Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:09:19, on 30.5.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINXP\System32\smss.exe C:\WINXP\system32\winlogon.exe C:\WINXP\system32\services.exe C:\WINXP\system32\lsass.exe C:\WINXP\system32\Ati2evxx.exe C:\WINXP\system32\svchost.exe C:\WINXP\System32\svchost.exe C:\WINXP\system32\Ati2evxx.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINXP\system32\LEXBCES.EXE C:\WINXP\system32\LEXPPS.EXE C:\WINXP\system32\spoolsv.exe C:\WINXP\SOUNDMAN.EXE C:\WINXP\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\WINXP\system32\LXSUPMON.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Documents and Settings\Yle\Omat tiedostot\katselu+codekit\Quiktime\iTunesHelper.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINXP\system32\ctfmon.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\WINXP\service.exe C:\WINXP\winudpmgr.exe C:\Program Files\Veoh Networks\Veoh\VeohClient.exe C:\Program Files\Nikon\PictureProject\NkbMonitor.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINXP\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINXP\explorer.exe C:\PROGRA~1\Mozilla Firefox\firefox.exe C:\WINXP\system32\taskmgr.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [LVCOMSX] C:\WINXP\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [LXSUPMON] C:\WINXP\system32\LXSUPMON.EXE RUN O4 - HKLM\..\Run: [NeroCheck] C:\WINXP\system32\NeroCheck.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Documents and Settings\Yle\Omat tiedostot\katselu+codekit\Quiktime\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe O4 - HKLM\..\Run: [Windows UDP Control Center] winudpmgr.exe O4 - HKLM\..\Run: [Windows svchost] service.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINXP\system32\ctfmon.exe O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{9DD88845-7E41-4248-98E9-28F8AD266849}: NameServer = 212.50.131.153 213.139.190.3 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINXP\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINXP\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINXP\system32\LEXBCES.EXE O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 7574 bytes
Mene Ohjauspaneliin ==>> Java ==> Update vlilehti ja alhaalta Update Now nappista päivitys. ****************************************************** En tunnistanut palomuuria koneeltasi. Asennukset on syytä tehdä Järjestelmänvalvojan tunnuksilla Asenna koneellesi YKSI palomuuriohjelma NYT: 1) ZoneAlarm 2) Agnitum 3) Sunbelt/Kerio 4) Comodo Jos käytät sisäänrakennettua Windowsin palomuuria, se ei ole suositeltua sillä se ei estä koneelta ulosmeneviä yhteyksiä. Muista käyttää vain yhtä palomuuria kerrallaan. --------------------------------------------------------------------------- 1. Lataa combofix.exe työpöydällesi jommastakummasta linkistä: combofix.exe combofix.exe Avaa Muistio ja kopioi/liitä Lainaus: laatikon sisältö sinne: Tallenna nimellä CFScript (itse asiassa combofix tunnistaa tuon vaikka tiedostopääte ei olisi edes .txt). Sitten raahaa ja pudota CFScript ComboFix.exeen kuten alla.(Älä klikkaa) Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen. Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne. Sammuta selain ja muut ohjelmat Fixin ajaksi. (ei virustorjuntaa) Käynnistä HijackThis:ja Scan ja ruksaa seuraavat punaisella listatut tiedostot sekä poista ne.(fix Chekked) O4 - HKLM\..\Run: [NeroCheck] C:\WINXP\system32\NeroCheck.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe O4 - HKLM\..\Run: [Windows UDP Control Center] winudpmgr.exe O4 - HKLM\..\Run: [Windows svchost] service.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE Tyhjennä roskakori ja käynnistä koneesi uudelleen. Postita tänne seuraavat lokit: * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta) * (C:\ComboFix.txt) raportti *
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 0:35:38, on 31.5.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINXP\System32\smss.exe C:\WINXP\system32\winlogon.exe C:\WINXP\system32\services.exe C:\WINXP\system32\lsass.exe C:\WINXP\system32\Ati2evxx.exe C:\WINXP\system32\svchost.exe C:\WINXP\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINXP\system32\Ati2evxx.exe C:\WINXP\Explorer.EXE C:\WINXP\system32\LEXBCES.EXE C:\WINXP\system32\spoolsv.exe C:\WINXP\system32\LEXPPS.EXE C:\WINXP\SOUNDMAN.EXE C:\WINXP\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\WINXP\system32\LXSUPMON.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Documents and Settings\Yle\Omat tiedostot\katselu+codekit\Quiktime\iTunesHelper.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINXP\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\Nikon\PictureProject\NkbMonitor.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINXP\system32\svchost.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINXP\system32\wuauclt.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [LVCOMSX] C:\WINXP\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [LXSUPMON] C:\WINXP\system32\LXSUPMON.EXE RUN O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Documents and Settings\Yle\Omat tiedostot\katselu+codekit\Quiktime\iTunesHelper.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINXP\system32\ctfmon.exe O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{9DD88845-7E41-4248-98E9-28F8AD266849}: NameServer = 212.50.131.153 213.139.190.3 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINXP\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINXP\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINXP\system32\LEXBCES.EXE O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 7240 bytes ComboFix 08-05-29.1 - Yle 2008-05-31 0:09:12.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.206 [GMT 3:00] Running from: C:\Documents and Settings\Yle\Työpöytä\ComboFix.exe Command switches used :: C:\Documents and Settings\Yle\Työpöytä\CFScript.txt * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! FILE :: C:\WINDOWS\winudspm.exe C:\WINXP\service.exe C:\WINXP\winudpmgr.exe . (((((((((((((((((((((((((((((((((((((( Muut poistot )))))))))))))))))))))))))))))))))))))))))))))))))))))))) . C:\setup.exe C:\WINXP\service.exe C:\WINXP\winudpmgr.exe . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-04-28 to 2008-05-30 ))))))))))))))))) . 2008-05-30 23:50 . 2008-05-30 23:50 <KANSIO> d-------- C:\Program Files\Sunbelt Software 2008-05-30 22:12 . 2008-05-30 22:12 60,132 --a------ C:\dcsi.exe 2008-05-30 21:27 . 2008-05-30 21:27 <KANSIO> d-------- C:\Program Files\Trend Micro 2008-05-30 20:26 . 2008-05-30 22:48 60,132 --a------ C:\dci.exe 2008-05-30 19:37 . 2008-05-30 19:37 83,400 --a------ C:\WINXP\winudpmgr.MSNFix 2008-05-30 19:37 . 2008-05-30 20:10 83,400 --a------ C:\img.exe 2008-05-30 19:37 . 2008-05-30 19:47 60,132 --a------ C:\dci.MSNFix 2008-05-30 18:29 . 2008-05-30 18:28 691,545 --a------ C:\WINXP\unins000.exe 2008-05-30 18:29 . 2008-05-30 18:29 2,550 --a------ C:\WINXP\unins000.dat 2008-05-30 18:03 . 2008-05-30 18:02 86,498 --a------ C:\WINXP\service.MSNFix 2008-05-29 22:07 . 2008-05-29 22:07 86,340 -r-hs---- C:\WINXP\winudspm.exe 2008-05-24 21:24 . 2008-05-24 21:24 <KANSIO> d-------- C:\Program Files\SystemRequirementsLab 2008-05-24 21:24 . 2008-05-24 21:24 <KANSIO> d-------- C:\Documents and Settings\Yle\Application Data\SystemRequirementsLab 2008-05-10 15:11 . 2008-05-10 15:11 54,156 --ah----- C:\WINXP\QTFont.qfn 2008-05-10 15:11 . 2008-05-10 15:11 1,409 --a------ C:\WINXP\QTFont.for 2008-05-10 13:05 . 2008-05-10 13:05 <KANSIO> d-------- C:\Program Files\Veoh Networks 2008-04-16 23:47 . 2008-04-16 23:47 <KANSIO> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-04-16 23:21 . 2007-07-30 19:19 271,224 --a------ C:\WINXP\system32\mucltui.dll 2008-04-16 23:21 . 2007-07-30 19:19 207,736 --a------ C:\WINXP\system32\muweb.dll 2008-04-16 23:21 . 2007-07-30 19:18 30,072 --a------ C:\WINXP\system32\mucltui.dll.mui 2008-04-16 19:19 . 2008-04-16 19:19 <KANSIO> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller 2008-04-16 19:18 . 2008-04-16 19:20 <KANSIO> d-------- C:\Program Files\Windows Live 2008-04-16 19:18 . 2008-04-16 19:18 <KANSIO> d-------- C:\Documents and Settings\All Users.WINXP\Application Data\WLInstaller 2008-04-14 20:23 . 2008-04-14 20:23 <KANSIO> d-------- C:\Program Files\Combined Community Codec Pack . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-30 15:36 --------- d-----w C:\Documents and Settings\All Users.WINXP\Application Data\Spybot - Search & Destroy 2008-05-30 15:34 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-05-29 18:58 --------- d-----w C:\Documents and Settings\Yle\Application Data\uTorrent 2008-05-10 10:06 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-04-27 08:37 20 ---h--w C:\Documents and Settings\All Users.WINXP\Application Data\PKP_DLec.DAT 2008-04-27 08:37 20 ---h--w C:\Documents and Settings\All Users.WINXP\Application Data\PKP_DLds.DAT 2008-04-16 16:29 --------- d-----w C:\Program Files\MSN Messenger 2008-03-25 04:51 621,344 ----a-w C:\WINXP\system32\mswstr10.dll 2008-03-25 04:51 166,688 ----a-w C:\WINXP\system32\msjint40.dll 2008-03-20 08:09 1,845,504 ----a-w C:\WINXP\system32\win32k.sys 2008-03-01 13:01 826,368 ----a-w C:\WINXP\system32\wininet.dll 2008-02-26 12:00 294,912 ----a-w C:\WINXP\system32\msctf.dll 2008-02-25 18:19 2,829 ----a-w C:\WINXP\War3Unin.pif 2008-02-25 18:19 139,264 ----a-w C:\WINXP\War3Unin.exe 2008-02-22 15:10 22,160 ----a-w C:\Documents and Settings\Yle\Application Data\GDIPFONTCACHEV1.DAT 2008-02-20 06:51 282,624 ----a-w C:\WINXP\system32\gdi32.dll 2008-02-20 05:38 45,568 ----a-w C:\WINXP\system32\dnsrslvr.dll . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINXP\system32\ctfmon.exe" [2004-09-15 15:00 15360] "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-10-08 12:06 196608] "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184] "Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [ ] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2008-02-22 14:30 217544] "Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-05-08 16:53 3640368] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2004-01-08 21:54 65536 C:\WINXP\SOUNDMAN.EXE] "LVCOMSX"="C:\WINXP\system32\LVCOMSX.EXE" [2004-10-08 11:52 221184] "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-10-08 12:31 458752] "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-10-08 12:24 217088] "LXSUPMON"="C:\WINXP\system32\LXSUPMON.exe" [2002-03-08 05:02 900096] "NeroCheck"="C:\WINXP\system32\NeroCheck.exe" [2001-07-09 12:50 155648] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41 45056] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "iTunesHelper"="C:\Documents and Settings\Yle\Omat tiedostot\katselu+codekit\Quiktime\iTunesHelper.exe" [2006-02-23 16:45 278528] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-06-28 15:58 282624] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 02:19 79224] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 04:06 40048] "Windows UDP Control"="winudspm.exe" [2008-05-29 22:07 86340 C:\WINXP\winudspm.exe] "Windows UDP Control Center"="winudpmgr.exe" [] "Windows svchost"="service.exe" [] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINXP\system32\CTFMON.EXE" [2004-09-15 15:00 15360] C:\Documents and Settings\All Users.WINXP\K„ynnist„-valikko\Ohjelmat\K„ynnistys\ Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 12:01:04 83360] NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2007-11-27 19:10:05 118784] VIA RAID TOOL.lnk - C:\Program Files\VIA\RAID\raid_tool.exe [2004-10-19 12:15:55 561152] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.iv41"= ir41_32.dll "VIDC.YV12"= yv12vfw.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Documents and Settings\\Yle\\Työpöytä\\dc++\\DCPlusPlus.exe"= "C:\\Documents and Settings\\Yle\\Omat tiedostot\\katselu+codekit\\Quiktime\\iTunes.exe"= "C:\\Documents and Settings\\Yle\\Omat tiedostot\\Vastaanotetut tiedostot\\TibiCam\\TibiCam\\TibiCAM.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\The All-Seeing Eye\\eye.exe"= "C:\\Program Files\\Microsoft Games\\Age of Empires\\Empires.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\uTorrent\\utorrent.exe"= "C:\\Warcraft III\\Warcraft III.exe"= "C:\\Program Files\\Hamachi\\hamachi.exe"= "C:\\WINXP\\system32\\LEXPPS.EXE"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"= "C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"= R0 viasraid;viasraid;C:\WINXP\system32\DRIVERS\viasraid.sys [2003-06-12 13:31] R1 aswSP;avast! Self Protection;C:\WINXP\system32\drivers\aswSP.sys [2008-05-16 02:20] R1 fwdrv;Firewall Driver;C:\WINXP\system32\drivers\fwdrv.sys [2007-04-26 10:21] R1 khips;Kerio HIPS Driver;C:\WINXP\system32\drivers\khips.sys [2007-04-26 10:21] R2 aswFsBlk;aswFsBlk;C:\WINXP\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16] R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [2007-04-26 10:21] *Newly Created Service* - CATCHME *Newly Created Service* - FWDRV *Newly Created Service* - KHIPS *Newly Created Service* - SPF4 . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-31 00:14:51 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-31 0:18:38 ComboFix-quarantined-files.txt 2008-05-30 21:18:14 Pre-Run: 24,285,712,384 tavua vapaana Post-Run: 25,065,295,872 tavua vapaana 146 --- E O F --- 2008-05-28 16:22:28
Mene Ohjauspaneliin ==>> Java ==> Update vlilehti ja alhaalta Update Now nappista päivitys. ---------------------------------------------------- * Lataa Otmoveit2 by OldTimer. * Tallenna se työpöydällesi. * Tuplaklikkaa OTMoveIt2.exe käynnistääksesi sen. * Kopioi (CTRL+C) alla olevasta laatikosta kaikki teksti. Code: C:\dcsi.exe C:\dci.exe C:\img.exe C:\dci.MSNFix * Palaa takaisin OtmoveIt2, paina oikeanpuoleista hiiren nappia Paste List Of Files/Folders to Move-ikkunassa (Keltaisen palkin alla) ja paina Liitä. * Paina punaista MoveIt! -nappia. * Kopioi (CTRL+C) ja liitä (CTRL+V) Results-ikkunaan (Vihreän palkin alla) tullut teksti seuraavaan viestiisi. * Sulje OtMoveIt. Jos jotain tiedostoa/kansiota ei voitu siirtää heti, ohjelma ehdottaa koneen uudelleenkäynnistystä. Vastaa ehdotukseen Yes, jolloin OtMoveIt käynnistää koneesi uudelleen. ---------------------------------------------------------- Varmista tällä: Lataa Malwarebytes' Anti-Malware työpöydällesi. * Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman. * Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes' Anti-Malware ja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Finish. * Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version. * Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan. * Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset. * Varmistu, että kaikki on merkitty ja klikkaa Remove Selected. * Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt * Lähetä lokin sisältö seuraavassa viestissäsi + uusi hjt-loki + OTMoveit logi. .
Malwarebytes' Anti-Malware 1.14 Tietokantaversio: 807 19:15:34 31.5.2008 mbam-log-5-31-2008 (19-15-34).txt Tarkistustyyppi: Täysi tarkistus (C:\|) Tarkistetut kohteet: 159378 Kulunut aika: 44 minute(s), 32 second(s) Saastuneita muistiprosesseja: 0 Saastuneita muistimoduuleja: 0 Saastuneita rekisteriavaimia: 0 Saastuneita rekisteriarvoja: 0 Saastuneita rekisterikohteita: 0 Saastuneita hakemistoja: 0 Saastuneita tiedostoja: 0 Saastuneita muistiprosesseja: (Haitallisia kohteita ei löydetty) Saastuneita muistimoduuleja: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriavaimia: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriarvoja: (Haitallisia kohteita ei löydetty) Saastuneita rekisterikohteita: (Haitallisia kohteita ei löydetty) Saastuneita hakemistoja: (Haitallisia kohteita ei löydetty) Saastuneita tiedostoja: (Haitallisia kohteita ei löydetty) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:17:15, on 31.5.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINXP\System32\smss.exe C:\WINXP\system32\winlogon.exe C:\WINXP\system32\services.exe C:\WINXP\system32\lsass.exe C:\WINXP\system32\Ati2evxx.exe C:\WINXP\system32\svchost.exe C:\WINXP\System32\svchost.exe C:\WINXP\system32\Ati2evxx.exe C:\WINXP\Explorer.EXE C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINXP\SOUNDMAN.EXE C:\WINXP\system32\LVCOMSX.EXE C:\Program Files\Logitech\Video\LogiTray.exe C:\WINXP\system32\LXSUPMON.EXE C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Documents and Settings\Yle\Omat tiedostot\katselu+codekit\Quiktime\iTunesHelper.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\WINXP\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\WINXP\system32\LEXBCES.EXE C:\Program Files\Nikon\PictureProject\NkbMonitor.exe C:\WINXP\system32\LEXPPS.EXE C:\WINXP\system32\spoolsv.exe C:\Program Files\Logitech\Video\FxSvr2.exe C:\Program Files\VIA\RAID\raid_tool.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINXP\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [LVCOMSX] C:\WINXP\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [LXSUPMON] C:\WINXP\system32\LXSUPMON.EXE RUN O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Documents and Settings\Yle\Omat tiedostot\katselu+codekit\Quiktime\iTunesHelper.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINXP\system32\ctfmon.exe O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{9DD88845-7E41-4248-98E9-28F8AD266849}: NameServer = 212.50.131.153 213.139.190.3 O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINXP\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINXP\system32\ati2sgag.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINXP\system32\LEXBCES.EXE O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- End of file - 7176 bytes File/Folder C:\dcsi.exe not found. File/Folder not found. File/Folder C:\dci.exe not found. File/Folder not found. File/Folder C:\img.exe not found. File/Folder not found. File/Folder C:\dci.MSNFix not found. OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 05312008_180748
Itselläkin on ongelmia ilmeisesti saman viruksen kanssa. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:14:33, on 12.6.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe C:\WINDOWS\CTHELPER.EXE C:\WINDOWS\system32\CTXFIHLP.EXE C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\System32\snmp.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\PROGRA~1\SPYWAR~1\sp_rsser.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\WINDOWS\system32\WgaTray.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\SAMSUNG\FW LiveUpdate\FWManager.exe C:\Program Files\HijackThis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/index.php?rvs=hompag R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {32D0DDCA-0684-4879-B24B-2E8CB00FDC52} - (no file) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\FWManager.exe r O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [SpywareTerminator] "C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe" O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" O4 - HKLM\..\Run: [RCSystem] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll" O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Windows Control Center] winudpmr.exe O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1186242354811 O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O20 - Winlogon Notify: pmnnOgDt - pmnnOgDt.dll (file missing) O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\PROGRA~1\SPYWAR~1\sp_rsser.exe -- End of file - 9962 bytes Kelpaako jo mainittu combofixin scripti, vai pitääkö tehdä erillainen?
==>> Craphe Älä käytä toisen koneen fixiä. Kaikki on yksilöllisiä ohjelmistojen suhteen. Tämä täytyy sammuttaa fixien ajaksi: 1. Käynnistä Spybot-S&D Edistyneessä tilassa 2. Jos se ei ole Edistyneessä tilassa, mene Tila-valikkoon ja valitse Edistynyt tila 3. Klikkaa vasemmalla Työkalut 4. Klikkaa listassa Pysyvä suojaus 5. Ota rasti pois kohdasta "Pysyvä TeaTimer" ja paina OK. 6. Käynnistä kone uudelleen. Lataa Malwarebytes' Anti-Malware työpöydällesi. * Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman. * Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes' Anti-Malware ja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Finish. * Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version. * Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan. * Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset. * Varmistu, että kaikki on merkitty ja klikkaa Remove Selected. * Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt * Lähetä lokin sisältö seuraavassa viestissäsi + uusi hjt-loki. ------------------------------------------------------------------ 1. Lataa combofix.exe työpöydällesi mistä tahansa alla olevasta linkistä: Linkki 1 Linkki 2 Linkki 3 2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia. 3. Kun työkalu on valmis, se tuottaa lokin. (C:\ComboFix.txt) Lähetä tämä loki viesti ketjuusi. Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen. ----------------------------------------------------------------- Sammuta selain ja muut ohjelmat Fixin ajaksi. (ei virustorjuntaa) Käynnistä HijackThis:ja Scan ja ruksaa seuraavat punaisella listatut tiedostot sekä poista ne.(fix Chekked) O2 - BHO: (no name) - {32D0DDCA-0684-4879-B24B-2E8CB00FDC52} - (no file) O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [Windows Control Center] winudpmr.exe O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe O20 - Winlogon Notify: pmnnOgDt - pmnnOgDt.dll (file missing) Tyhjennä roskakori ja käynnistä koneesi uudelleen. Postita tänne seuraavat lokit: * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta) * (C:\ComboFix.txt) raportti * Malwarebytes' Anti-Malware\Logs\log-päiväys.txt *
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:44:21, on 12.6.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\snmp.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\SAMSUNG\FW LiveUpdate\FWManager.exe C:\Program Files\Winamp\winampa.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe C:\WINDOWS\CTHELPER.EXE C:\WINDOWS\system32\CTXFIHLP.EXE C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe C:\Program Files\iTunes\iTunesHelper.exe C:\PROGRA~1\SPYWAR~1\sp_rsser.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\DAEMON Tools\daemon.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\WINDOWS\system32\WgaTray.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Opera\Opera.exe C:\Program Files\HijackThis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://finnish.toggle.com/index.php?rvs=hompag R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Name of App] C:\Program Files\SAMSUNG\FW LiveUpdate\FWManager.exe r O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler O4 - HKLM\..\Run: [SpywareTerminator] "C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe" O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE O4 - HKLM\..\Run: [CTDVDDET] "C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" O4 - HKLM\..\Run: [RCSystem] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll" O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1186242354811 O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\PROGRA~1\SPYWAR~1\sp_rsser.exe -- End of file - 9164 bytes ComboFix 08-06-10.5 - Craphe 2008-06-12 18:13:47.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1440 [GMT 3:00] Running from: C:\ComboFix.exe WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((( Files Created from 2008-05-12 to 2008-06-12 ))))))))))))))))))))))))))))))) . 2008-06-12 17:41 . 2008-06-12 18:09 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-06-12 17:41 . 2008-06-12 17:41 <DIR> d-------- C:\Documents and Settings\Craphe\Application Data\Malwarebytes 2008-06-12 17:41 . 2008-06-12 17:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-06-12 17:41 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-06-12 17:41 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-06-12 17:32 . 2008-06-12 18:12 1,831,870 --a------ C:\ComboFix.exe 2008-06-12 17:29 . 2008-06-12 17:29 1,628,032 --a------ C:\mbam-setup.exe 2008-06-12 11:55 . 2008-06-12 11:55 <DIR> d-------- C:\Program Files\Sunbelt Software 2008-06-12 11:47 . 2008-06-12 11:47 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE 2008-06-12 10:54 . 2008-06-12 11:50 2,232 --a------ C:\is15932.exe 2008-06-12 10:47 . 2008-06-12 11:47 <DIR> d-------- C:\Program Files\Common Files\Agnitum Shared 2008-06-12 10:47 . 2008-06-12 10:47 <DIR> d-------- C:\Program Files\Agnitum 2008-06-12 10:46 . 2008-06-12 10:46 2,617,008 --a------ C:\OutpostInstall.exe 2008-06-12 10:07 . 2008-06-12 10:07 <DIR> d-------- C:\Program Files\Omat 2008-06-11 22:07 . 2008-06-11 22:07 244 --ah----- C:\sqmnoopt03.sqm 2008-06-11 22:07 . 2008-06-11 22:07 232 --ah----- C:\sqmdata03.sqm 2008-06-11 17:34 . 2008-06-11 17:34 2,232 --a------ C:\mzdza.exe 2008-06-11 11:30 . 2008-04-14 14:01 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-11 10:53 . 2008-06-11 10:53 2,402,320 --a------ C:\WLinstaller.exe 2008-06-11 10:50 . 2008-06-11 10:50 2,232 --a------ C:\is155815.exe 2008-06-10 22:09 . 2008-06-10 22:25 115,215 --a------ C:\sexy.exe 2008-06-08 23:10 . 2008-06-09 17:31 29,342 --a------ C:\Documents and Settings\Craphe\ps.exe 2008-06-08 23:07 . 2008-06-09 17:25 29,342 -r-hs---- C:\WINDOWS\winudmr.exe 2008-06-08 23:03 . 2008-06-08 23:03 29,339 -r-hs---- C:\WINDOWS\winudpmr.exe 2008-05-12 15:06 . 2008-05-12 15:06 <DIR> d-------- C:\WINDOWS\Sun . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-12 14:34 --------- d-----w C:\Program Files\mIRC 2008-06-12 07:41 --------- d-----w C:\Documents and Settings\Craphe\Application Data\uTorrent 2008-06-11 21:39 --------- d-----w C:\Program Files\Spyware Terminator 2008-06-11 21:38 --------- d-----w C:\Documents and Settings\Craphe\Application Data\Spyware Terminator 2008-06-11 07:54 --------- d-----w C:\Program Files\Windows Live 2008-06-11 07:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-06-09 16:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spyware Terminator 2008-06-07 06:43 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-06-02 15:40 --------- d-----w C:\Documents and Settings\Craphe\Application Data\MSN6 2008-05-12 13:55 --------- d-----w C:\Program Files\RevConnect 2008-05-11 11:34 --------- d-----w C:\Program Files\TVUPlayer 2008-05-11 11:33 --------- d-----w C:\Documents and Settings\Craphe\Application Data\TVU Networks 2008-05-11 11:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\TVU Networks 2008-05-11 11:28 690,648 ----a-w C:\installer-71203-864fi-TVuPlayer.exe 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-02 12:45 --------- d-----w C:\Documents and Settings\Craphe\Application Data\Apple Computer 2008-04-28 20:23 --------- d-----w C:\Program Files\Common Files\DirectX 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-15 10:50 --------- d-----w C:\Program Files\Java 2008-04-14 11:01 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-04-09 13:54 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-03-27 15:40 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll 2008-03-27 15:40 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll 2008-03-27 15:40 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll 2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys 2006-03-20 12:37 5,689,344 ----a-w C:\Program Files\mplayerc.exe 2007-06-13 10:23 115,215 --sh--r C:\WINDOWS\system32\svho.exe 2007-08-10 18:40 84,997 --sha-w C:\WINDOWS\system32\sys_\klog.dat . ((((((((((((((((((((((((((((( snapshot@2008-06-12_10.55.13,51 ))))))))))))))))))))))))))))))))))))))))) . + 2008-06-12 08:47:51 2,560 ----a-w C:\WINDOWS\_MSRSTRT.EXE - 2008-06-11 19:24:13 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-06-12 14:38:32 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-06-12 08:55:04 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\ARPPRODUCTICON.exe + 2008-06-12 08:55:04 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\NewShortcut1_E659E0EE10E649B7869660F38D0EB174.exe + 2008-06-12 08:55:04 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\NewShortcut2_8315396A5EA1419DBEC4978284BDF556.exe + 2007-04-26 07:21:30 302,000 ----a-w C:\WINDOWS\system32\drivers\fwdrv.sys + 2007-04-26 07:21:34 72,624 ----a-w C:\WINDOWS\system32\drivers\khips.sys - 2008-06-11 19:29:00 59,916 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-06-12 14:43:08 59,916 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-06-11 19:29:00 397,696 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-06-12 14:43:08 397,696 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-06-12 14:38:42 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_190.dat + 2008-06-12 14:39:02 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_654.dat + 2008-06-12 14:38:59 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_764.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{32D0DDCA-0684-4879-B24B-2E8CB00FDC52}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:56 15360] "LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-08-08 22:26 67128] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-04 01:29 165784] "NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-07-03 12:32 81920] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 02:19 79224] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776] "nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "NWEReboot"="" [] "Name of App"="C:\Program Files\SAMSUNG\FW LiveUpdate\FWManager.exe" [2008-05-23 14:51 688217] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-15 01:22 35328] "SoundMan"="SOUNDMAN.EXE" [2004-11-15 13:20 77824 C:\WINDOWS\SOUNDMAN.EXE] "ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 17:34 213936] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "SpywareTerminator"="C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe" [2007-11-04 01:09 2834432] "CTHelper"="CTHELPER.EXE" [2005-08-08 01:10 16384 C:\WINDOWS\CTHELPER.EXE] "CTxfiHlp"="CTXFIHLP.EXE" [2005-08-08 01:10 18944 C:\WINDOWS\system32\CTXFIHLP.EXE] "CTDVDDET"="C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [2003-06-18 02:00 45056] "RCSystem"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 19:25 49152] "AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 19:25 49152] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00 90112] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048] "Windows Control Center"="winudpmr.exe" [2008-06-08 23:03 29339 C:\WINDOWS\winudpmr.exe] "Windows Controls Center"="winudmr.exe" [2008-06-09 17:25 29342 C:\WINDOWS\winudmr.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 10:56 15360] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-08-08 22:26:13 67128] Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-08-04 16:03:32 450560] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 13:01:04 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnnOgDt] pmnnOgDt.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\RevConnect\\DCPlusPlus.exe"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "D:\\Games\\Supreme Commander\\bin\\SupremeCommander.exe"= "D:\\Games\\GPGNet\\GPG.Multiplayer.Client.exe"= "C:\\Program Files\\Hamachi\\hamachi.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "D:\\Games\\WorldInConflict\\wic.exe"= "D:\\Games\\WorldInConflict\\wic_online.exe"= "D:\\Games\\WorldInConflict\\wic_ds.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "D:\\Games\\Kane's Wrath\\RetailExe\\1.0\\cnc3ep1.dat"= "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"= "C:\\WINDOWS\\system32\\svho.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20] R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21] R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21] R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2007-11-04 01:11] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16] R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [2007-04-26 10:21] S3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2005-08-08 00:54] S3 PciCon;PciCon;D:\PciCon.sys [] . Contents of the 'Scheduled Tasks' folder "2008-06-11 09:20:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-12 18:17:47 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-06-12 18:20:02 ComboFix-quarantined-files.txt 2008-06-12 15:19:52 ComboFix2.txt 2008-06-12 07:56:24 Pre-Run: 51,435,384,832 bytes free Post-Run: 51,427,217,408 bytes free 179 --- E O F --- 2008-06-11 18:03:20 Malwarebytes' Anti-Malware 1.17 Database version: 850 18:09:06 12.6.2008 mbam-log-6-12-2008 (18-09-01).txt Scan type: Full Scan (C:\|D:\|E:\|F:\|G:\|H:\|) Objects scanned: 112622 Time elapsed: 23 minute(s), 3 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 43 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP582\A0072363.exe (Trojan.Agent) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP627\A0079759.com (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP627\A0079778.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP627\A0079781.com (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP627\A0079782.com (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP627\A0079786.com (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP627\A0079787.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP627\A0079788.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP627\A0079789.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP627\A0079790.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP627\A0079814.com (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP628\A0080890.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0082972.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0082974.com (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0082978.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083023.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083025.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083026.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083027.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083028.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083029.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083030.com (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083031.com (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083032.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083033.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083034.com (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083035.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083042.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083043.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083118.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083119.exe (Trojan.Agent) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083141.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083142.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083143.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083144.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083168.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP629\A0083172.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP630\A0083235.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP632\A0083470.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP632\A0083478.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP632\A0083479.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP632\A0083480.exe (Backdoor.Bot) -> No action taken. C:\System Volume Information\_restore{8D63A5F6-24A6-48C3-B19F-C1F30C6F92B8}\RP632\A0083493.exe (Backdoor.Bot) -> No action taken. Ja tossa kaikki, tein kaikki neuvojen mukaan... Toivottavasti on puhdasta!
==>> Craphe Avaa Muistio ja kopioi/liitä Lainaus: laatikon sisältö sinne: Tallenna nimellä CFScript (itse asiassa combofix tunnistaa tuon vaikka tiedostopääte ei olisi edes .txt). Sitten raahaa ja pudota CFScript ComboFix.exeen kuten alla.(Älä klikkaa) Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne. Lähetä => (C:\ComboFix.txt) .
ComboFix 08-06-10.5 - Craphe 2008-06-12 23:35:42.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1515 [GMT 3:00] Running from: C:\ComboFix.exe Command switches used :: C:\CFScript.txt * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! FILE :: C:\is155815.exe C:\is15932.exe C:\sexy.exe C:\WINDOWS\winudmr.exe C:\WINDOWS\winudpmr.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\winudmr.exe C:\WINDOWS\winudpmr.exe . ((((((((((((((((((((((((( Files Created from 2008-05-12 to 2008-06-12 ))))))))))))))))))))))))))))))) . 2008-06-12 17:41 . 2008-06-12 18:09 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-06-12 17:41 . 2008-06-12 17:41 <DIR> d-------- C:\Documents and Settings\Craphe\Application Data\Malwarebytes 2008-06-12 17:41 . 2008-06-12 17:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-06-12 17:41 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-06-12 17:41 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-06-12 17:32 . 2008-06-12 18:12 1,831,870 --a------ C:\ComboFix.exe 2008-06-12 17:29 . 2008-06-12 17:29 1,628,032 --a------ C:\mbam-setup.exe 2008-06-12 11:55 . 2008-06-12 11:55 <DIR> d-------- C:\Program Files\Sunbelt Software 2008-06-12 11:47 . 2008-06-12 11:47 2,560 --a------ C:\WINDOWS\_MSRSTRT.EXE 2008-06-12 10:47 . 2008-06-12 11:47 <DIR> d-------- C:\Program Files\Common Files\Agnitum Shared 2008-06-12 10:47 . 2008-06-12 10:47 <DIR> d-------- C:\Program Files\Agnitum 2008-06-12 10:46 . 2008-06-12 10:46 2,617,008 --a------ C:\OutpostInstall.exe 2008-06-12 10:07 . 2008-06-12 10:07 <DIR> d-------- C:\Program Files\Omat 2008-06-11 22:07 . 2008-06-11 22:07 244 --ah----- C:\sqmnoopt03.sqm 2008-06-11 22:07 . 2008-06-11 22:07 232 --ah----- C:\sqmdata03.sqm 2008-06-11 11:30 . 2008-04-14 14:01 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-08 23:10 . 2008-06-09 17:31 29,342 --a------ C:\Documents and Settings\Craphe\ps.exe 2008-05-12 15:06 . 2008-05-12 15:06 <DIR> d-------- C:\WINDOWS\Sun . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-12 20:32 --------- d-----w C:\Program Files\mIRC 2008-06-12 07:41 --------- d-----w C:\Documents and Settings\Craphe\Application Data\uTorrent 2008-06-11 21:39 --------- d-----w C:\Program Files\Spyware Terminator 2008-06-11 21:38 --------- d-----w C:\Documents and Settings\Craphe\Application Data\Spyware Terminator 2008-06-11 07:54 --------- d-----w C:\Program Files\Windows Live 2008-06-11 07:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-06-09 16:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spyware Terminator 2008-06-07 06:43 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-06-02 15:40 --------- d-----w C:\Documents and Settings\Craphe\Application Data\MSN6 2008-05-12 13:55 --------- d-----w C:\Program Files\RevConnect 2008-05-11 11:34 --------- d-----w C:\Program Files\TVUPlayer 2008-05-11 11:33 --------- d-----w C:\Documents and Settings\Craphe\Application Data\TVU Networks 2008-05-11 11:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\TVU Networks 2008-05-11 11:28 690,648 ----a-w C:\installer-71203-864fi-TVuPlayer.exe 2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys 2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll 2008-05-02 12:45 --------- d-----w C:\Documents and Settings\Craphe\Application Data\Apple Computer 2008-04-28 20:23 --------- d-----w C:\Program Files\Common Files\DirectX 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-04-15 10:50 --------- d-----w C:\Program Files\Java 2008-04-14 11:01 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-04-09 13:54 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-03-27 15:40 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll 2008-03-27 15:40 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll 2008-03-27 15:40 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll 2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys 2006-03-20 12:37 5,689,344 ----a-w C:\Program Files\mplayerc.exe 2007-06-13 10:23 115,215 --sh--r C:\WINDOWS\system32\svho.exe 2007-08-10 18:40 84,997 --sha-w C:\WINDOWS\system32\sys_\klog.dat . ((((((((((((((((((((((((((((( snapshot@2008-06-12_10.55.13,51 ))))))))))))))))))))))))))))))))))))))))) . + 2008-06-12 08:47:51 2,560 ----a-w C:\WINDOWS\_MSRSTRT.EXE - 2008-06-11 19:24:13 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-06-12 20:27:14 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-06-12 08:55:04 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\ARPPRODUCTICON.exe + 2008-06-12 08:55:04 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\NewShortcut1_E659E0EE10E649B7869660F38D0EB174.exe + 2008-06-12 08:55:04 18,718 ----a-r C:\WINDOWS\Installer\{BFD080F6-3BF0-40E1-9507-9CA969C35870}\NewShortcut2_8315396A5EA1419DBEC4978284BDF556.exe + 2007-04-26 07:21:30 302,000 ----a-w C:\WINDOWS\system32\drivers\fwdrv.sys + 2007-04-26 07:21:34 72,624 ----a-w C:\WINDOWS\system32\drivers\khips.sys - 2008-06-11 19:29:00 59,916 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-06-12 20:32:34 59,916 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-06-11 19:29:00 397,696 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-06-12 20:32:34 397,696 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-06-12 20:27:24 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_19c.dat + 2008-06-12 20:28:37 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_1e0.dat + 2008-06-12 20:28:11 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_39c.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:56 15360] "LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-08-08 22:26 67128] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-04 01:29 165784] "NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-07-03 12:32 81920] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 02:19 79224] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776] "NWEReboot"="" [] "Name of App"="C:\Program Files\SAMSUNG\FW LiveUpdate\FWManager.exe" [2008-05-23 14:51 688217] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-15 01:22 35328] "SoundMan"="SOUNDMAN.EXE" [2004-11-15 13:20 77824 C:\WINDOWS\SOUNDMAN.EXE] "ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 17:34 213936] "SpywareTerminator"="C:\PROGRA~1\SPYWAR~1\SpywareTerminatorShield.exe" [2007-11-04 01:09 2834432] "CTHelper"="CTHELPER.EXE" [2005-08-08 01:10 16384 C:\WINDOWS\CTHELPER.EXE] "CTxfiHlp"="CTXFIHLP.EXE" [2005-08-08 01:10 18944 C:\WINDOWS\system32\CTXFIHLP.EXE] "CTDVDDET"="C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [2003-06-18 02:00 45056] "RCSystem"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 19:25 49152] "AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 19:25 49152] "UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00 90112] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 10:56 15360] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-08-08 22:26:13 67128] Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-08-04 16:03:32 450560] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 13:01:04 83360] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\RevConnect\\DCPlusPlus.exe"= "C:\\Program Files\\mIRC\\mirc.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"= "D:\\Games\\Supreme Commander\\bin\\SupremeCommander.exe"= "D:\\Games\\GPGNet\\GPG.Multiplayer.Client.exe"= "C:\\Program Files\\Hamachi\\hamachi.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "D:\\Games\\WorldInConflict\\wic.exe"= "D:\\Games\\WorldInConflict\\wic_online.exe"= "D:\\Games\\WorldInConflict\\wic_ds.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "D:\\Games\\Kane's Wrath\\RetailExe\\1.0\\cnc3ep1.dat"= "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"= "C:\\WINDOWS\\system32\\svho.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20] R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 10:21] R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 10:21] R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2007-11-04 01:11] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16] R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [2007-04-26 10:21] S3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2005-08-08 00:54] S3 PciCon;PciCon;D:\PciCon.sys [] . Contents of the 'Scheduled Tasks' folder "2008-06-11 09:20:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-12 23:39:40 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-06-12 23:42:30 ComboFix-quarantined-files.txt 2008-06-12 20:41:53 ComboFix2.txt 2008-06-12 15:20:04 ComboFix3.txt 2008-06-12 07:56:24 Pre-Run: 51,399,081,984 bytes free Post-Run: 51,391,307,776 bytes free 175 --- E O F --- 2008-06-11 18:03:20
Oikein hyvä !!! Roskat vain pois ja menoksi. ****************************************** Kirjoita windowsin käynnistävalikon suorita-kenttään ComboFix.exe /u paina OK *************************************************************************** ****************************************** Käynnistä Malwarebytes Karanteeni välileti ja tyhjennä roskat. ********************************************************************* .
