Miltä tämä vaikuttaa?

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by hietanen1, Feb 26, 2009.

  1. hietanen1

    hietanen1 Member

    Joined:
    Feb 26, 2009
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:49:17, on 26.2.2009
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\IDT\WDM\sttray.exe
    C:\Program Files\HP\QuickPlay\QPService.exe
    C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
    C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Program Files\Mozilla Thunderbird\thunderbird.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Windows\system32\SearchFilterHost.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=83&bd=Pavilion&pf=cnnb
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=83&bd=Pavilion&pf=cnnb
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=83&bd=Pavilion&pf=cnnb
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=83&bd=Pavilion&pf=cnnb
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O3 - Toolbar: wvfsrqab - {4B87885D-104A-4C24-A9BB-7D795B8039A2} - C:\Users\Antti\AppData\Local\Temp\ac8zt2\wvfsrqab.dll (file missing)
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
    O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\2.0"
    O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
    O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f691e717\aestsrv.exe
    O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
    O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    O23 - Service: HP Service (hpsrv) - Hewlett-Packard Corporation - C:\Windows\system32\Hpservice.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
    O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
    O23 - Service: Recovery Service for Windows - Unknown owner - C:\Windows\SMINST\BLService.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
    O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE
    O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_f691e717\STacSV.exe
    O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

    --
    End of file - 9580 bytes
     
    hietanen1, Feb 26, 2009
    #1
  2. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina Fix checked

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

    ===============

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi
     
    Hujo, Feb 26, 2009
    #2
  3. hietanen1

    hietanen1 Member

    Joined:
    Feb 26, 2009
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    Latasin ja asensin tuon Malwarebytes' Anti-Malwaren. Skannaus kuitenkin jumittaa koko koneen aina noin tunnin kuluttua sen aloittamisesta, joten en saa skannausta suoritettua loppuun. Mitäköhän sille voisi tehdä?
     
    hietanen1, Mar 1, 2009
    #3
  4. Hujo

    Hujo Guest

    1.Lataa Combofix.exe työpöydällesi yhdestä linkistä:
    Combofix1
    Combofix2

    Älä asenna Palautus consolia
    2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, Mar 1, 2009
    #4
  5. hietanen1

    hietanen1 Member

    Joined:
    Feb 26, 2009
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    Lopulta sainkin suoritettua sen skannauksen Anti-Malwarella loppuun. Tällaista tuli:

    Malwarebytes' Anti-Malware 1.34
    Tietokantaversio: 1813
    Windows 6.0.6001 Service Pack 1

    1.3.2009 22:23:34
    mbam-log-2009-03-01 (22-23-34).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|)
    Tarkistetut kohteet: 260210
    Kulunut aika: 3 hour(s), 23 minute(s), 44 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 3
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 2

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    HKEY_CLASSES_ROOT\wvfsrqab.bfba (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\wvfsrqab.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WebVideo (Trojan.FakeAlert) -> Quarantined and deleted successfully.

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    C:\Users\Antti\AppData\Local\Temp\pwrmgr.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Users\Antti\AppData\Local\Temp\s1402.php (Trojan.FakeAlert) -> Quarantined and deleted successfully.
     
    hietanen1, Mar 1, 2009
    #5
  6. Hujo

    Hujo Guest

    ajas tuo combofix
     
    Hujo, Mar 2, 2009
    #6
  7. hietanen1

    hietanen1 Member

    Joined:
    Feb 26, 2009
    Messages:
    11
    Likes Received:
    0
    Trophy Points:
    11
    Combofix antoi seuraavat:

    ComboFix 09-02-28.01 - Antti 2009-03-02 11:59:37.1 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1035.18.3069.1999 [GMT 2:00]
    Sijainti: c:\users\Antti\Downloads\ComboFix.exe
    AV: Symantec Endpoint Protection *On-access scanning disabled* (Updated)
    FW: Symantec Endpoint Protection *disabled*
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-02-02 to 2009-03-02 )))))))))))))))))
    .

    2009-03-01 18:57 . 2009-03-01 18:57 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
    2009-03-01 18:57 . 2009-02-11 10:19 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
    2009-03-01 18:57 . 2009-02-11 10:19 15,504 --a------ c:\windows\System32\drivers\mbam.sys
    2009-02-27 10:14 . 2009-02-27 10:14 <KANSIO> d-------- c:\users\Antti\AppData\Roaming\Malwarebytes
    2009-02-27 10:13 . 2009-02-27 10:13 <KANSIO> d-------- c:\users\All Users\Malwarebytes
    2009-02-27 10:13 . 2009-02-27 10:13 <KANSIO> d-------- c:\programdata\Malwarebytes
    2009-02-26 20:48 . 2009-02-26 20:48 <KANSIO> d-------- c:\program files\Trend Micro
    2009-02-22 12:29 . 2009-02-22 12:29 0 --ah----- c:\windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
    2009-02-15 11:02 . 2009-02-15 11:02 <KANSIO> d-------- c:\users\All Users\Apple Computer
    2009-02-15 11:02 . 2009-02-15 11:02 <KANSIO> d-------- c:\programdata\Apple Computer
    2009-02-15 11:02 . 2009-02-15 11:03 <KANSIO> d-------- c:\program files\QuickTime
    2009-02-15 11:01 . 2009-02-15 11:01 <KANSIO> d-------- c:\users\All Users\Apple
    2009-02-15 11:01 . 2009-02-15 11:01 <KANSIO> d-------- c:\programdata\Apple
    2009-02-15 11:01 . 2009-02-15 11:01 <KANSIO> d-------- c:\program files\Apple Software Update
    2009-02-15 03:15 . 2009-02-15 03:15 <KANSIO> d-------- c:\users\Antti\fontconfig
    2009-02-15 02:55 . 2009-02-15 02:59 <KANSIO> d-------- c:\users\Antti\AppData\Roaming\vlc
    2009-02-15 02:54 . 2009-02-15 02:54 <KANSIO> d-------- c:\program files\VideoLAN
    2009-02-15 02:48 . 2008-12-05 06:32 428,544 --a------ c:\windows\System32\EncDec.dll
    2009-02-15 02:48 . 2008-12-05 06:32 293,376 --a------ c:\windows\System32\psisdecd.dll
    2009-02-15 02:48 . 2008-12-05 06:31 217,088 --a------ c:\windows\System32\psisrndr.ax
    2009-02-15 02:48 . 2008-12-05 06:31 177,664 --a------ c:\windows\System32\mpg2splt.ax
    2009-02-15 02:48 . 2008-12-05 06:31 80,896 --a------ c:\windows\System32\MSNP.ax
    2009-02-12 07:49 . 2009-01-15 05:36 1,383,424 --a------ c:\windows\System32\mshtml.tlb
    2009-02-12 07:49 . 2009-01-15 08:11 827,392 --a------ c:\windows\System32\wininet.dll
    2009-02-06 13:43 . 2009-02-06 13:44 <KANSIO> d--h----- c:\users\Antti\Nauhoitetut
    2009-02-02 10:47 . 2009-02-02 10:47 <KANSIO> d-------- c:\users\Antti\AppData\Roaming\Nitro PDF
    2009-02-02 10:46 . 2009-02-02 10:46 <KANSIO> d-------- c:\users\All Users\Nitro PDF
    2009-02-02 10:46 . 2009-02-02 10:46 <KANSIO> d-------- c:\programdata\Nitro PDF

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-03-01 21:00 --------- d-----w c:\users\Antti\AppData\Roaming\Skype
    2009-03-01 15:59 --------- d-----w c:\users\Antti\AppData\Roaming\skypePM
    2009-02-28 11:10 --------- d-----w c:\users\Antti\AppData\Roaming\uTorrent
    2009-02-25 15:59 --------- d-----w c:\users\Antti\AppData\Roaming\SSH
    2009-02-15 00:59 --------- d-----w c:\users\Antti\AppData\Roaming\vlc
    2009-02-12 20:35 --------- d-----w c:\program files\Windows Mail
    2009-01-26 18:26 --------- d--h--w c:\program files\InstallShield Installation Information
    2009-01-26 18:23 --------- d-----w c:\program files\Hewlett-Packard
    2009-01-20 18:44 149,760 ----a-w c:\windows\system32\drivers\WpsHelper.sys
    2009-01-13 16:33 --------- d-----w c:\program files\EA GAMES
    2009-01-04 23:07 --------- d-----w c:\program files\EGCS
    2009-01-04 23:06 --------- d-----w c:\program files\PSCAD421Eval
    2008-12-17 20:19 410,984 ----a-w c:\windows\System32\deploytk.dll
    2008-10-04 08:05 56 ---ha-w c:\users\All Users\ezsidmv.dat
    2008-10-04 08:05 56 ---ha-w c:\programdata\ezsidmv.dat
    2008-01-21 02:43 174 --sha-w c:\program files\desktop.ini
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
    "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
    "ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-01-17 1033512]
    "SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2008-04-16 442433]
    "UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2007-12-25 222504]
    "QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2008-05-15 468264]
    "QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-03-14 202032]
    "OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-11-02 554288]
    "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-11-20 488752]
    "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-09-12 36352]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
    "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-02-01 115560]
    "HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-16 75008]

    c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-10-29 805392]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.l3codecp"= l3codecp.acm

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
    @="Service"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
    @="Service"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
    @="Service"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{77EE5ECE-F6EA-460F-8BA9-66AF7E5ED80F}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
    "{1F154C7C-27EB-4171-AB63-7DC5A2BA90EC}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
    "{A7B725BE-FF70-4A2B-8480-BD3DD5C33BFC}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
    "{F8DAD64C-20F2-4460-A71A-4F50E26326E3}"= c:\program files\Skype\Phone\Skype.exe:Skype
    "{CFAC2EC6-DAE6-41BE-8CCD-25D97EB8F67F}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
    "{0F84FED9-A7BF-43F7-8C1D-D908BD6A2440}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
    "{9F4ADCC4-9A4F-488D-A3BF-767BD595256A}"= UDP:c:\program files\Symantec\Symantec Endpoint Protection\Smc.exe:SMC Service
    "{0D07FC5E-7CAD-497B-AF98-E5F61AA631FA}"= TCP:c:\program files\Symantec\Symantec Endpoint Protection\Smc.exe:SMC Service
    "{EBBF9490-24D3-4FB5-B8CE-428073835719}"= UDP:c:\program files\Symantec\Symantec Endpoint Protection\SNAC.EXE:SNAC Service
    "{F31A9EA5-830A-46BB-96E5-50FEEEA1736E}"= TCP:c:\program files\Symantec\Symantec Endpoint Protection\SNAC.EXE:SNAC Service
    "{E14541E5-3756-4AC2-8891-3F0C4DB4AC93}"= UDP:c:\program files\Common Files\Symantec Shared\ccApp.exe:Symantec Email
    "{752C0A55-7239-423E-8866-61F12FB8B8C3}"= TCP:c:\program files\Common Files\Symantec Shared\ccApp.exe:Symantec Email
    "{D49A0AF8-AD68-40DA-B9A5-F9819B6DC7BC}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
    "{851929C8-9F8D-4D53-A40A-FC9202EB7B45}"= UDP:c:\program files\PSCAD421Eval\bin\win\PSCAD.exe:pSCAD
    "{DE8375E5-E640-4B30-9398-E6D08DBC652E}"= TCP:c:\program files\PSCAD421Eval\bin\win\PSCAD.exe:pSCAD

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
    "DoNotAllowExceptions"= 1 (0x1)

    R0 Amddfltr;Amd Disk Lower Filter Driver;c:\windows\System32\drivers\Amddfltr.sys [2008-07-26 15416]
    R2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt.inf_f691e717\AEstSrv.exe [2008-07-26 73728]
    R2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe -k netsvcs [2008-01-21 21504]
    R2 hpsrv;HP Service;c:\windows\System32\hpservice.exe [2008-03-19 19456]
    R2 Recovery Service for Windows;Recovery Service for Windows;c:\windows\SMINST\BLService.exe [2008-06-07 341328]
    R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-06-07 193840]
    R3 enecir;ENE CIR Receiver;c:\windows\System32\drivers\enecir.sys [2008-01-23 52736]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2009-02-26 101936]
    R3 JMCR;JMCR;c:\windows\System32\drivers\jmcr.sys [2008-04-01 81296]
    S3 COH_Mon;COH_Mon;c:\windows\System32\drivers\COH_Mon.sys [2007-05-29 23888]

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    ezSharedSvc

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
    "c:\program files\Common Files\LightScribe\LSRunOnce.exe"
    .
    'Ajoitetut tehtävät'-kansion sisältö

    2009-03-01 c:\windows\Tasks\User_Feed_Synchronization-{EAEEEA80-322E-4F31-BBAC-5C947A026390}.job
    - c:\windows\system32\msfeedssync.exe [2008-01-21 04:24]
    .
    - - - - POISTETUT JÄMÄRIVIT - - - -

    SafeBoot-Symantec Antvirus


    .
    ------- Täydentävä tarkistus -------
    .
    uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=83&bd=Pavilion&pf=cnnb
    uDefault_Search_URL = hxxp://www.google.com/ie
    mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=fi_fi&c=83&bd=Pavilion&pf=cnnb
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: Vie Microsoft E&xceliin - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    FF - ProfilePath - c:\users\Antti\AppData\Roaming\Mozilla\Firefox\Profiles\6qja2xb4.default\
    FF - prefs.js: browser.startup.homepage - www.tut.fi/haavi
    FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
    FF - plugin: c:\program files\Picasa2\npPicasa2.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-03-02 12:03:07
    Windows 6.0.6001 Service Pack 1 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************
    .
    --------------------- Prosesseihin ladatut DLLt ---------------------

    - - - - - - - > 'Explorer.exe'(5448)
    c:\program files\Logitech\SetPoint\lgscroll.dll
    .
    Valmistumisajankohta: 2009-03-02 12:05:19
    ComboFix-quarantined-files.txt 2009-03-02 10:05:12

    Ennen ajoa: 159,850,078,208 tavua vapaana
    Ajon jälkeen: 159,582,965,760 tavua vapaana

    173 --- E O F --- 2009-02-15 01:00:48
     
    hietanen1, Mar 2, 2009
    #7
  8. Hujo

    Hujo Guest

    Kirjoita suorita luukkuun

    ComboFix /u

    Klikkaa OK
     
    Hujo, Mar 2, 2009
    #8

Share This Page