderator: May 22, 2008
    Hujo, May 22, 2008
    #4
  5. AkAntA

    AkAntA Member

    Joined:
    Oct 15, 2007
    Messages:
    58
    Likes Received:
    0
    Trophy Points:
    16
    Tuollaista kansiota ei löytynyt tuosta polusta.

    -------VundoFix Log---------
    VundoFix V6.5.10

    Checking Java version...

    Java version is 1.5.0.4
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.6
    Old versions of java are exploitable and should be removed.

    Scan started at 20:07:05 21.5.2008

    Listing files found while scanning....

    No infected files were found.


    ---------------HJT Log-----------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:15:19, on 22.5.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    D:\WINDOWS\System32\smss.exe
    D:\WINDOWS\system32\winlogon.exe
    D:\WINDOWS\system32\services.exe
    D:\WINDOWS\system32\lsass.exe
    D:\WINDOWS\system32\svchost.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\system32\spoolsv.exe
    D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    D:\WINDOWS\ATKKBService.exe
    D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
    D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
    D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
    D:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
    D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
    D:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
    D:\WINDOWS\system32\nvsvc32.exe
    D:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
    D:\WINDOWS\system32\svchost.exe
    D:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
    D:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
    D:\Program Files\Sonera Tietoturva\Anti-Virus\fsrw.exe
    D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
    D:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
    D:\WINDOWS\system32\WgaTray.exe
    D:\WINDOWS\Explorer.EXE
    D:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\htpatch.exe
    D:\WINDOWS\system32\RunDll32.exe
    D:\Program Files\TW-IA300C ADSL\CnxDslTb.exe
    D:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
    D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe
    D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    K:\Hewlett\Digital Imaging\Unload\hpqcmon.exe
    K:\Hewlett\HP Share-to-Web\hpgs2wnd.exe
    D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    D:\Program Files\QuickTime\QTTask.exe
    D:\WINDOWS\system32\ctfmon.exe
    D:\Program Files\MSN Messenger\MsnMsgr.Exe
    K:\Hewlett\HP Share-to-Web\hpgs2wnf.exe
    D:\PROGRA~1\SONERA~1\ANTI-S~1\fsaw.exe
    D:\WINDOWS\system32\wuauclt.exe
    D:\Program Files\redline\gameutil.exe
    D:\Program Files\Sonera Tietoturva\FSGUI\fsguidll.exe
    D:\Program Files\HotKey\HotKey.exe
    D:\Program Files\Logitech\SetPoint\SetPoint.exe
    D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
    K:\mIRC\mirc.exe
    D:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
    D:\Program Files\Mozilla Firefox\firefox.exe
    D:\WINDOWS\system32\msiexec.exe
    K:\jtn\fasdfadsfdas\scanner.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O4 - HKLM\..\Run: [HTpatch] D:\WINDOWS\htpatch.exe
    O4 - HKLM\..\Run: [SiSUSBRG] D:\WINDOWS\SiSUSBrg.exe
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [CnxDslTaskBar] "D:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [ScanRegistry] D:\W
    O4 - HKLM\..\Run: [F-Secure Manager] "D:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "D:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [News Service] "D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [RedLine Taskbar] D:\Program Files\RedLine\Taskbar.exe
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "D:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [CamMonitor] K:\Hewlett\Digital Imaging\\Unload\hpqcmon.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] K:\Hewlett\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [j2291439] rundll32 D:\WINDOWS\system32\j2291439.dll sook
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] K:\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Steam] "k:\valve\steam\steam.exe" -silent
    O4 - HKCU\..\Run: [ProBNC] "D:\Documents and Settings\Jani\Työpöytä\arkku\Arkku IP Updater\sysupdate.exe"
    O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [FTPUploader] F:\ftpuploader\FTPUploader.exe /s
    O4 - HKCU\..\Run: [Free Download Manager] F:\Free Download Manager\fdm.exe -autorun
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (User 'Default user')
    O4 - Startup: mIRC.lnk = K:\mIRC\mirc.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: DllCmd32.lnk = C:\jetsuite\DLLCMD32.EXE
    O4 - Global Startup: gameutil.exe.lnk = ?
    O4 - Global Startup: HotKey Driver.lnk = D:\Program Files\HotKey\HotKey.exe
    O4 - Global Startup: HP LaserJet 3100 Status.lnk = C:\jetsuite\JETSTAT.EXE
    O4 - Global Startup: Logitech SetPoint.lnk = D:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Sonera Tietoturva.lnk = D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
    O8 - Extra context menu item: &Estä tämä kohoikkuna - D:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - D:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - D:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
    O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab
    O16 - DPF: {861FDA2A-2B57-4BDA-8B8B-305C9D5D8604} (_Multimedia Player) - http://stream.pussyharem.com/stream/mmp2.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
    O20 - Winlogon Notify: abbaeeea - D:\WINDOWS\system32\abbaeeea.dll (file missing)
    O21 - SSODL: JxuZgsR - {31451BE6-9BEF-B14C-E3AC-AEAC623890C5} - D:\WINDOWS\System32\ddloa.dll (file missing)
    O23 - Service: Apple Mobile Device - Apple, Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - D:\WINDOWS\ATKKBService.exe
    O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
    O23 - Service: fsbwsys - F-Secure Corp. - D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Process Monitor (LVPrcSrv) - Unknown owner - d:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe (file missing)
    O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - D:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - K:\sissari\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe
    O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - K:\sissari\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe
    O23 - Service: ServiceLayer - Nokia. - D:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - D:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
    O24 - Desktop Component 0: (no name) - file:///D:/DOCUME~1/Jani/LOCALS~1/Temp/msohtml1/05/clip_image001.jpg
    O24 - Desktop Component 2: (no name) - file://localhost/D:/Documents%20and%20Settings/Jani/Työpöytä/countdown.html
    O24 - Desktop Component 3: sieni.us - Lyhyitä ja hauskoja flasheja, epileptikkojen paratiisi! - http://sieni.us/?id=6

    --
    End of file - 12166 bytes
     
    AkAntA, May 22, 2008
    #5
  6. Hujo

    Hujo Guest

    Poista tuo vanha vundofixsi ja lataa uusi tuolta ylempää
    punasesta txt

    =================

    scannaa hjt:llä paina Fix checked

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    O4 - HKLM\..\Run: [j2291439] rundll32 D:\WINDOWS\system32\j2291439.dll sook
    O20 - Winlogon Notify: abbaeeea - D:\WINDOWS\system32\abbaeeea.dll (file missing)
    O21 - SSODL: JxuZgsR - {31451BE6-9BEF-B14C-E3AC-AEAC623890C5} - D:\WINDOWS\System32\ddloa.dll (file missing)
    O24 - Desktop Component 0: (no name) - file:///D:/DOCUME~1/Jani/LOCALS~1/Temp/msohtml1/05/clip_image001.jpg
    O24 - Desktop Component 2: (no name) - file://localhost/D:/Documents%20and%20Settings/Jani/Työpöytä/countdown.html
    O24 - Desktop Component 3: sieni.us - Lyhyitä ja hauskoja flasheja, epileptikkojen paratiisi! - http://sieni.us/?id=6

    ================

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.


     
    Hujo, May 22, 2008
    #6
  7. AkAntA

    AkAntA Member

    Joined:
    Oct 15, 2007
    Messages:
    58
    Likes Received:
    0
    Trophy Points:
    16
    ----VundoFix Log------

    VundoFix V7.0.5

    Scan started at 16:51:08 26.5.2008

    Listing files found while scanning....

    No infected files were found.

    ------ComboFix Log--------

    ComboFix 08-05-25.4 - Jani 2008-05-26 16:30:48.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.490 [GMT 3:00]
    Running from: D:\Documents and Settings\Jani\Työpöytä\ComboFix.exe
    * Created a new restore point
    * Resident AV is active


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    D:\WINDOWS\system32\cqgyntgw.ini
    D:\WINDOWS\system32\gln.dll
    D:\WINDOWS\system32\iaqgafox.ini
    D:\WINDOWS\system32\kounchnu.ini
    D:\WINDOWS\system32\llnmp.bak1
    D:\WINDOWS\system32\llnmp.bak2
    D:\WINDOWS\system32\llnmp.ini
    D:\WINDOWS\system32\mcrh.tmp
    D:\WINDOWS\system32\MSINET.oca
    D:\WINDOWS\system32\pdbxtfaq.ini
    D:\WINDOWS\system32\rwnonkmg.ini
    D:\WINDOWS\system32\sogaxsiw.ini
    D:\WINDOWS\system32\uttss.bak1
    D:\WINDOWS\system32\uttss.bak2
    D:\WINDOWS\system32\uttss.ini
    D:\WINDOWS\system32\uttss.ini2
    D:\WINDOWS\system32\vdawftqc.ini
    D:\WINDOWS\system32\vphifdqe.ini

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_DOMAINSERVICE


    ((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-04-26 to 2008-05-26 )))))))))))))))))
    .

    2008-05-26 16:36 . 2008-05-26 16:36 505,856 --------- D:\WINDOWS\system32\WINLOGON.EXE.$DIS
    2008-05-21 20:24 . 2008-05-21 20:24 <KANSIO> d-------- D:\Documents and Settings\Jani\Application Data\Malwarebytes
    2008-05-21 20:24 . 2008-05-21 20:24 <KANSIO> d-------- D:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-05-21 20:24 . 2008-05-05 20:46 27,048 --a------ D:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-05-21 20:24 . 2008-05-05 20:46 15,864 --a------ D:\WINDOWS\system32\drivers\mbam.sys
    2008-05-21 20:07 . 2008-05-21 20:07 <KANSIO> d-------- D:\VundoFix Backups
    2008-05-21 18:53 . 2008-05-21 18:53 54,156 --ah----- D:\WINDOWS\QTFont.qfn
    2008-05-21 18:53 . 2008-05-21 18:53 1,409 --a------ D:\WINDOWS\QTFont.for
    2008-05-20 18:03 . 2008-05-20 18:03 127 --a------ D:\WINDOWS\system32\MRT.INI
    2008-04-28 15:05 . 2007-08-18 10:54 380,928 --a------ D:\WINDOWS\system32\ac3filter.acm

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-05-23 11:23 --------- d-----w D:\Documents and Settings\Jani\Application Data\uTorrent
    2008-05-22 16:13 --------- d-----w D:\Program Files\Common Files\Adobe
    2008-05-22 16:11 --------- d-----w D:\Documents and Settings\Jani\Application Data\AdobeUM
    2008-05-21 15:30 110,080 ------w D:\WINDOWS\system32\services.exe
    2008-05-20 19:08 58,368 ------w D:\WINDOWS\system32\spoolsv.exe
    2008-05-20 19:08 16,896 ------w D:\WINDOWS\system32\svchost.exe
    2008-05-20 15:46 14,336 ----a-w D:\WINDOWS\system32\lsass.exe
    2008-04-25 12:46 --------- d--h--w D:\Program Files\InstallShield Installation Information
    2008-04-23 07:47 --------- d-----w D:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
    2008-04-22 08:55 --------- d-----w D:\Documents and Settings\Jani\Application Data\Media Player Classic
    2008-04-22 06:34 --------- d-----w D:\Documents and Settings\Admin2\Application Data\ispnews
    2008-04-21 08:16 --------- d-----w D:\Documents and Settings\Admin2\Application Data\PC Suite
    2008-04-21 08:16 --------- d-----w D:\Documents and Settings\Admin2\Application Data\Logitech
    2008-04-20 10:33 --------- d-----w D:\Documents and Settings\Jani\Application Data\Nokia Multimedia Player
    2008-04-19 06:47 --------- d-----w D:\Program Files\Microsoft IntelliType Pro
    2008-04-18 18:08 --------- d-----w D:\Program Files\MSN Messenger
    2008-04-17 08:14 --------- d-----w D:\Documents and Settings\Jani\Application Data\Winamp
    2008-04-09 08:38 --------- d-----w D:\Program Files\Winamp
    2008-03-25 04:51 621,344 ----a-w D:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 ----a-w D:\WINDOWS\system32\msjint40.dll
    2008-03-20 08:09 1,845,504 ----a-w D:\WINDOWS\system32\win32k.sys
    2008-03-01 13:01 826,368 ----a-w D:\WINDOWS\system32\wininet.dll
    2007-06-14 11:01 263,220 -csha-w D:\WINDOWS\system32\pmnll.dll.vir
    .

    ------- Sigcheck -------

    2008-05-20 22:08 16896 8d2a8f002bddf7413d8ddd3cfe58932a D:\WINDOWS\system32\svchost.exe

    md5deep: D:\WINDOWS\system32\winlogon.exe: Permission denied

    2008-05-21 18:30 110080 145d8cf51eab341a676e551c04a1505e D:\WINDOWS\system32\services.exe

    2008-05-20 18:46 14336 3df6efbe297e056a2142fa89a46bbb0f D:\WINDOWS\system32\lsass.exe
    .
    (((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-09-14 19:12 15360]
    "Steam"="k:\valve\steam\steam.exe" [2008-03-28 16:45 1271032]
    "ProBNC"="D:\Documents and Settings\Jani\Työpöytä\arkku\Arkku IP Updater\sysupdate.exe" [ ]
    "msnmsgr"="D:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
    "FTPUploader"="F:\ftpuploader\FTPUploader.exe" [ ]
    "Free Download Manager"="F:\Free Download Manager\fdm.exe" [ ]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HTpatch"="D:\WINDOWS\htpatch.exe" [2002-10-30 12:40 28672]
    "SiSUSBRG"="D:\WINDOWS\SiSUSBrg.exe" [2002-07-12 19:15 106496]
    "Cmaudio"="cmicnfg.cpl" []
    "CnxDslTaskBar"="D:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe" [2003-05-12 14:24 454656]
    "NeroFilterCheck"="D:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50 155648]
    "F-Secure Manager"="D:\Program Files\Sonera Tietoturva\Common\FSM32.exe" [2005-05-09 10:05 118833]
    "F-Secure TNB"="D:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" [2005-06-02 16:05 700416]
    "News Service"="D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe" [2005-05-31 15:45 356352]
    "RedLine Taskbar"="D:\Program Files\RedLine\Taskbar.exe" [2003-02-09 19:56 22528]
    "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-12-10 12:45 49152 D:\WINDOWS\KHALMNPR.Exe]
    "ATIPTA"="D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
    "F-Secure Startup Wizard"="D:\Program Files\Sonera Tietoturva\FSGUI\FSSW.exe" [2005-11-18 15:57 372736]
    "NvCplDaemon"="D:\WINDOWS\system32\NvCpl.dll" [2007-09-17 02:07 8491008]
    "nwiz"="nwiz.exe" [2007-09-17 02:07 1626112 D:\WINDOWS\system32\nwiz.exe]
    "HP Software Update"="D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
    "CamMonitor"="K:\Hewlett\Digital Imaging\\Unload\hpqcmon.exe" [2002-10-07 00:23 90112]
    "Share-to-Web Namespace Daemon"="K:\Hewlett\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 10:42 69632]
    "SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
    "NvMediaCenter"="D:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 02:07 81920]
    "QuickTime Task"="D:\Program Files\QuickTime\QTTask.exe" [2007-12-11 11:56 286720]
    "iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [ ]
    "PCSuiteTrayApplication"="K:\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 13:20 227328]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-09-14 19:12 15360]
    "Nokia.PCSync"="K:\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 15:58 1744896]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
    D:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll 2005-01-31 15:13 49152 D:\PROGRA~1\COMMON~1\Stardock\MCPStub.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.ac3filter"= ac3filter.acm

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
    --a------ 2004-08-22 17:05 81920 K:\Daemon Tools\daemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    D:\Program Files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\itype]
    --a------ 2005-12-04 16:38 437008 D:\Program Files\Microsoft IntelliType Pro\itype.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
    --a------ 2007-03-23 13:20 227328 K:\Nokia\Nokia PC Suite 6\LaunchApplication.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
    --a------ 2006-09-25 18:50 20053544 D:\Program Files\Skype\Phone\Skype.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "usnjsvc"=3 (0x3)
    "SandraTheSrv"=3 (0x3)
    "SandraDataSrv"=3 (0x3)
    "MySql"=2 (0x2)
    "MDM"=2 (0x2)
    "jsdaemon"=2 (0x2)
    "iPodService"=3 (0x3)
    "FirebirdServerDefaultInstance"=3 (0x3)
    "FirebirdGuardianDefaultInstance"=2 (0x2)
    "CallerIP"=3 (0x3)
    "AFSEGTGF Windows Service"=2 (0x2)
    "Adobe LM Service"=3 (0x3)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "D:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
    "K:\\Skype\\Phone\\Skype.exe"=
    "K:\\Hamachi\\hamachi.exe"=
    "K:\\jtn\\utorrent.exe"=
    "D:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "D:\\Program Files\\MSN Messenger\\livecall.exe"=
    "K:\\WoW\\World of Warcraft\\BackgroundDownloader.exe"=
    "K:\\LimeWire\\LimeWire.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "D:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "D:\\Program Files\\Sonera Tietoturva\\backweb\\4436233\\Program\\fspex.exe"=
    "K:\\mIRC\\mirc.exe"=
    "K:\\Valve\\Steam\\SteamApps\\0_blingbling_0\\counter-strike\\hl.exe"=
    "F:\\HLSW\\hlsw.exe"=
    "D:\\Program Files\\Internet Explorer\\iexplore.exe"=
    "K:\\The All-Seeing Eye\\eye.exe"=
    "K:\\Valve\\steamapps\\kapu90\\counter-strike\\hl.exe"=
    "K:\\Valve\\Steam\\SteamApps\\weetbixx\\counter-strike\\hl.exe"=
    "F:\\DC++\\DCPlusPlus.exe"=
    "K:\\Valve\\steamapps\\weetbixx\\counter-strike\\hl.exe"=
    "K:\\sissari\\SiSoftware Sandra Lite XIIc\\Win32\\RpcDataSrv.exe"=
    "K:\\sissari\\SiSoftware Sandra Lite XIIc\\RpcSandraSrv.exe"=
    "K:\\Valve\\Steam\\SteamApps\\weetbixx\\counter-strike source\\hl2.exe"=
    "K:\\Valve\\Steam\\SteamApps\\samasungu\\counter-strike source\\hl2.exe"=
    "K:\\Valve\\Steam\\steam.exe"=
    "D:\\WINDOWS\\system32\\dpvsetup.exe"=
    "D:\\WINDOWS\\system32\\rtcshare.exe"=
    "D:\\Program Files\\Messenger\\msmsgs.exe"=
    "D:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "K:\\jtn\\P-660HW-D1_340AGL3C0_0100_Bridge.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP"= 3389:TCP:mad:xpsp2res.dll,-22009
    "3724:TCP"= 3724:TCP:Blizzard Downloader
    "612:TCP"= 612:TCP:Blizzard Downloader
    "6881:TCP"= 6881:TCP:Blizzard Downloader

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 1 (0x1)

    R0 FSFW;F-Secure Firewall Driver;D:\WINDOWS\system32\drivers\fsdfw.sys [2005-08-22 16:05]
    R1 bbcap;bbcap;D:\WINDOWS\system32\DRIVERS\bbcap.sys [2005-08-13 14:33]
    R1 js1284;js1284;D:\WINDOWS\system32\drivers\js1284.sys [1998-06-01 13:54]
    R1 jsmux;jsmux;D:\WINDOWS\system32\drivers\jsmux.sys [1998-06-01 13:54]
    R1 jsscan;jsscan;D:\WINDOWS\system32\drivers\jsscan.sys [1998-06-01 13:54]
    R2 BackWeb Plug-in - 4436233;Sonera Tietoturva;D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE [2006-02-23 12:11]
    R2 F-Secure Filter;F-Secure File System Filter;D:\Program Files\Sonera Tietoturva\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 18:14]
    R2 F-Secure Gatekeeper;F-Secure Gatekeeper;D:\Program Files\Sonera Tietoturva\Anti-Virus\Win2K\FSgk.sys [2008-03-17 14:28]
    R2 F-Secure Recognizer;F-Secure File System Recognizer;D:\Program Files\Sonera Tietoturva\Anti-Virus\Win2K\FSrec.sys [2004-12-17 12:34]
    R2 jsfax;jsfax;D:\WINDOWS\system32\drivers\jsfax.sys [1998-06-01 13:54]
    R2 jspclcap;jspclcap;D:\WINDOWS\system32\drivers\jspclcap.sys [1998-06-01 13:54]
    R3 CnxTgR;Conexant AccessRunner PCI ADSL Interface Device Driver;D:\WINDOWS\system32\DRIVERS\CnxTgR.sys [2003-05-12 13:54]
    S3 CnxTgN;Conexant AccessRunner PCI ADSL LAN Adapter Driver;D:\WINDOWS\system32\DRIVERS\CnxTgN.sys [2003-05-12 14:02]
    S3 CnxTgP;Conexant AccessRunner PCI ADSL LAN Adapter Filter Driver;D:\WINDOWS\system32\DRIVERS\CnxTgP.sys [2003-05-12 13:56]
    S3 PCASp50;PCASp50 NDIS Protocol Driver;D:\WINDOWS\system32\Drivers\PCASp50.sys []
    S3 Probe;Probe;D:\WINDOWS\system32\DRIVERS\probe.sys [2004-01-12 11:18]
    S3 teamviewervpn;TeamViewer VPN Adapter;D:\WINDOWS\system32\DRIVERS\teamviewervpn.sys [2008-01-25 12:12]
    S4 AFSEGTGF Windows Service;AFSEGTGF Windows Service;D:\WINDOWS\system32\dsuyd.exe []
    S4 CallerIP;Visualware CallerIP;F:\CallerIP\cip-nt.exe []
    S4 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;D:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe []
    S4 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;D:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe []
    S4 jsdbg;jsdbg;D:\WINDOWS\system32\drivers\jsdbg.sys [1998-06-01 13:54]

    .
    'Ajoitetut teht„v„t'-kansion sis„lt”
    "2008-04-23 19:32:01 D:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - D:\Program Files\Apple Software Update\SoftwareUpdate.exe
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-26 16:38:47
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MySql]
    "ImagePath"="K:/MySQL/bin/mysqld-nt.exe"

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\MySql]
    "ImagePath"="K:/MySQL/bin/mysqld-nt.exe"

    [HKEY_LOCAL_MACHINE\System\ControlSet003\Services\OMSCAN]
    "ImagePath"="\Sys"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    -> D:\WINDOWS\system32\winlogon.exe

    PROCESS: D:\WINDOWS\explorer.exe
    -> D:\Program Files\Logitech\SetPoint\GameHook.dll
    -> ?:\WINDOWS\system32\MLANG.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    D:\WINDOWS\ATKKBService.exe
    D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
    D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fsbwsys.exe
    D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32.exe
    D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
    D:\WINDOWS\system32\nvsvc32.exe
    D:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
    D:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
    D:\WINDOWS\system32\wdfmgr.exe
    D:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
    D:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
    D:\Program Files\Sonera Tietoturva\Anti-Virus\FSRW.exe
    D:\Program Files\Sonera Tietoturva\FWES\program\fsdfwd.exe
    D:\Program Files\Common Files\Stardock\SDMCP.exe
    D:\WINDOWS\system32\WgaTray.exe
    D:\Program Files\Sonera Tietoturva\Anti-Virus\FSAV32.exe
    D:\WINDOWS\system32\rundll32.exe
    D:\Program Files\TW-IA300C ADSL\CnxDslTb.exe
    D:\PROGRA~1\SONERA~1\ANTI-S~1\FSAW.exe
    K:\Hewlett\Digital Imaging\Unload\HpqCmon.exe
    D:\WINDOWS\system32\rundll32.exe
    K:\Hewlett\HP Share-to-Web\hpgs2wnf.exe
    D:\Program Files\Sonera Tietoturva\FSGUI\fsguidll.exe
    D:\Program Files\RedLine\GameUtil.exe
    D:\Program Files\HotKey\HotKey.exe
    D:\Program Files\Logitech\SetPoint\SetPoint.exe
    D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
    D:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
    .
    **************************************************************************
    .
    Completion time: 2008-05-26 16:48:20 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-05-26 13:47:52

    Pre-Run: 3,467,718,656 tavua vapaana
    Post-Run: 3,660,259,328 tavua vapaana

    268 --- E O F --- 2008-05-26 13:24:07
     
    AkAntA, May 26, 2008
    #7
  8. Hujo

    Hujo Guest

    ajas combofix uudelleen
     
    Hujo, May 26, 2008
    #8
  9. AkAntA

    AkAntA Member

    Joined:
    Oct 15, 2007
    Messages:
    58
    Likes Received:
    0
    Trophy Points:
    16
    Täs on tulos

    ComboFix 08-05-25.4 - Jani 2008-05-26 17:30:52.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.575 [GMT 3:00]
    Running from: D:\Documents and Settings\Jani\Työpöytä\ComboFix.exe
    * Resident AV is active


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-04-26 to 2008-05-26 )))))))))))))))))
    .

    2008-05-26 16:36 . 2008-05-26 16:36 505,856 --------- D:\WINDOWS\system32\WINLOGON.EXE.$DIS
    2008-05-21 20:24 . 2008-05-21 20:24 <KANSIO> d-------- D:\Documents and Settings\Jani\Application Data\Malwarebytes
    2008-05-21 20:24 . 2008-05-21 20:24 <KANSIO> d-------- D:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-05-21 20:24 . 2008-05-05 20:46 27,048 --a------ D:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-05-21 20:24 . 2008-05-05 20:46 15,864 --a------ D:\WINDOWS\system32\drivers\mbam.sys
    2008-05-21 20:07 . 2008-05-21 20:07 <KANSIO> d-------- D:\VundoFix Backups
    2008-05-21 18:53 . 2008-05-21 18:53 54,156 --ah----- D:\WINDOWS\QTFont.qfn
    2008-05-21 18:53 . 2008-05-21 18:53 1,409 --a------ D:\WINDOWS\QTFont.for
    2008-05-20 18:03 . 2008-05-20 18:03 127 --a------ D:\WINDOWS\system32\MRT.INI
    2008-04-28 15:05 . 2007-08-18 10:54 380,928 --a------ D:\WINDOWS\system32\ac3filter.acm

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-05-23 11:23 --------- d-----w D:\Documents and Settings\Jani\Application Data\uTorrent
    2008-05-22 16:13 --------- d-----w D:\Program Files\Common Files\Adobe
    2008-05-22 16:11 --------- d-----w D:\Documents and Settings\Jani\Application Data\AdobeUM
    2008-05-21 15:30 110,080 ------w D:\WINDOWS\system32\services.exe
    2008-05-20 19:08 58,368 ------w D:\WINDOWS\system32\spoolsv.exe
    2008-05-20 19:08 16,896 ------w D:\WINDOWS\system32\svchost.exe
    2008-05-20 15:46 14,336 ----a-w D:\WINDOWS\system32\lsass.exe
    2008-04-25 12:46 --------- d--h--w D:\Program Files\InstallShield Installation Information
    2008-04-23 07:47 --------- d-----w D:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
    2008-04-22 08:55 --------- d-----w D:\Documents and Settings\Jani\Application Data\Media Player Classic
    2008-04-22 06:34 --------- d-----w D:\Documents and Settings\Admin2\Application Data\ispnews
    2008-04-21 08:16 --------- d-----w D:\Documents and Settings\Admin2\Application Data\PC Suite
    2008-04-21 08:16 --------- d-----w D:\Documents and Settings\Admin2\Application Data\Logitech
    2008-04-20 10:33 --------- d-----w D:\Documents and Settings\Jani\Application Data\Nokia Multimedia Player
    2008-04-19 06:47 --------- d-----w D:\Program Files\Microsoft IntelliType Pro
    2008-04-18 18:08 --------- d-----w D:\Program Files\MSN Messenger
    2008-04-17 08:14 --------- d-----w D:\Documents and Settings\Jani\Application Data\Winamp
    2008-04-09 08:38 --------- d-----w D:\Program Files\Winamp
    2008-03-25 04:51 621,344 ----a-w D:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 ----a-w D:\WINDOWS\system32\msjint40.dll
    2008-03-20 08:09 1,845,504 ----a-w D:\WINDOWS\system32\win32k.sys
    2008-03-01 13:01 826,368 ----a-w D:\WINDOWS\system32\wininet.dll
    2007-06-14 11:01 263,220 -csha-w D:\WINDOWS\system32\pmnll.dll.vir
    .

    ------- Sigcheck -------

    2008-05-20 22:08 16896 8d2a8f002bddf7413d8ddd3cfe58932a D:\WINDOWS\system32\svchost.exe

    md5deep: D:\WINDOWS\system32\winlogon.exe: Permission denied

    2008-05-21 18:30 110080 145d8cf51eab341a676e551c04a1505e D:\WINDOWS\system32\services.exe

    2008-05-20 18:46 14336 3df6efbe297e056a2142fa89a46bbb0f D:\WINDOWS\system32\lsass.exe
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-09-14 19:12 15360]
    "Steam"="k:\valve\steam\steam.exe" [2008-03-28 16:45 1271032]
    "ProBNC"="D:\Documents and Settings\Jani\Työpöytä\arkku\Arkku IP Updater\sysupdate.exe" [ ]
    "msnmsgr"="D:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
    "FTPUploader"="F:\ftpuploader\FTPUploader.exe" [ ]
    "Free Download Manager"="F:\Free Download Manager\fdm.exe" [ ]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HTpatch"="D:\WINDOWS\htpatch.exe" [2002-10-30 12:40 28672]
    "SiSUSBRG"="D:\WINDOWS\SiSUSBrg.exe" [2002-07-12 19:15 106496]
    "Cmaudio"="cmicnfg.cpl" []
    "CnxDslTaskBar"="D:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe" [2003-05-12 14:24 454656]
    "NeroFilterCheck"="D:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50 155648]
    "F-Secure Manager"="D:\Program Files\Sonera Tietoturva\Common\FSM32.exe" [2005-05-09 10:05 118833]
    "F-Secure TNB"="D:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" [2005-06-02 16:05 700416]
    "News Service"="D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe" [2005-05-31 15:45 356352]
    "RedLine Taskbar"="D:\Program Files\RedLine\Taskbar.exe" [2003-02-09 19:56 22528]
    "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-12-10 12:45 49152 D:\WINDOWS\KHALMNPR.Exe]
    "ATIPTA"="D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
    "F-Secure Startup Wizard"="D:\Program Files\Sonera Tietoturva\FSGUI\FSSW.exe" [2005-11-18 15:57 372736]
    "NvCplDaemon"="D:\WINDOWS\system32\NvCpl.dll" [2007-09-17 02:07 8491008]
    "nwiz"="nwiz.exe" [2007-09-17 02:07 1626112 D:\WINDOWS\system32\nwiz.exe]
    "HP Software Update"="D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
    "CamMonitor"="K:\Hewlett\Digital Imaging\\Unload\hpqcmon.exe" [2002-10-07 00:23 90112]
    "Share-to-Web Namespace Daemon"="K:\Hewlett\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 10:42 69632]
    "SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
    "NvMediaCenter"="D:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 02:07 81920]
    "QuickTime Task"="D:\Program Files\QuickTime\QTTask.exe" [2007-12-11 11:56 286720]
    "iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [ ]
    "PCSuiteTrayApplication"="K:\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 13:20 227328]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-09-14 19:12 15360]
    "Nokia.PCSync"="K:\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 15:58 1744896]

    D:\Documents and Settings\Jani\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    mIRC.lnk - K:\mIRC\mirc.exe [2006-10-31 17:09:18 1949696]

    D:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Adobe Gamma Loader.lnk - D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-06-05 17:20:04 110592]
    Adobe Reader Speed Launch.lnk - D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
    DllCmd32.lnk - C:\jetsuite\DLLCMD32.EXE [2007-09-04 14:20:35 12035]
    gameutil.exe.lnk - D:\Program Files\redline\gameutil.exe [2003-07-10 17:04:14 26624]
    HotKey Driver.lnk - D:\Program Files\HotKey\HotKey.exe [2005-06-05 16:34:11 36864]
    HP LaserJet 3100 Status.lnk - C:\jetsuite\JETSTAT.EXE [2007-09-04 14:20:35 108291]
    Logitech SetPoint.lnk - D:\Program Files\Logitech\SetPoint\SetPoint.exe [2005-07-28 23:15:42 434176]
    Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 12:01:04 83360]
    Sonera Tietoturva.lnk - D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe [2005-07-07 20:53:57 32807]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
    D:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll 2005-01-31 15:13 49152 D:\PROGRA~1\COMMON~1\Stardock\MCPStub.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.ac3filter"= ac3filter.acm

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
    --a------ 2004-08-22 17:05 81920 K:\Daemon Tools\daemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    D:\Program Files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\itype]
    --a------ 2005-12-04 16:38 437008 D:\Program Files\Microsoft IntelliType Pro\itype.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
    --a------ 2007-03-23 13:20 227328 K:\Nokia\Nokia PC Suite 6\LaunchApplication.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
    --a------ 2006-09-25 18:50 20053544 D:\Program Files\Skype\Phone\Skype.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "usnjsvc"=3 (0x3)
    "SandraTheSrv"=3 (0x3)
    "SandraDataSrv"=3 (0x3)
    "MySql"=2 (0x2)
    "MDM"=2 (0x2)
    "jsdaemon"=2 (0x2)
    "iPodService"=3 (0x3)
    "FirebirdServerDefaultInstance"=3 (0x3)
    "FirebirdGuardianDefaultInstance"=2 (0x2)
    "CallerIP"=3 (0x3)
    "AFSEGTGF Windows Service"=2 (0x2)
    "Adobe LM Service"=3 (0x3)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "D:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
    "K:\\Skype\\Phone\\Skype.exe"=
    "K:\\Hamachi\\hamachi.exe"=
    "K:\\jtn\\utorrent.exe"=
    "D:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "D:\\Program Files\\MSN Messenger\\livecall.exe"=
    "K:\\WoW\\World of Warcraft\\BackgroundDownloader.exe"=
    "K:\\LimeWire\\LimeWire.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "D:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "D:\\Program Files\\Sonera Tietoturva\\backweb\\4436233\\Program\\fspex.exe"=
    "K:\\mIRC\\mirc.exe"=
    "K:\\Valve\\Steam\\SteamApps\\0_blingbling_0\\counter-strike\\hl.exe"=
    "F:\\HLSW\\hlsw.exe"=
    "D:\\Program Files\\Internet Explorer\\iexplore.exe"=
    "K:\\The All-Seeing Eye\\eye.exe"=
    "K:\\Valve\\steamapps\\kapu90\\counter-strike\\hl.exe"=
    "K:\\Valve\\Steam\\SteamApps\\weetbixx\\counter-strike\\hl.exe"=
    "F:\\DC++\\DCPlusPlus.exe"=
    "K:\\Valve\\steamapps\\weetbixx\\counter-strike\\hl.exe"=
    "K:\\sissari\\SiSoftware Sandra Lite XIIc\\Win32\\RpcDataSrv.exe"=
    "K:\\sissari\\SiSoftware Sandra Lite XIIc\\RpcSandraSrv.exe"=
    "K:\\Valve\\Steam\\SteamApps\\weetbixx\\counter-strike source\\hl2.exe"=
    "K:\\Valve\\Steam\\SteamApps\\samasungu\\counter-strike source\\hl2.exe"=
    "K:\\Valve\\Steam\\steam.exe"=
    "D:\\WINDOWS\\system32\\dpvsetup.exe"=
    "D:\\WINDOWS\\system32\\rtcshare.exe"=
    "D:\\Program Files\\Messenger\\msmsgs.exe"=
    "D:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "K:\\jtn\\P-660HW-D1_340AGL3C0_0100_Bridge.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP"= 3389:TCP:mad:xpsp2res.dll,-22009
    "3724:TCP"= 3724:TCP:Blizzard Downloader
    "612:TCP"= 612:TCP:Blizzard Downloader
    "6881:TCP"= 6881:TCP:Blizzard Downloader

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 1 (0x1)

    R0 FSFW;F-Secure Firewall Driver;D:\WINDOWS\system32\drivers\fsdfw.sys [2005-08-22 16:05]
    R1 bbcap;bbcap;D:\WINDOWS\system32\DRIVERS\bbcap.sys [2005-08-13 14:33]
    R1 js1284;js1284;D:\WINDOWS\system32\drivers\js1284.sys [1998-06-01 13:54]
    R1 jsmux;jsmux;D:\WINDOWS\system32\drivers\jsmux.sys [1998-06-01 13:54]
    R1 jsscan;jsscan;D:\WINDOWS\system32\drivers\jsscan.sys [1998-06-01 13:54]
    R2 BackWeb Plug-in - 4436233;Sonera Tietoturva;D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE [2006-02-23 12:11]
    R2 F-Secure Filter;F-Secure File System Filter;D:\Program Files\Sonera Tietoturva\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 18:14]
    R2 F-Secure Gatekeeper;F-Secure Gatekeeper;D:\Program Files\Sonera Tietoturva\Anti-Virus\Win2K\FSgk.sys [2008-03-17 14:28]
    R2 F-Secure Recognizer;F-Secure File System Recognizer;D:\Program Files\Sonera Tietoturva\Anti-Virus\Win2K\FSrec.sys [2004-12-17 12:34]
    R2 jsfax;jsfax;D:\WINDOWS\system32\drivers\jsfax.sys [1998-06-01 13:54]
    R2 jspclcap;jspclcap;D:\WINDOWS\system32\drivers\jspclcap.sys [1998-06-01 13:54]
    R3 CnxTgR;Conexant AccessRunner PCI ADSL Interface Device Driver;D:\WINDOWS\system32\DRIVERS\CnxTgR.sys [2003-05-12 13:54]
    S3 CnxTgN;Conexant AccessRunner PCI ADSL LAN Adapter Driver;D:\WINDOWS\system32\DRIVERS\CnxTgN.sys [2003-05-12 14:02]
    S3 CnxTgP;Conexant AccessRunner PCI ADSL LAN Adapter Filter Driver;D:\WINDOWS\system32\DRIVERS\CnxTgP.sys [2003-05-12 13:56]
    S3 PCASp50;PCASp50 NDIS Protocol Driver;D:\WINDOWS\system32\Drivers\PCASp50.sys []
    S3 Probe;Probe;D:\WINDOWS\system32\DRIVERS\probe.sys [2004-01-12 11:18]
    S3 teamviewervpn;TeamViewer VPN Adapter;D:\WINDOWS\system32\DRIVERS\teamviewervpn.sys [2008-01-25 12:12]
    S4 AFSEGTGF Windows Service;AFSEGTGF Windows Service;D:\WINDOWS\system32\dsuyd.exe []
    S4 CallerIP;Visualware CallerIP;F:\CallerIP\cip-nt.exe []
    S4 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;D:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe []
    S4 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;D:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe []
    S4 jsdbg;jsdbg;D:\WINDOWS\system32\drivers\jsdbg.sys [1998-06-01 13:54]

    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-04-23 19:32:01 D:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - D:\Program Files\Apple Software Update\SoftwareUpdate.exe
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-26 17:34:00
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MySql]
    "ImagePath"="K:/MySQL/bin/mysqld-nt.exe"

    [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MySql]
    "ImagePath"="K:/MySQL/bin/mysqld-nt.exe"

    [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\OMSCAN]
    "ImagePath"="\Sys"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    -> D:\WINDOWS\system32\winlogon.exe

    PROCESS: D:\WINDOWS\explorer.exe
    -> D:\Program Files\Logitech\SetPoint\GameHook.dll
    .
    Completion time: 2008-05-26 17:36:58
    ComboFix-quarantined-files.txt 2008-05-26 14:35:48
    ComboFix2.txt 2008-05-26 13:48:22

    Pre-Run: 3,669,950,464 tavua vapaana
    Post-Run: 3,676,381,184 tavua vapaana

    219 --- E O F --- 2008-05-26 13:24:07
     
    AkAntA, May 26, 2008
    #9
  10. Hujo

    Hujo Guest

    Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

    Tallenna se nimellä CFScript.txt

    Sitten raahaa CFScript ComboFix.exeen kuten alla.
    [​IMG]

    Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
     
    Hujo, May 26, 2008
    #10
  11. AkAntA

    AkAntA Member

    Joined:
    Oct 15, 2007
    Messages:
    58
    Likes Received:
    0
    Trophy Points:
    16
    ComboFix 08-05-25.4 - Jani 2008-05-26 18:19:54.3 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.515 [GMT 3:00]
    Running from: D:\Documents and Settings\Jani\Työpöytä\ComboFix.exe
    Command switches used :: D:\Documents and Settings\Jani\Työpöytä\CFScript.txt
    * Created a new restore point
    * Resident AV is active


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    D:\WINDOWS\system32\pmnll.dll.vir
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    D:\WINDOWS\system32\pmnll.dll.vir

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-04-26 to 2008-05-26 )))))))))))))))))
    .

    2008-05-26 18:06 . 2007-10-24 01:47 282,112 --a------ D:\WINDOWS\system32\TBD1BB2.tmp
    2008-05-26 16:36 . 2008-05-26 16:36 505,856 --------- D:\WINDOWS\system32\WINLOGON.EXE.$DIS
    2008-05-21 20:24 . 2008-05-21 20:24 <KANSIO> d-------- D:\Documents and Settings\Jani\Application Data\Malwarebytes
    2008-05-21 20:24 . 2008-05-21 20:24 <KANSIO> d-------- D:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-05-21 20:24 . 2008-05-05 20:46 27,048 --a------ D:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-05-21 20:24 . 2008-05-05 20:46 15,864 --a------ D:\WINDOWS\system32\drivers\mbam.sys
    2008-05-21 20:07 . 2008-05-21 20:07 <KANSIO> d-------- D:\VundoFix Backups
    2008-05-21 18:53 . 2008-05-26 18:13 54,156 --ah----- D:\WINDOWS\QTFont.qfn
    2008-05-21 18:53 . 2008-05-21 18:53 1,409 --a------ D:\WINDOWS\QTFont.for
    2008-05-20 18:03 . 2008-05-20 18:03 127 --a------ D:\WINDOWS\system32\MRT.INI
    2008-04-28 15:05 . 2007-08-18 10:54 380,928 --a------ D:\WINDOWS\system32\ac3filter.acm

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-05-26 15:02 --------- d-----w D:\Documents and Settings\Jani\Application Data\uTorrent
    2008-05-22 16:13 --------- d-----w D:\Program Files\Common Files\Adobe
    2008-05-22 16:11 --------- d-----w D:\Documents and Settings\Jani\Application Data\AdobeUM
    2008-05-21 15:30 110,080 ------w D:\WINDOWS\system32\services.exe
    2008-05-20 19:08 58,368 ------w D:\WINDOWS\system32\spoolsv.exe
    2008-05-20 19:08 16,896 ------w D:\WINDOWS\system32\svchost.exe
    2008-05-20 15:46 14,336 ----a-w D:\WINDOWS\system32\lsass.exe
    2008-04-25 12:46 --------- d--h--w D:\Program Files\InstallShield Installation Information
    2008-04-23 07:47 --------- d-----w D:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
    2008-04-22 08:55 --------- d-----w D:\Documents and Settings\Jani\Application Data\Media Player Classic
    2008-04-22 06:34 --------- d-----w D:\Documents and Settings\Admin2\Application Data\ispnews
    2008-04-21 08:16 --------- d-----w D:\Documents and Settings\Admin2\Application Data\PC Suite
    2008-04-21 08:16 --------- d-----w D:\Documents and Settings\Admin2\Application Data\Logitech
    2008-04-20 10:33 --------- d-----w D:\Documents and Settings\Jani\Application Data\Nokia Multimedia Player
    2008-04-19 06:47 --------- d-----w D:\Program Files\Microsoft IntelliType Pro
    2008-04-18 18:08 --------- d-----w D:\Program Files\MSN Messenger
    2008-04-17 08:14 --------- d-----w D:\Documents and Settings\Jani\Application Data\Winamp
    2008-04-09 08:38 --------- d-----w D:\Program Files\Winamp
    2008-03-25 04:51 621,344 ----a-w D:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 ----a-w D:\WINDOWS\system32\msjint40.dll
    2008-03-20 08:09 1,845,504 ----a-w D:\WINDOWS\system32\win32k.sys
    2008-03-01 13:01 826,368 ----a-w D:\WINDOWS\system32\wininet.dll
    .

    ------- Sigcheck -------

    2008-05-20 22:08 16896 8d2a8f002bddf7413d8ddd3cfe58932a D:\WINDOWS\system32\svchost.exe

    md5deep: D:\WINDOWS\system32\winlogon.exe: Permission denied

    2008-05-21 18:30 110080 145d8cf51eab341a676e551c04a1505e D:\WINDOWS\system32\services.exe

    2008-05-20 18:46 14336 3df6efbe297e056a2142fa89a46bbb0f D:\WINDOWS\system32\lsass.exe
    .
    ((((((((((((((((((((((((((((( snapshot@2008-05-26_16.47.25.15 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-05-26 13:20:34 69,120 ----a-w D:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
    + 2008-05-26 15:04:26 69,120 ----a-w D:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll
    - 2008-05-26 13:20:41 72,192 ----a-w D:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
    + 2008-05-26 15:04:33 72,192 ----a-w D:\WINDOWS\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll
    - 2008-05-26 13:20:21 4,444,160 ----a-w D:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
    + 2008-05-26 15:04:11 4,444,160 ----a-w D:\WINDOWS\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll
    - 2008-05-26 13:20:43 483,840 ----a-w D:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
    + 2008-05-26 15:04:36 483,840 ----a-w D:\WINDOWS\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll
    - 2008-05-26 13:20:27 3,036,160 ----a-w D:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
    + 2008-05-26 15:04:18 3,036,160 ----a-w D:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
    - 2008-05-26 13:20:47 258,048 ----a-w D:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
    + 2008-05-26 15:04:39 258,048 ----a-w D:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
    - 2008-05-26 13:20:47 113,664 ----a-w D:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
    + 2008-05-26 15:04:39 113,664 ----a-w D:\WINDOWS\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll
    - 2008-05-26 13:20:41 261,120 ----a-w D:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
    + 2008-05-26 15:04:34 261,120 ----a-w D:\WINDOWS\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
    - 2008-05-26 13:20:25 5,431,296 ----a-w D:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
    + 2008-05-26 15:04:16 5,431,296 ----a-w D:\WINDOWS\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll
    - 2008-05-26 13:20:32 10,752 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
    + 2008-05-26 15:04:23 10,752 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll
    - 2008-05-26 13:20:26 507,904 ----a-w D:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
    + 2008-05-26 15:04:17 507,904 ----a-w D:\WINDOWS\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll
    - 2008-05-26 13:20:34 13,312 ----a-w D:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
    + 2008-05-26 15:04:25 13,312 ----a-w D:\WINDOWS\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll
    - 2008-05-26 13:20:37 8,192 ----a-w D:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
    + 2008-05-26 15:04:29 8,192 ----a-w D:\WINDOWS\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll
    - 2008-05-26 13:20:38 77,824 ----a-w D:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
    + 2008-05-26 15:04:30 77,824 ----a-w D:\WINDOWS\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll
    - 2008-05-26 13:20:39 6,656 ----a-w D:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
    + 2008-05-26 15:04:31 6,656 ----a-w D:\WINDOWS\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll
    - 2008-05-26 13:20:47 348,160 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
    + 2008-05-26 15:04:40 348,160 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll
    - 2008-05-26 13:20:48 36,864 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
    + 2008-05-26 15:04:41 36,864 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll
    - 2008-05-26 13:20:49 655,360 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
    + 2008-05-26 15:04:43 655,360 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll
    - 2008-05-26 13:20:49 77,824 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
    + 2008-05-26 15:04:44 77,824 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll
    - 2008-05-26 13:20:39 749,568 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
    + 2008-05-26 15:04:31 749,568 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
    - 2008-05-26 13:20:38 110,592 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
    + 2008-05-26 15:04:30 110,592 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll
    - 2008-05-26 13:20:37 372,736 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
    + 2008-05-26 15:04:28 372,736 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll
    - 2008-05-26 13:20:43 28,672 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
    + 2008-05-26 15:04:36 28,672 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
    - 2008-05-26 13:20:36 671,744 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
    + 2008-05-26 15:04:27 671,744 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
    - 2008-05-26 13:20:23 5,632 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
    + 2008-05-26 15:04:13 5,632 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll
    - 2008-05-26 13:20:45 12,800 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
    + 2008-05-26 15:04:38 12,800 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
    - 2008-05-26 13:20:35 32,768 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
    + 2008-05-26 15:04:27 32,768 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
    - 2008-05-26 13:20:35 7,168 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
    + 2008-05-26 15:04:26 7,168 ----a-w D:\WINDOWS\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
    - 2008-05-26 13:20:40 110,592 ----a-w D:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
    + 2008-05-26 15:04:32 110,592 ----a-w D:\WINDOWS\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll
    - 2008-05-26 13:20:40 81,920 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
    + 2008-05-26 15:04:33 81,920 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
    - 2008-05-26 13:20:27 425,984 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
    + 2008-05-26 15:04:17 425,984 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll
    - 2008-05-26 13:20:28 741,376 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
    + 2008-05-26 15:04:19 741,376 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll
    - 2008-05-26 13:20:29 933,888 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
    + 2008-05-26 15:04:20 933,888 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll
    - 2008-05-26 13:20:50 5,070,848 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
    + 2008-05-26 15:04:45 5,070,848 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll
    - 2008-05-26 13:20:48 188,416 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
    + 2008-05-26 15:04:43 188,416 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll
    - 2008-05-26 13:20:33 401,408 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
    + 2008-05-26 15:04:24 401,408 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
    - 2008-05-26 13:20:44 81,920 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
    + 2008-05-26 15:04:37 81,920 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
    - 2008-05-26 13:20:23 630,784 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
    + 2008-05-26 15:04:13 630,784 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll
    - 2008-05-26 13:20:46 372,736 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
    + 2008-05-26 15:04:39 372,736 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll
    - 2008-05-26 13:20:44 258,048 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
    + 2008-05-26 15:04:37 258,048 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll
    - 2008-05-26 13:20:42 299,008 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
    + 2008-05-26 15:04:35 299,008 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll
    - 2008-05-26 13:20:41 131,072 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
    + 2008-05-26 15:04:34 131,072 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
    - 2008-05-26 13:20:24 258,048 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
    + 2008-05-26 15:04:14 258,048 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll
    - 2008-05-26 13:20:24 114,688 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
    + 2008-05-26 15:04:14 114,688 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
    - 2008-05-26 13:20:31 884,736 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
    + 2008-05-26 15:04:22 884,736 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll
    - 2008-05-26 13:20:32 90,112 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
    + 2008-05-26 15:04:23 90,112 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
    - 2008-05-26 13:20:30 839,680 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
    + 2008-05-26 15:04:21 839,680 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll
    - 2008-05-26 13:20:33 5,013,504 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
    + 2008-05-26 15:04:25 5,013,504 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll
    - 2008-05-26 13:20:25 2,068,480 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
    + 2008-05-26 15:04:15 2,068,480 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll
    - 2008-05-26 13:20:30 3,076,096 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
    + 2008-05-26 15:04:20 3,076,096 ----a-w D:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll
    - 2008-05-26 13:20:57 83,664 ----a-w D:\WINDOWS\system32\perfc009.dat
    + 2008-05-26 15:04:53 83,664 ----a-w D:\WINDOWS\system32\perfc009.dat
    - 2008-05-26 13:20:57 100,444 ----a-w D:\WINDOWS\system32\perfc00B.dat
    + 2008-05-26 15:04:53 100,444 ----a-w D:\WINDOWS\system32\perfc00B.dat
    - 2008-05-26 13:20:57 454,734 ----a-w D:\WINDOWS\system32\perfh009.dat
    + 2008-05-26 15:04:53 454,734 ----a-w D:\WINDOWS\system32\perfh009.dat
    - 2008-05-26 13:20:57 431,130 ----a-w D:\WINDOWS\system32\perfh00B.dat
    + 2008-05-26 15:04:53 431,130 ----a-w D:\WINDOWS\system32\perfh00B.dat
    - 2008-05-26 13:20:37 8,192 ----a-w D:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
    + 2008-05-26 15:04:29 8,192 ----a-w D:\WINDOWS\WinSxS\MSIL_IEExecRemote_b03f5f7f11d50a3a_2.0.0.0_x-ww_6e57c34e\IEExecRemote.dll
    - 2008-05-26 13:20:47 258,048 ----a-w D:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
    + 2008-05-26 15:04:39 258,048 ----a-w D:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll
    - 2008-05-26 13:20:47 113,664 ----a-w D:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
    + 2008-05-26 15:04:39 113,664 ----a-w D:\WINDOWS\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll
    .
    -- Snapshot reset to current date --
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-09-14 19:12 15360]
    "Steam"="k:\valve\steam\steam.exe" [2008-03-28 16:45 1271032]
    "ProBNC"="D:\Documents and Settings\Jani\Työpöytä\arkku\Arkku IP Updater\sysupdate.exe" [ ]
    "msnmsgr"="D:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
    "FTPUploader"="F:\ftpuploader\FTPUploader.exe" [ ]
    "Free Download Manager"="F:\Free Download Manager\fdm.exe" [ ]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HTpatch"="D:\WINDOWS\htpatch.exe" [2002-10-30 12:40 28672]
    "SiSUSBRG"="D:\WINDOWS\SiSUSBrg.exe" [2002-07-12 19:15 106496]
    "Cmaudio"="cmicnfg.cpl" []
    "CnxDslTaskBar"="D:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe" [2003-05-12 14:24 454656]
    "NeroFilterCheck"="D:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50 155648]
    "F-Secure Manager"="D:\Program Files\Sonera Tietoturva\Common\FSM32.exe" [2005-05-09 10:05 118833]
    "F-Secure TNB"="D:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" [2005-06-02 16:05 700416]
    "News Service"="D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe" [2005-05-31 15:45 356352]
    "RedLine Taskbar"="D:\Program Files\RedLine\Taskbar.exe" [2003-02-09 19:56 22528]
    "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-12-10 12:45 49152 D:\WINDOWS\KHALMNPR.Exe]
    "ATIPTA"="D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
    "F-Secure Startup Wizard"="D:\Program Files\Sonera Tietoturva\FSGUI\FSSW.exe" [2005-11-18 15:57 372736]
    "NvCplDaemon"="D:\WINDOWS\system32\NvCpl.dll" [2007-09-17 02:07 8491008]
    "nwiz"="nwiz.exe" [2007-09-17 02:07 1626112 D:\WINDOWS\system32\nwiz.exe]
    "HP Software Update"="D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
    "CamMonitor"="K:\Hewlett\Digital Imaging\\Unload\hpqcmon.exe" [2002-10-07 00:23 90112]
    "Share-to-Web Namespace Daemon"="K:\Hewlett\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 10:42 69632]
    "SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
    "NvMediaCenter"="D:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 02:07 81920]
    "QuickTime Task"="D:\Program Files\QuickTime\QTTask.exe" [2007-12-11 11:56 286720]
    "iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [ ]
    "PCSuiteTrayApplication"="K:\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 13:20 227328]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-09-14 19:12 15360]
    "Nokia.PCSync"="K:\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 15:58 1744896]

    D:\Documents and Settings\Jani\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    mIRC.lnk - K:\mIRC\mirc.exe [2006-10-31 17:09:18 1949696]

    D:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Adobe Gamma Loader.lnk - D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-06-05 17:20:04 110592]
    Adobe Reader Speed Launch.lnk - D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
    DllCmd32.lnk - C:\jetsuite\DLLCMD32.EXE [2007-09-04 14:20:35 12035]
    gameutil.exe.lnk - D:\Program Files\redline\gameutil.exe [2003-07-10 17:04:14 26624]
    HotKey Driver.lnk - D:\Program Files\HotKey\HotKey.exe [2005-06-05 16:34:11 36864]
    HP LaserJet 3100 Status.lnk - C:\jetsuite\JETSTAT.EXE [2007-09-04 14:20:35 108291]
    Logitech SetPoint.lnk - D:\Program Files\Logitech\SetPoint\SetPoint.exe [2005-07-28 23:15:42 434176]
    Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 12:01:04 83360]
    Sonera Tietoturva.lnk - D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe [2005-07-07 20:53:57 32807]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
    D:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll 2005-01-31 15:13 49152 D:\PROGRA~1\COMMON~1\Stardock\MCPStub.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.ac3filter"= ac3filter.acm

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
    --a------ 2004-08-22 17:05 81920 K:\Daemon Tools\daemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    D:\Program Files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\itype]
    --a------ 2005-12-04 16:38 437008 D:\Program Files\Microsoft IntelliType Pro\itype.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
    --a------ 2007-03-23 13:20 227328 K:\Nokia\Nokia PC Suite 6\LaunchApplication.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
    --a------ 2006-09-25 18:50 20053544 D:\Program Files\Skype\Phone\Skype.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "usnjsvc"=3 (0x3)
    "SandraTheSrv"=3 (0x3)
    "SandraDataSrv"=3 (0x3)
    "MySql"=2 (0x2)
    "MDM"=2 (0x2)
    "jsdaemon"=2 (0x2)
    "iPodService"=3 (0x3)
    "FirebirdServerDefaultInstance"=3 (0x3)
    "FirebirdGuardianDefaultInstance"=2 (0x2)
    "CallerIP"=3 (0x3)
    "AFSEGTGF Windows Service"=2 (0x2)
    "Adobe LM Service"=3 (0x3)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "D:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
    "K:\\Skype\\Phone\\Skype.exe"=
    "K:\\Hamachi\\hamachi.exe"=
    "K:\\jtn\\utorrent.exe"=
    "D:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "D:\\Program Files\\MSN Messenger\\livecall.exe"=
    "K:\\WoW\\World of Warcraft\\BackgroundDownloader.exe"=
    "K:\\LimeWire\\LimeWire.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "D:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "D:\\Program Files\\Sonera Tietoturva\\backweb\\4436233\\Program\\fspex.exe"=
    "K:\\mIRC\\mirc.exe"=
    "K:\\Valve\\Steam\\SteamApps\\0_blingbling_0\\counter-strike\\hl.exe"=
    "F:\\HLSW\\hlsw.exe"=
    "D:\\Program Files\\Internet Explorer\\iexplore.exe"=
    "K:\\The All-Seeing Eye\\eye.exe"=
    "K:\\Valve\\steamapps\\kapu90\\counter-strike\\hl.exe"=
    "K:\\Valve\\Steam\\SteamApps\\weetbixx\\counter-strike\\hl.exe"=
    "F:\\DC++\\DCPlusPlus.exe"=
    "K:\\Valve\\steamapps\\weetbixx\\counter-strike\\hl.exe"=
    "K:\\sissari\\SiSoftware Sandra Lite XIIc\\Win32\\RpcDataSrv.exe"=
    "K:\\sissari\\SiSoftware Sandra Lite XIIc\\RpcSandraSrv.exe"=
    "K:\\Valve\\Steam\\SteamApps\\weetbixx\\counter-strike source\\hl2.exe"=
    "K:\\Valve\\Steam\\SteamApps\\samasungu\\counter-strike source\\hl2.exe"=
    "K:\\Valve\\Steam\\steam.exe"=
    "D:\\WINDOWS\\system32\\dpvsetup.exe"=
    "D:\\WINDOWS\\system32\\rtcshare.exe"=
    "D:\\Program Files\\Messenger\\msmsgs.exe"=
    "D:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "K:\\jtn\\P-660HW-D1_340AGL3C0_0100_Bridge.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP"= 3389:TCP:mad:xpsp2res.dll,-22009
    "3724:TCP"= 3724:TCP:Blizzard Downloader
    "612:TCP"= 612:TCP:Blizzard Downloader
    "6881:TCP"= 6881:TCP:Blizzard Downloader

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 1 (0x1)

    R0 FSFW;F-Secure Firewall Driver;D:\WINDOWS\system32\drivers\fsdfw.sys [2005-08-22 16:05]
    R1 bbcap;bbcap;D:\WINDOWS\system32\DRIVERS\bbcap.sys [2005-08-13 14:33]
    R1 js1284;js1284;D:\WINDOWS\system32\drivers\js1284.sys [1998-06-01 13:54]
    R1 jsmux;jsmux;D:\WINDOWS\system32\drivers\jsmux.sys [1998-06-01 13:54]
    R1 jsscan;jsscan;D:\WINDOWS\system32\drivers\jsscan.sys [1998-06-01 13:54]
    R2 BackWeb Plug-in - 4436233;Sonera Tietoturva;D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE [2006-02-23 12:11]
    R2 F-Secure Filter;F-Secure File System Filter;D:\Program Files\Sonera Tietoturva\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 18:14]
    R2 F-Secure Gatekeeper;F-Secure Gatekeeper;D:\Program Files\Sonera Tietoturva\Anti-Virus\Win2K\FSgk.sys [2008-03-17 14:28]
    R2 F-Secure Recognizer;F-Secure File System Recognizer;D:\Program Files\Sonera Tietoturva\Anti-Virus\Win2K\FSrec.sys [2004-12-17 12:34]
    R2 jsfax;jsfax;D:\WINDOWS\system32\drivers\jsfax.sys [1998-06-01 13:54]
    R2 jspclcap;jspclcap;D:\WINDOWS\system32\drivers\jspclcap.sys [1998-06-01 13:54]
    R3 CnxTgR;Conexant AccessRunner PCI ADSL Interface Device Driver;D:\WINDOWS\system32\DRIVERS\CnxTgR.sys [2003-05-12 13:54]
    S3 CnxTgN;Conexant AccessRunner PCI ADSL LAN Adapter Driver;D:\WINDOWS\system32\DRIVERS\CnxTgN.sys [2003-05-12 14:02]
    S3 CnxTgP;Conexant AccessRunner PCI ADSL LAN Adapter Filter Driver;D:\WINDOWS\system32\DRIVERS\CnxTgP.sys [2003-05-12 13:56]
    S3 PCASp50;PCASp50 NDIS Protocol Driver;D:\WINDOWS\system32\Drivers\PCASp50.sys []
    S3 Probe;Probe;D:\WINDOWS\system32\DRIVERS\probe.sys [2004-01-12 11:18]
    S3 teamviewervpn;TeamViewer VPN Adapter;D:\WINDOWS\system32\DRIVERS\teamviewervpn.sys [2008-01-25 12:12]
    S4 AFSEGTGF Windows Service;AFSEGTGF Windows Service;D:\WINDOWS\system32\dsuyd.exe []
    S4 CallerIP;Visualware CallerIP;F:\CallerIP\cip-nt.exe []
    S4 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;D:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe []
    S4 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;D:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe []
    S4 jsdbg;jsdbg;D:\WINDOWS\system32\drivers\jsdbg.sys [1998-06-01 13:54]

    .
    'Ajoitetut tehtävät'-kansion sisältö
    "2008-04-23 19:32:01 D:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - D:\Program Files\Apple Software Update\SoftwareUpdate.exe
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-26 18:22:09
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MySql]
    "ImagePath"="K:/MySQL/bin/mysqld-nt.exe"

    [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\MySql]
    "ImagePath"="K:/MySQL/bin/mysqld-nt.exe"

    [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\OMSCAN]
    "ImagePath"="\Sys"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    -> D:\WINDOWS\system32\winlogon.exe
    .
    Completion time: 2008-05-26 18:25:36
    ComboFix-quarantined-files.txt 2008-05-26 15:24:27
    ComboFix2.txt 2008-05-26 14:37:01
    ComboFix3.txt 2008-05-26 13:48:22

    Pre-Run: 3,463,684,096 tavua vapaana
    Post-Run: 3,502,915,584 tavua vapaana

    345 --- E O F --- 2008-05-26 15:09:09
     
    AkAntA, May 26, 2008
    #11
  12. Hujo

    Hujo Guest

    scannaa uusi hjt:n loki
     
    Hujo, May 26, 2008
    #12
  13. AkAntA

    AkAntA Member

    Joined:
    Oct 15, 2007
    Messages:
    58
    Likes Received:
    0
    Trophy Points:
    16
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:35:08, on 26.5.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    D:\WINDOWS\System32\smss.exe
    D:\WINDOWS\system32\winlogon.exe
    D:\WINDOWS\system32\services.exe
    D:\WINDOWS\system32\lsass.exe
    D:\WINDOWS\system32\svchost.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\system32\spoolsv.exe
    D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    D:\WINDOWS\ATKKBService.exe
    D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
    D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
    D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
    D:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
    D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
    D:\WINDOWS\system32\nvsvc32.exe
    D:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
    D:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
    D:\WINDOWS\system32\svchost.exe
    D:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
    D:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
    D:\Program Files\Sonera Tietoturva\Anti-Virus\fsrw.exe
    D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
    D:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
    D:\WINDOWS\system32\WgaTray.exe
    D:\WINDOWS\System32\svchost.exe
    D:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
    D:\WINDOWS\htpatch.exe
    D:\Program Files\TW-IA300C ADSL\CnxDslTb.exe
    D:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
    D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe
    D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    D:\PROGRA~1\SONERA~1\ANTI-S~1\fsaw.exe
    K:\Hewlett\Digital Imaging\Unload\hpqcmon.exe
    K:\Hewlett\HP Share-to-Web\hpgs2wnd.exe
    D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    D:\Program Files\QuickTime\QTTask.exe
    K:\Hewlett\HP Share-to-Web\hpgs2wnf.exe
    D:\WINDOWS\system32\ctfmon.exe
    D:\Program Files\Sonera Tietoturva\FSGUI\fsguidll.exe
    D:\Program Files\redline\gameutil.exe
    D:\Program Files\HotKey\HotKey.exe
    D:\Program Files\Logitech\SetPoint\SetPoint.exe
    D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
    D:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
    D:\WINDOWS\system32\wuauclt.exe
    D:\WINDOWS\system32\notepad.exe
    D:\WINDOWS\explorer.exe
    D:\Program Files\Mozilla Firefox\firefox.exe
    K:\mIRC\mirc.exe
    D:\Program Files\MSN Messenger\msnmsgr.exe
    K:\jtn\fasdfadsfdas\scanner.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O4 - HKLM\..\Run: [HTpatch] D:\WINDOWS\htpatch.exe
    O4 - HKLM\..\Run: [SiSUSBRG] D:\WINDOWS\SiSUSBrg.exe
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [CnxDslTaskBar] "D:\Program Files\\TW-IA300C ADSL\CnxDslTb.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [F-Secure Manager] "D:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "D:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [News Service] "D:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [RedLine Taskbar] D:\Program Files\RedLine\Taskbar.exe
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [ATIPTA] D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [F-Secure Startup Wizard] "D:\Program Files\Sonera Tietoturva\FSGUI\FSSW.EXE" /reboot
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [HP Software Update] D:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [CamMonitor] K:\Hewlett\Digital Imaging\\Unload\hpqcmon.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] K:\Hewlett\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE D:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] K:\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Steam] "k:\valve\steam\steam.exe" -silent
    O4 - HKCU\..\Run: [ProBNC] "D:\Documents and Settings\Jani\Työpöytä\arkku\Arkku IP Updater\sysupdate.exe"
    O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [FTPUploader] F:\ftpuploader\FTPUploader.exe /s
    O4 - HKCU\..\Run: [Free Download Manager] F:\Free Download Manager\fdm.exe -autorun
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe (User 'Default user')
    O4 - Startup: mIRC.lnk = K:\mIRC\mirc.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = D:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: DllCmd32.lnk = C:\jetsuite\DLLCMD32.EXE
    O4 - Global Startup: gameutil.exe.lnk = ?
    O4 - Global Startup: HotKey Driver.lnk = D:\Program Files\HotKey\HotKey.exe
    O4 - Global Startup: HP LaserJet 3100 Status.lnk = C:\jetsuite\JETSTAT.EXE
    O4 - Global Startup: Logitech SetPoint.lnk = D:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: Sonera Tietoturva.lnk = D:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
    O8 - Extra context menu item: &Estä tämä kohoikkuna - D:\Program Files\Sonera Tietoturva\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - D:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
    O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - D:\Program Files\Sonera Tietoturva\Anti-Spyware\ieshield.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
    O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/securelogin-devel.cab
    O16 - DPF: {861FDA2A-2B57-4BDA-8B8B-305C9D5D8604} (_Multimedia Player) - http://stream.pussyharem.com/stream/mmp2.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab57176.cab
    O23 - Service: Apple Mobile Device - Apple, Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - D:\WINDOWS\ATKKBService.exe
    O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Sonera Tietoturva - D:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - D:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
    O23 - Service: fsbwsys - F-Secure Corp. - D:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
    O23 - Service: FSMA - F-Secure Corporation - D:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Process Monitor (LVPrcSrv) - Unknown owner - d:\program files\common files\logishrd\lvmvfm\LVPrcSrv.exe (file missing)
    O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - D:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - K:\sissari\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe
    O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - K:\sissari\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe
    O23 - Service: ServiceLayer - Nokia. - D:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - D:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
    O24 - Desktop Component 3: sieni.us - Lyhyitä ja hauskoja flasheja, epileptikkojen paratiisi! - http://sieni.us/?id=6

    --
    End of file - 11520 bytes
     
    AkAntA, May 26, 2008
    #13
  14. Hujo

    Hujo Guest

    loki ok
     
    Hujo, May 26, 2008
    #14
  15. AkAntA

    AkAntA Member

    Joined:
    Oct 15, 2007
    Messages:
    58
    Likes Received:
    0
    Trophy Points:
    16
    Mitäs nyt? Virus vaivaa edelleen konetta.
     
    AkAntA, May 26, 2008
    #15
  16. Hujo

    Hujo Guest

    ajas uudelleen Malwarebytes' Anti-Malware
     
    Hujo, May 26, 2008
    #16
  17. AkAntA

    AkAntA Member

    Joined:
    Oct 15, 2007
    Messages:
    58
    Likes Received:
    0
    Trophy Points:
    16
    Tässä ois tulos

    Malwarebytes' Anti-Malware 1.12
    Tietokantaversio: 722

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|F:\|G:\|H:\|K:\|)
    Tarkistetut kohteet: 244475
    Kulunut aika: 2 hour(s), 8 minute(s), 38 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 1

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    D:\WINDOWS\system32\WINLOGON.EXE.$DIS (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
     
    AkAntA, May 28, 2008
    #17
  18. AkAntA

    AkAntA Member

    Joined:
    Oct 15, 2007
    Messages:
    58
    Likes Received:
    0
    Trophy Points:
    16
    Virus näyttäisi vihdoin lähteneen. Kiitos avusta.
     
    AkAntA, May 28, 2008
    #18

Share This Page