loki muodostettu virheestä..mukana combofix ja malvarebytes lokit. APUVA. F-secure kaapattu.?

Tere. Ehtiskö joku viisaampi katsoa tän hjt lokin.
Ongelmana on että kone käynnistyi itsestään uudelleen ja sen jälkeen ilmoitti että windows on palautunut vakavasta virheestä. Ilmoitti että loki olisi muodostettu virheestä.??


Logfile of HijackThis v1.99.1
Scan saved at 12:07:10, on 4.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
f:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
f:\Program Files\MagicTune Premium\MagicTuneEngine.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\WINDOWS\SOUNDMAN.EXE
F:\Program Files\Winamp\Winampa.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
F:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
F:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
F:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
F:\Program Files\MagicTune Premium\GammaTray.exe
F:\Program Files\SEC\Natural Color Pro\NCProTray.exe
F:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
f:\Program Files\MagicTune Premium\MagicTune.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
F:\net\hjt\HijackThis_v1.99.1.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe" //mailurl:mailto:markus.keinanen@pp.inet.fi
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WinampAgent] "f:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] f:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [DAEMON Tools-1033] "F:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PcSync] F:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - Global Startup: GammaTray.lnk = F:\Program Files\MagicTune Premium\GammaTray.exe
O4 - Global Startup: NCProTray.lnk = F:\Program Files\SEC\Natural Color Pro\NCProTray.exe
O4 - Global Startup: WinZip Quick Pick.lnk = F:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
O11 - Options group: [INTERNATIONAL] International*
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - f:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: MagicTuneEngine - Unknown owner - f:\Program Files\MagicTune Premium\MagicTuneEngine.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

 

Tässä tuon malwarebytesin skannauksen tulos. Yks troijalainen poistettu.

Malwarebytes' Anti-Malware 1.14
Tietokantaversio: 821

16:07:35 4.6.2008
mbam-log-6-4-2008 (16-07-35).txt

Tarkistustyyppi: Täysi tarkistus (C:\|D:\|F:\|G:\|J:\|)
Tarkistetut kohteet: 158110
Kulunut aika: 50 minute(s), 12 second(s)

Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 1

Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)

Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)

Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)

Saastuneita tiedostoja:
F:\net\BSplayer.Pro\CORE10k.EXE (Trojan.Agent) -> Quarantined and deleted successfully.

 

Tässäpä vielä combofixin tulos:


ComboFix 08-06-03.1 - Timppa 2008-06-04 16:18:30.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.1932 [GMT 3:00]
Running from: C:\Documents and Settings\Timppa\Työpöytä\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-04 to 2008-06-04 )))))))))))))))))
.

2008-06-04 15:14 . 2008-06-04 15:14 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-04 15:14 . 2008-06-04 15:14 <KANSIO> d-------- C:\Documents and Settings\Timppa\Application Data\Malwarebytes
2008-06-04 15:14 . 2008-06-04 15:14 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-04 15:14 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-04 15:14 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-02 09:40 . 2008-06-02 09:39 720,896 --a------ C:\WINDOWS\iun6002.exe
2008-06-01 15:17 . 2008-06-01 15:17 <KANSIO> d-------- C:\Documents and Settings\Timppa\Application Data\123 Free Solitaire
2008-06-01 14:55 . 2008-06-01 18:50 <KANSIO> d-------- C:\Documents and Settings\Timppa\Application Data\SolSuite
2008-06-01 14:55 . 2008-06-01 14:55 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\TreeCardGames
2008-05-31 23:27 . 2008-06-01 00:31 <KANSIO> d-------- C:\Documents and Settings\Timppa\.scorched3d
2008-05-31 23:20 . 2007-09-15 15:11 27,136 --a------ C:\WINDOWS\system32\PCWizard.cpl
2008-05-31 20:09 . 2008-05-31 20:09 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\ATI
2008-05-31 19:58 . 2008-05-31 19:58 <KANSIO> d-------- C:\Program Files\Google
2008-05-30 00:00 . 2008-05-30 00:31 65,782 --a------ C:\error.htm
2008-05-30 00:00 . 2008-05-30 00:24 244 --a------ C:\infect.htm
2008-05-29 12:50 . 2008-05-29 12:50 <KANSIO> d-------- C:\WINDOWS\Sun
2008-05-29 08:10 . 2004-09-15 15:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-05-27 17:51 . 2008-06-02 13:47 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-27 17:51 . 2008-05-27 17:51 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-27 17:50 . 2008-05-27 17:50 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-27 17:49 . 2008-05-27 17:49 <KANSIO> d-------- C:\Program Files\Apple Software Update
2008-05-27 17:49 . 2008-05-27 17:49 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-05-27 17:34 . 2008-06-04 15:30 49 --a------ C:\WINDOWS\NeroDigital.ini
2008-05-27 17:33 . 2008-05-29 14:52 <KANSIO> d-------- C:\Program Files\Java
2008-05-27 17:33 . 2008-05-27 17:33 <KANSIO> d-------- C:\Program Files\Common Files\Java
2008-05-27 17:33 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-05-27 16:58 . 2008-05-29 11:14 <KANSIO> d-------- C:\Documents and Settings\Timppa\Application Data\vlc
2008-05-27 15:59 . 2008-05-27 16:08 135,042 --a------ C:\WINDOWS\hpdj3600.his
2008-05-27 15:59 . 2008-05-27 16:08 5,150 --a------ C:\WINDOWS\hpdj3600.ini
2008-05-27 11:24 . 2004-03-24 10:52 1,802,240 --------- C:\WINDOWS\NuNinst.exe
2008-05-27 11:24 . 2004-04-21 09:10 47,563 --------- C:\WINDOWS\NuNinst.cfg
2008-05-27 11:23 . 2008-05-27 11:23 <KANSIO> d-------- C:\WINDOWS\InCD
2008-05-27 11:23 . 2004-03-24 18:44 99,568 --------- C:\WINDOWS\system32\drivers\incdfs.sys
2008-05-27 11:23 . 2004-03-24 18:45 27,664 --------- C:\WINDOWS\system32\drivers\incdpass.sys
2008-05-27 11:23 . 2004-03-24 18:45 9,561 --------- C:\WINDOWS\system32\drivers\incdrec.sys
2008-05-27 11:03 . 2004-03-25 10:06 1,802,240 --------- C:\WINDOWS\UNNMP.exe
2008-05-27 11:03 . 2004-04-21 09:10 52,418 --------- C:\WINDOWS\UNNMP.cfg
2008-05-27 10:48 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-05-27 10:43 . 2004-04-19 06:37 1,814,528 --------- C:\WINDOWS\UNNeroVision.exe
2008-05-27 10:43 . 2004-04-21 09:10 96,891 --------- C:\WINDOWS\UNNeroVision.cfg
2008-05-27 10:43 . 2001-03-08 19:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2008-05-27 10:40 . 2008-05-27 10:40 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Ahead
2008-05-27 10:39 . 2008-05-27 10:40 <KANSIO> d-------- C:\Program Files\Common Files\Ahead
2008-05-27 10:39 . 2001-07-06 14:41 569,344 --a------ C:\WINDOWS\system32\imagr5.dll
2008-05-27 10:39 . 2001-07-06 12:44 544,768 --a------ C:\WINDOWS\system32\imagx5.dll
2008-05-27 10:39 . 2001-07-06 18:24 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll
2008-05-27 10:39 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2008-05-27 10:39 . 2001-06-26 08:15 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2008-05-27 10:29 . 2008-05-27 10:29 <KANSIO> d-------- C:\Program Files\Common Files\Adobe
2008-05-26 20:33 . 2008-03-01 16:01 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-05-26 20:33 . 2008-03-01 16:01 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-05-26 20:32 . 2008-03-01 16:01 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-05-26 20:32 . 2007-04-17 12:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-05-26 20:32 . 2007-03-08 08:10 1,011,712 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-05-26 20:32 . 2003-02-24 16:20 827,392 -ra------ C:\WINDOWS\system32\Flash.ocx
2008-05-26 20:32 . 2008-03-01 16:01 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-05-26 20:32 . 2008-03-01 16:01 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-05-26 20:32 . 2008-03-01 16:01 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-05-26 20:32 . 2008-02-22 13:00 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-05-26 20:32 . 2007-02-13 10:35 12,544 --a------ C:\WINDOWS\system32\drivers\MTiCtwl.sys
2008-05-26 20:31 . 2008-05-26 20:35 <KANSIO> d-------- C:\WINDOWS\system32\fi-fi
2008-05-26 20:08 . 2008-05-26 20:08 <KANSIO> d-------- C:\Documents and Settings\Timppa\Application Data\ATI
2008-05-26 17:23 . 2007-02-28 19:02 2,182,656 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-05-26 17:23 . 2007-02-28 19:02 2,138,624 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-05-26 17:23 . 2007-02-28 19:02 2,059,904 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-05-26 17:23 . 2007-02-28 19:02 2,018,304 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-05-26 17:15 . 2006-05-05 12:41 453,120 -----c--- C:\WINDOWS\system32\dllcache\mrxsmb.sys
2008-05-26 17:11 . 2006-06-01 21:48 163,840 -----c--- C:\WINDOWS\system32\dllcache\jgdw400.dll
2008-05-26 17:11 . 2006-06-01 21:48 27,648 -----c--- C:\WINDOWS\system32\dllcache\jgpl400.dll
2008-05-26 17:00 . 2006-03-17 03:38 28,672 --------- C:\WINDOWS\system32\verclsid.exe
2008-05-26 16:53 . 2008-05-26 16:53 <KANSIO> d-------- C:\WINDOWS\system32\Lang
2008-05-26 16:53 . 2008-05-26 16:53 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-05-26 16:53 . 2008-05-26 16:53 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-05-26 16:39 . 2008-05-27 16:46 <KANSIO> d--h----- C:\WINDOWS\$hf_mig$
2008-05-26 16:33 . 2008-05-26 16:33 <KANSIO> d-------- C:\Documents and Settings\Timppa\Application Data\Talkback
2008-05-26 16:32 . 2008-05-26 16:32 0 --a------ C:\WINDOWS\nsreg.dat
2008-05-26 16:26 . 2008-05-26 16:26 13,646 --a------ C:\WINDOWS\system32\wpa.bak
2008-05-26 16:22 . 2008-05-27 17:49 <KANSIO> d-------- C:\Documents and Settings\Timppa\Application Data\F-Secure
2008-05-26 16:18 . 2008-05-26 16:18 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\fssg
2008-05-26 16:18 . 2008-05-26 16:18 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
2008-05-26 16:18 . 2006-12-21 16:51 50,240 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
2008-05-26 16:18 . 2006-12-21 16:51 29,536 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys
2008-05-26 16:16 . 2008-05-26 16:18 <KANSIO> d-------- C:\Program Files\F-Secure
2008-05-26 16:11 . 2008-05-26 16:11 <KANSIO> d-------- C:\Program Files\DIFX
2008-05-26 16:10 . 2008-05-26 16:11 <KANSIO> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-05-26 16:10 . 2008-05-26 16:10 <KANSIO> d-------- C:\Program Files\Nokia
2008-05-26 16:10 . 2008-05-26 16:10 <KANSIO> d-------- C:\Program Files\Common Files\PCSuite
2008-05-26 16:10 . 2008-05-26 16:10 <KANSIO> d-------- C:\Program Files\Common Files\Nokia
2008-05-26 16:10 . 2008-05-26 16:11 <KANSIO> d-------- C:\Documents and Settings\Timppa\Application Data\PC Suite
2008-05-26 16:10 . 2008-05-26 16:10 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite
2008-05-26 16:04 . 2008-05-31 12:26 132 --a------ C:\WINDOWS\winamp.ini
2008-05-26 16:00 . 2008-05-26 16:00 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-05-18 13:49 . 2003-12-23 06:32 174,464 --a------ C:\WINDOWS\system32\drivers\yukonwxp.sys
2008-05-18 13:49 . 2003-12-23 13:30 12,288 --a------ C:\WINDOWS\system32\mrvdlg.dll
2008-05-12 18:03 . 2008-05-12 18:03 19,968 --a------ C:\WINDOWS\system32\atiadlxx.dll

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-31 17:06 --------- d-----w C:\Program Files\ATI Technologies
2008-05-31 16:58 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-29 08:14 --------- d-----w C:\Documents and Settings\Timppa\Application Data\vlc
2008-05-26 15:22 --------- d-----w C:\Program Files\MSXML 4.0
2008-05-26 13:09 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-05-26 12:55 --------- d-----w C:\Program Files\Realtek AC97
2008-05-26 12:45 --------- d-----w C:\Program Files\microsoft frontpage
2008-05-12 16:30 3,007,488 ----a-w C:\WINDOWS\system32\drivers\ati2mtag.sys
2008-05-12 15:56 397,312 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
2008-05-12 15:54 305,152 ----a-w C:\WINDOWS\system32\ati2dvag.dll
2008-05-12 15:53 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
2008-05-12 15:45 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
2008-05-12 15:45 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
2008-05-12 15:45 180,224 ----a-w C:\WINDOWS\system32\atipdlxx.dll
2008-05-12 15:45 139,264 ----a-w C:\WINDOWS\system32\Oemdspif.dll
2008-05-12 15:44 139,264 ----a-w C:\WINDOWS\system32\ati2evxx.dll
2008-05-12 15:43 540,672 ----a-w C:\WINDOWS\system32\ati2evxx.exe
2008-05-12 15:43 10,153,984 ----a-w C:\WINDOWS\system32\atioglx2.dll
2008-05-12 15:41 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
2008-05-12 15:32 3,203,168 ----a-w C:\WINDOWS\system32\ati3duag.dll
2008-05-12 15:22 1,999,616 ----a-w C:\WINDOWS\system32\ativvaxx.dll
2008-05-12 15:09 47,104 ----a-w C:\WINDOWS\system32\amdpcom32.dll
2008-05-12 15:05 5,439,488 ----a-w C:\WINDOWS\system32\atioglxx.dll
2008-05-12 15:05 327,680 ----a-w C:\WINDOWS\system32\atikvmag.dll
2008-05-12 15:03 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
2008-05-12 15:02 49,152 ----a-w C:\WINDOWS\system32\drivers\ati2erec.dll
2008-05-12 15:02 241,664 ----a-w C:\WINDOWS\system32\atiok3x2.dll
2008-05-12 14:57 548,864 ----a-w C:\WINDOWS\system32\ati2cqag.dll
2008-05-12 07:49 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe
2008-03-25 07:20 219,936 ----a-w C:\WINDOWS\system32\msltus40.dll
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2006-05-06 16:42 7,260,160 ----a-w C:\Program Files\mozilla firefox\plugins\libvlc.dll
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 15:00 15360]
"PcSync"="F:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-04-11 17:52 1409024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 577536 C:\WINDOWS\soundman.exe]
"WinampAgent"="f:\Program Files\Winamp\Winampa.exe" [2003-04-02 05:20 12288]
"QuickTime Task"="F:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"PCSuiteTrayApplication"="F:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-04-26 08:29 237568]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2006-12-05 16:22 176177]
"F-Secure TNB"="C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" [2007-01-08 22:10 724992]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"InCD"="f:\Program Files\Ahead\InCD\InCD.exe" [2004-03-24 13:41 1294446]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]
"DAEMON Tools-1033"="F:\Program Files\D-Tools\daemon.exe" [2003-10-02 02:20 81920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]

C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
GammaTray.lnk - F:\Program Files\MagicTune Premium\GammaTray.exe [2008-05-18 18:21:57 36864]
NCProTray.lnk - F:\Program Files\SEC\Natural Color Pro\NCProTray.exe [2008-05-18 18:20:13 49220]
WinZip Quick Pick.lnk - F:\Program Files\WinZip\WZQKPICK.EXE [2008-05-26 16:06:33 122880]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2006-12-21 16:51]
R0 pnpshark;pnpshark;C:\WINDOWS\system32\DRIVERS\pnpshark.sys [2003-10-02 03:16]
R0 st3shark;st3shark;C:\WINDOWS\system32\DRIVERS\st3shark.sys [2003-09-27 14:37]
R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure\HIPS\fshs.sys [2006-12-14 18:52]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\minifilter\fsgk.sys [2007-01-24 18:41]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2007-01-24 18:41]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2007-01-24 18:41]

*Newly Created Service* - CATCHME
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-06-04 00:01:12 C:\WINDOWS\Tasks\Scheduled scanning task.job"
- C:\PROGRA~1\F-Secure\ANTI-V~1\fsav.exeQ /HARD /POLICY /SCHED /NOBREAK /REPORT=C:\PROGRA~1\F-Secure\ANTI-V~1\report.txt
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-04 16:20:59
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-04 16:21:31
ComboFix-quarantined-files.txt 2008-06-04 13:21:27

Pre-Run: 11,148,095,488 tavua vapaana
Post-Run: 11,309,371,392 tavua vapaana

203 --- E O F --- 2008-05-27 13:46:27

 

Mulla oli kuukausi sitten sama ongelma ja paljastu, että koneella oli virus.. Poistin sen ja eikä sen jälkeen enään mitään ongelmia=)