Messenger-virus + hjt logi

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by HeikkiN, Jun 10, 2008.

  1. HeikkiN

    HeikkiN Member

    Joined:
    Jun 10, 2008
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    11
    Eli tälläinen on päässyt minunkin riesaksi, Malwarebytes ei viirusta enään löydä mutta kone koittaa aina uudelleenkäynnistyksen jälkeen käynnistellä WINUDMR.exeä joka päätyy prosesseihin estosta huolimatta, tätä exeä en koneelta kuitenkaan löydä. Kiitoksia avusta jo etukäteen. Tässä logit:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:16, on 2008-06-10
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Norman\bin\ZLH.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\Program Files\D-Tools\daemon.exe
    C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Logitech\MouseWare\system\em_exec.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\CTsvcCDA.EXE
    C:\WINDOWS\System32\gearsec.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Norman\bin\ZANDA.EXE
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\mIRC\mirc.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    C:\Norman\bin\NJEEVES.EXE
    C:\PROGRA~1\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
    C:\WINDOWS\system32\CF8092.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\CF8092.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mail.yahoo.com/?.intl=us
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\AddOn\AcrobatReader\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
    O4 - HKLM\..\Run: [Zone Labs Client] C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\Run: [DataLayer] C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE
    O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
    O16 - DPF: {C3DFA998-A486-11D4-AA25-00C04F72DAEB} (MSN Photo Upload Tool) - http://sc.groups.msn.com/controls/PhotoUC/MsnPUpld.cab
    O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
    O23 - Service: Gear Security Service (GEARSecurity) - GEAR Software - C:\WINDOWS\System32\gearsec.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
    O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\bin\ZANDA.EXE
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
     
    HeikkiN, Jun 10, 2008
    #1
  2. HeikkiN

    HeikkiN Member

    Joined:
    Jun 10, 2008
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    11
    Tässä ComboFix logi:

    ComboFix 08-06-09.7 - Neuvonen 2008-06-10 19:57:29.1 - NTFSx86
    Running from: C:\Documents and Settings\Neuvonen\Työpöytä\ComboFix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-10 to 2008-06-10 )))))))))))))))))
    .

    2008-06-10 20:14 . 2008-06-10 20:14 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-06-10 18:57 . 2008-06-10 18:57 <KANSIO> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-06-10 18:57 . 2008-06-10 19:50 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-06-10 13:53 . 2008-06-10 13:53 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-06-10 13:53 . 2008-06-10 13:53 <KANSIO> d-------- C:\Documents and Settings\Neuvonen\Application Data\Malwarebytes
    2008-06-10 13:53 . 2008-06-10 13:53 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-06-10 13:53 . 2008-06-09 20:13 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-06-10 13:53 . 2008-06-09 20:13 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-06-09 00:37 . 2008-06-09 00:33 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
    2008-06-08 23:10 . 2008-06-08 23:09 29,342 -r-hs---- C:\WINDOWS\winudmr.exe

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-10 17:15 --------- d-----w C:\Program Files\mIRC
    2008-06-10 16:14 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
    2008-06-10 16:14 --------- d-----w C:\Program Files\SpywareBlaster
    2008-06-10 15:07 --------- d-----w C:\Program Files\Warcraft III
    2008-06-05 01:19 996,352 ----a-w C:\WINDOWS\Internet Logs\xDB109.tmp
    2008-06-05 01:19 4,186,112 ----a-w C:\WINDOWS\Internet Logs\xDB108.tmp
    2008-06-04 22:33 --------- d-----w C:\Documents and Settings\Neuvonen\Application Data\uTorrent
    2008-06-01 17:10 1,148,928 ----a-w C:\WINDOWS\Internet Logs\xDB107.tmp
    2008-06-01 17:09 4,183,040 ----a-w C:\WINDOWS\Internet Logs\xDB106.tmp
    2008-05-26 23:06 4,180,992 ----a-w C:\WINDOWS\Internet Logs\xDB105.tmp
    2008-05-24 22:09 4,176,896 ----a-w C:\WINDOWS\Internet Logs\xDB103.tmp
    2008-05-24 22:09 2,657,280 ----a-w C:\WINDOWS\Internet Logs\xDB104.tmp
    2008-04-25 10:46 595,968 ----a-w C:\WINDOWS\Internet Logs\xDB102.tmp
    2008-04-25 10:46 4,132,352 ----a-w C:\WINDOWS\Internet Logs\xDB101.tmp
    2008-04-22 15:09 695,808 ----a-w C:\WINDOWS\Internet Logs\xDB100.tmp
    2008-04-22 15:09 4,129,280 ----a-w C:\WINDOWS\Internet Logs\xDBFF.tmp
    2008-04-19 12:36 4,123,136 ----a-w C:\WINDOWS\Internet Logs\xDBFD.tmp
    2008-04-19 12:36 1,387,008 ----a-w C:\WINDOWS\Internet Logs\xDBFE.tmp
    2008-04-14 09:40 2,671,816 ----a-w C:\spywareblastersetup40.exe
    2008-04-11 12:31 4,109,312 ----a-w C:\WINDOWS\Internet Logs\xDBFB.tmp
    2008-04-11 12:31 22,528 ----a-w C:\WINDOWS\Internet Logs\xDBFC.tmp
    2008-04-11 12:24 4,111,872 ----a-w C:\WINDOWS\Internet Logs\xDBF9.tmp
    2008-04-11 12:24 1,748,992 ----a-w C:\WINDOWS\Internet Logs\xDBFA.tmp
    2008-04-06 18:08 4,098,560 ----a-w C:\WINDOWS\Internet Logs\xDBF7.tmp
    2008-04-06 18:08 323,072 ----a-w C:\WINDOWS\Internet Logs\xDBF8.tmp
    2008-04-04 08:01 4,096,000 ----a-w C:\WINDOWS\Internet Logs\xDBF5.tmp
    2008-04-04 08:01 1,091,584 ----a-w C:\WINDOWS\Internet Logs\xDBF6.tmp
    2008-03-27 18:53 792,064 ----a-w C:\WINDOWS\Internet Logs\xDBF2.tmp
    2008-03-27 18:53 4,071,936 ----a-w C:\WINDOWS\Internet Logs\xDBF1.tmp
    2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-21 18:50 4,036,096 ----a-w C:\WINDOWS\Internet Logs\xDBEF.tmp
    2008-03-21 18:50 2,657,792 ----a-w C:\WINDOWS\Internet Logs\xDBF0.tmp
    2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
    2005-12-19 16:23 48,933,632 ----a-w C:\Program Files\openofficeorg3.cab
    2005-12-19 16:23 2,778,030 ----a-w C:\Program Files\openofficeorg4.cab
    2005-12-19 16:21 6,143,581 ----a-w C:\Program Files\openofficeorg2.cab
    2005-12-19 16:21 17,835,069 ----a-w C:\Program Files\openofficeorg1.cab
    2005-12-19 16:13 3,121,152 ----a-w C:\Program Files\openofficeorg20.msi
    2005-12-19 16:13 217 ----a-w C:\Program Files\setup.ini
    2005-12-19 16:13 1,821,008 ----a-w C:\Program Files\instmsiw.exe
    2005-12-19 16:13 1,707,856 ----a-w C:\Program Files\instmsia.exe
    2004-11-10 17:24 58,528 ----a-w C:\Documents and Settings\Neuvonen\Application Data\GDIPFONTCACHEV1.DAT
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360]
    "Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 18:23 102400]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ATIModeChange"="Ati2mdxx.exe" [2001-09-05 08:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
    "Norman ZANDA"="C:\Norman\bin\ZLH.exe" [2006-05-31 11:22 135168]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2003-12-16 13:06 229376]
    "Zone Labs Client"="C:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe" [2004-02-17 18:01 693528]
    "Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-25 07:20 28672]
    "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2003-10-02 03:20 81920]
    "NeroCheck"="C:\WINDOWS\System32\\NeroCheck.exe" [2001-07-09 12:50 155648]
    "Logitech Utility"="Logi_MwX.Exe" [2003-12-11 12:50 20992 C:\WINDOWS\LOGI_MWX.EXE]
    "DataLayer"="C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE" [2004-09-23 11:33 1019392]
    "PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE" [2004-09-15 16:36 148992]
    "SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-06-30 17:56 2376928]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 02:19 79224]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-02-28 22:00 315392]
    "Windows Controls Center"="winudmr.exe" [2008-06-08 23:09 29342 C:\WINDOWS\winudmr.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 02:12 15360]

    C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2004-09-13 19:09:44 169472]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 12:01:04 83360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.I420"= i263_32.drv
    "vidc.DIV3"= DivXc32.dll
    "vidc.DIV4"= DivXc32f.dll
    "msacm.divxa32"= divxa32.acm
    "vidc.3iv2"= 3ivxVfWCodec.dll
    "VIDC.HFYU"= huffyuv.dll
    "VIDC.i263"= i263_32.drv
    "msacm.imc"= imc32.acm
    "VIDC.VP31"= vp31vfw.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\mIRC\\mirc.exe"=
    "C:\\Program Files\\Warcraft III\\war3.exe"=
    "C:\\Program Files\\Warcraft III\\lancraft.exe"=
    "C:\\Program Files\\K-Lite Codec Pack\\Media Player Classic\\mplayerc.exe"=
    "C:\\Program Files\\Windows Media Player\\wmplayer.exe"=
    "C:\\Program Files\\FlashFXP\\flashfxp.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\Soulseek\\slsk.exe"=
    "C:\\WINDOWS\\system32\\rtcshare.exe"=
    "C:\\Program Files\\uTorrent\\utorrent.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

    R0 pnpshark;pnpshark;C:\WINDOWS\system32\DRIVERS\pnpshark.sys [2003-10-02 04:16]
    R0 st3shark;st3shark;C:\WINDOWS\system32\DRIVERS\st3shark.sys [2003-09-27 15:37]
    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
    R2 Ndiskio;Ndiskio;c:\norman\nse\bin\ndiskio.sys [2003-05-13 11:38]
    R3 DP83815;National Semiconductor Corp. DP83815/816 NDIS 5.0 Miniport Driver;C:\WINDOWS\system32\DRIVERS\DP83815.SYS [2003-04-23 02:39]
    R3 NVCScheduler;Norman Virus Control Scheduler;C:\NORMAN\Nvc\BIN\NVCSCHED.EXE [2005-01-12 11:22]
    S3 FA312;NETGEAR FA330/FA312/FA311 Fast Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\FA312nd5.sys [2001-08-17 21:12]
    S3 nvcfsr;nvcfsr;C:\NORMAN\Nvc\BIN\nvcfsr.sys [2004-11-05 10:47]
    S3 nvcoafl51;nvcoafl51;C:\NORMAN\Nvc\BIN\nvcoafl51.sys [2005-05-13 15:20]
    S3 nvcoaft51;nvcoaft51;C:\NORMAN\Nvc\BIN\nvcoaft51.sys [2006-06-14 14:39]
    S3 nvcoarc51;nvcoarc51;C:\NORMAN\Nvc\BIN\nvcoarc51.sys [2005-05-13 15:10]
    S3 nvcoas;Norman Virus Control on-access component;C:\NORMAN\Nvc\BIN\nvcoas.exe [2006-06-15 12:42]
    S3 USBVSP;USBVSP;C:\WINDOWS\system32\drivers\Usbvsp.sys [2003-09-08 15:43]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
    \Shell\AutoRun\command - D:\autoplay.exe

    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-10 20:17:37
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-06-10 20:24:29
    ComboFix-quarantined-files.txt 2008-06-10 17:24:20

    Pre-Run: 5,552,721,920 tavua vapaana
    Post-Run: 5,687,492,608 tavua vapaana

    149 --- E O F --- 2008-06-09 12:03:12
     
    HeikkiN, Jun 10, 2008
    #2
  3. HeikkiN

    HeikkiN Member

    Joined:
    Jun 10, 2008
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    11
    Malwarebytes' Anti-Malware 1.16
    Tietokantaversio: 845

    21:44:23 10.6.2008
    mbam-log-6-10-2008 (21-44-23).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|)
    Tarkistetut kohteet: 107394
    Kulunut aika: 1 hour(s), 0 minute(s), 3 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)

    Malwarebytes ei löytänyt mitään, mistä johtuu että tuo exe silti pysyy prosessina ja koittaa ajaa sitä heti bootin jälkeen?

    Unohtu mainita että aijempi testi Malwarella näytti 3 tartuntaa mutta nyt ne on kadonnu...
     
    Last edited: Jun 10, 2008
    HeikkiN, Jun 10, 2008
    #3
  4. HeikkiN

    HeikkiN Member

    Joined:
    Jun 10, 2008
    Messages:
    7
    Likes Received:
    0
    Trophy Points:
    11
    winudmr.exe teki jälleen paluun prosesseihin uudelleenkäynnistyksen jälkeen, mikä tähän on neuvoksi? Jos joku kerkeäis katsomaan alkaa vähitellen sapettamaan tämä ongelma kun tuntuu että tuo exe saastuttaa satunnaisia tiedostoja?
     
    HeikkiN, Jun 11, 2008
    #4

Share This Page