MSN viruksen poistaminen käynnissä

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Haksu83, May 29, 2008.

  1. Haksu83

    Haksu83 Member

    Joined:
    May 29, 2008
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    Tyttökaveri asenteli...

    winudspm.exe poistettu, jos olis jotain muutakin

    HJ loki:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:07:15, on 29.5.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    E:\WINDOWS\System32\smss.exe
    E:\WINDOWS\system32\winlogon.exe
    E:\WINDOWS\system32\services.exe
    E:\WINDOWS\system32\lsass.exe
    E:\WINDOWS\system32\svchost.exe
    E:\WINDOWS\System32\svchost.exe
    E:\WINDOWS\system32\spoolsv.exe
    E:\Program Files\F-Secure\Common\FSM32.EXE
    E:\WINDOWS\RTHDCPL.EXE
    E:\Program Files\D-Tools\daemon.exe
    E:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
    E:\WINDOWS\system32\RUNDLL32.EXE
    E:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    E:\Program Files\Winamp\winampa.exe
    E:\Program Files\Common Files\Real\Update_OB\realsched.exe
    E:\WINDOWS\system32\ctfmon.exe
    E:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    E:\Program Files\Messenger\msmsgs.exe
    E:\Program Files\OpenOffice.org 2.4\program\soffice.exe
    E:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
    E:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    E:\Program Files\F-Secure\Common\FSMA32.EXE
    E:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    E:\WINDOWS\system32\nvsvc32.exe
    E:\Program Files\F-Secure\Common\FSMB32.EXE
    E:\WINDOWS\system32\PnkBstrA.exe
    E:\WINDOWS\system32\svchost.exe
    E:\Program Files\F-Secure\Common\FCH32.EXE
    E:\Program Files\F-Secure\Common\FAMEH32.EXE
    E:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    E:\Program Files\F-Secure\Common\FNRB32.EXE
    E:\Program Files\F-Secure\FSGUI\fsguidll.exe
    E:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    E:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    E:\Program Files\F-Secure\Common\FIH32.EXE
    E:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    E:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    E:\WINDOWS\explorer.exe
    E:\WINDOWS\system32\notepad.exe
    E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - E:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - E:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - E:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O4 - HKLM\..\Run: [F-Secure Manager] "E:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "E:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [SSBkgdUpdate] "E:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
    O4 - HKLM\..\Run: [OpwareSE4] "E:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [WinampAgent] "E:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "E:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: OpenOffice.org 2.4.lnk = E:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://E:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://E:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://E:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://E:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1207138527674
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{8624B6F8-E781-43DF-AB3F-0447D5187140}: NameServer = 213.139.190.3 212.50.131.153
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - E:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - E:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - E:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - E:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - E:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - E:\WINDOWS\system32\PnkBstrA.exe

    --
    End of file - 7601 bytes

    Combofix:

    ComboFix 08-05-28.4 - Käyttäjä 2008-05-29 17:03:14.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.192 [GMT 3:00]
    Running from: E:\Documents and Settings\Käyttäjä\Työpöytä\ComboFix.exe
    Command switches used :: E:\Documents and Settings\Käyttäjä\Työpöytä\CFScript.txt
    * Created a new restore point
    * Resident AV is active


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-04-28 to 2008-05-29 )))))))))))))))))
    .

    2008-05-29 16:52 . 2008-05-29 16:52 <KANSIO> d-------- E:\Program Files\Trend Micro
    2008-05-29 15:57 . 2008-05-29 15:57 59,392 --a------ E:\WINDOWS\system32\geBqPIYp.dll
    2008-05-29 14:53 . 2008-05-29 14:52 56,832 -r-hs---- E:\WINDOWS\winudspm.exe
    2008-05-26 19:40 . 2008-05-26 19:53 <KANSIO> d-------- E:\Program Files\Widelands
    2008-05-25 23:48 . 2008-05-25 23:48 268 --ah----- E:\sqmdata07.sqm
    2008-05-25 23:48 . 2008-05-25 23:48 244 --ah----- E:\sqmnoopt07.sqm
    2008-05-24 23:04 . 2008-05-24 23:04 268 --ah----- E:\sqmdata06.sqm
    2008-05-24 23:04 . 2008-05-24 23:04 244 --ah----- E:\sqmnoopt06.sqm
    2008-05-24 14:03 . 2008-05-24 14:03 268 --ah----- E:\sqmdata05.sqm
    2008-05-24 14:03 . 2008-05-24 14:03 244 --ah----- E:\sqmnoopt05.sqm
    2008-05-22 23:43 . 2008-05-22 23:43 268 --ah----- E:\sqmdata04.sqm
    2008-05-22 23:43 . 2008-05-22 23:43 244 --ah----- E:\sqmnoopt04.sqm
    2008-05-18 21:45 . 2004-09-14 16:11 159,232 --a------ E:\WINDOWS\system32\ptpusd.dll
    2008-05-18 21:45 . 2001-10-05 16:31 5,632 --a------ E:\WINDOWS\system32\ptpusb.dll
    2008-05-11 20:00 . 2008-05-11 19:57 737,280 --a------ E:\WINDOWS\iun6002.exe
    2008-05-08 20:50 . 2008-05-08 20:50 <KANSIO> d-------- E:\Documents and Settings\Käyttäjä\Application Data\UFOAI
    2008-05-08 20:44 . 2008-05-08 20:58 <KANSIO> d-------- E:\Program Files\UFOAI-2.1.1
    2008-05-06 22:34 . 2008-05-06 22:34 268 --ah----- E:\sqmdata03.sqm
    2008-05-06 22:34 . 2008-05-06 22:34 244 --ah----- E:\sqmnoopt03.sqm
    2008-05-06 16:18 . 2008-05-06 16:18 <KANSIO> d-------- E:\Documents and Settings\Käyttäjä\Application Data\DivX

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-05-29 13:47 --------- d-----w E:\Documents and Settings\Käyttäjä\Application Data\OpenOffice.org2
    2008-05-27 16:43 23,352 ----a-w E:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-05-27 16:43 107,832 ----a-w E:\WINDOWS\system32\PnkBstrB.exe
    2008-04-26 11:02 --------- d-----w E:\Program Files\DivX
    2008-04-26 10:55 499,712 ----a-w E:\WINDOWS\system32\msvcp71.dll
    2008-04-26 10:55 348,160 ----a-w E:\WINDOWS\system32\msvcr71.dll
    2008-04-26 10:55 --------- d-----w E:\Program Files\Real
    2008-04-26 10:55 --------- d-----w E:\Program Files\Common Files\xing shared
    2008-04-26 10:55 --------- d-----w E:\Program Files\Common Files\Real
    2008-04-24 14:02 --------- d-----w E:\Documents and Settings\All Users\Application Data\nView_Profiles
    2008-04-23 11:27 --------- d-----w E:\Program Files\OpenOffice.org 2.4
    2008-04-13 18:06 --------- d-----w E:\Documents and Settings\Käyttäjä\Application Data\Canon
    2008-04-08 08:37 --------- d-----w E:\Documents and Settings\Käyttäjä\Application Data\Winamp
    2008-04-07 16:59 --------- d-----w E:\Program Files\MSXML 4.0
    2008-04-07 16:59 --------- d-----w E:\Program Files\Microsoft CAPICOM 2.1.0.2
    2008-04-07 16:26 --------- d-----w E:\Program Files\Java
    2008-04-07 16:23 --------- d-----w E:\Program Files\Common Files\Java
    2008-04-06 16:46 --------- dcsh--w E:\Program Files\Common Files\WindowsLiveInstaller
    2008-04-06 16:46 --------- d-----w E:\Program Files\Windows Live
    2008-04-06 16:39 --------- d-----w E:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-04-06 13:09 --------- d-----w E:\Program Files\Common Files\Adobe
    2008-04-06 11:36 --------- d-----w E:\Program Files\Canon
    2008-04-06 11:34 --------- d-----w E:\Program Files\Common Files\ScanSoft Shared
    2008-04-06 11:34 --------- d-----w E:\Program Files\Common Files\InstallShield
    2008-04-06 11:34 --------- d-----w E:\Documents and Settings\Käyttäjä\Application Data\ScanSoft
    2008-04-06 11:34 --------- d-----w E:\Documents and Settings\All Users\Application Data\ScanSoft
    2008-04-06 11:34 --------- d-----w E:\Documents and Settings\All Users\Application Data\InstallShield
    2008-04-06 11:33 --------- d-----w E:\Program Files\ScanSoft
    2008-04-06 11:32 --------- d--h--w E:\Program Files\InstallShield Installation Information
    2008-04-06 11:32 --------- d-----w E:\Program Files\ArcSoft
    2008-04-06 11:04 --------- d--h--w E:\Program Files\CanonBJ
    2008-04-06 11:04 --------- d--h--w E:\Documents and Settings\All Users\Application Data\CanonBJ
    2008-04-03 10:18 66,872 ----a-w E:\WINDOWS\system32\PnkBstrA.exe
    2008-04-02 12:03 --------- d-----w E:\Documents and Settings\Käyttäjä\Application Data\F-Secure
    2008-04-01 19:02 --------- d-----w E:\Program Files\Winamp
    2008-04-01 19:00 --------- d-----w E:\Program Files\DVD Shrink
    2008-04-01 19:00 --------- d-----w E:\Documents and Settings\All Users\Application Data\DVD Shrink
    2008-04-01 18:17 --------- d-----w E:\Program Files\Webteh
    2008-04-01 18:17 --------- d-----w E:\Program Files\AC3Filter
    2008-04-01 18:03 --------- d-----w E:\Program Files\D-Tools
    2008-04-01 17:31 --------- d-----w E:\Program Files\Realtek
    2008-04-01 17:22 --------- d-----w E:\Program Files\VIA
    2008-04-01 17:18 --------- d-----w E:\Program Files\AMD
    2008-04-01 16:56 --------- d-----w E:\Documents and Settings\All Users\Application Data\F-Secure
    2008-04-01 16:52 --------- d-----w E:\Program Files\F-Secure
    2008-04-01 16:37 --------- d-----w E:\Program Files\microsoft frontpage
    2008-03-31 21:25 831,488 ----a-w E:\WINDOWS\system32\divx_xx0a.dll
    2008-03-31 21:25 823,296 ----a-w E:\WINDOWS\system32\divx_xx0c.dll
    2008-03-31 21:25 823,296 ----a-w E:\WINDOWS\system32\divx_xx07.dll
    2008-03-31 21:25 802,816 ----a-w E:\WINDOWS\system32\divx_xx11.dll
    2008-03-31 21:25 682,496 ----a-w E:\WINDOWS\system32\DivX.dll
    2008-03-31 21:25 161,096 ----a-w E:\WINDOWS\system32\DivXCodecVersionChecker.exe
    2008-03-25 04:51 621,344 ----a-w E:\WINDOWS\system32\mswstr10.dll
    2008-03-25 04:51 166,688 ----a-w E:\WINDOWS\system32\msjint40.dll
    2008-03-21 20:30 524,288 ----a-w E:\WINDOWS\system32\DivXsm.exe
    2008-03-21 20:30 3,596,288 ----a-w E:\WINDOWS\system32\qt-dx331.dll
    2008-03-21 20:30 200,704 ----a-w E:\WINDOWS\system32\ssldivx.dll
    2008-03-21 20:30 129,784 ------w E:\WINDOWS\system32\pxafs.dll
    2008-03-21 20:30 120,056 ------w E:\WINDOWS\system32\pxcpyi64.exe
    2008-03-21 20:30 118,520 ------w E:\WINDOWS\system32\pxinsi64.exe
    2008-03-21 20:30 1,044,480 ----a-w E:\WINDOWS\system32\libdivx.dll
    2008-03-21 20:28 81,920 ----a-w E:\WINDOWS\system32\dpl100.dll
    2008-03-21 20:28 593,920 ----a-w E:\WINDOWS\system32\dpuGUI11.dll
    2008-03-21 20:28 57,344 ----a-w E:\WINDOWS\system32\dpv11.dll
    2008-03-21 20:28 53,248 ----a-w E:\WINDOWS\system32\dpuGUI10.dll
    2008-03-21 20:28 344,064 ----a-w E:\WINDOWS\system32\dpus11.dll
    2008-03-21 20:28 294,912 ----a-w E:\WINDOWS\system32\dpu11.dll
    2008-03-21 20:28 294,912 ----a-w E:\WINDOWS\system32\dpu10.dll
    2008-03-21 20:28 196,608 ----a-w E:\WINDOWS\system32\dtu100.dll
    2008-03-21 20:28 12,288 ----a-w E:\WINDOWS\system32\DivXWMPExtType.dll
    2008-03-20 08:09 1,845,504 ----a-w E:\WINDOWS\system32\win32k.sys
    2008-03-01 13:01 826,368 ----a-w E:\WINDOWS\system32\wininet.dll
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="E:\WINDOWS\system32\ctfmon.exe" [2006-03-02 15:00 15360]
    "MsnMsgr"="E:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
    "MSMSGS"="E:\Program Files\Messenger\msmsgs.exe" [2004-10-13 19:24 1694208]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "F-Secure Manager"="E:\Program Files\F-Secure\Common\FSM32.exe" [2008-02-15 18:46 182936]
    "F-Secure TNB"="E:\Program Files\F-Secure\FSGUI\TNBUtil.exe" [2008-02-15 18:46 895584]
    "RTHDCPL"="RTHDCPL.EXE" [2006-09-11 20:58 16264192 E:\WINDOWS\RTHDCPL.exe]
    "SkyTel"="SkyTel.EXE" [2006-05-15 22:04 2879488 E:\WINDOWS\SkyTel.exe]
    "NvCplDaemon"="E:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
    "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 E:\WINDOWS\system32\nwiz.exe]
    "DAEMON Tools-1033"="E:\Program Files\D-Tools\daemon.exe" [2004-03-12 22:43 81920]
    "SSBkgdUpdate"="E:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-30 00:14 155648]
    "OpwareSE4"="E:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe" [2006-03-21 13:19 69632]
    "NvMediaCenter"="E:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
    "Adobe Reader Speed Launcher"="E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
    "SunJavaUpdateSched"="E:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
    "WinampAgent"="E:\Program Files\Winamp\winampa.exe" [2008-03-27 09:35 36352]
    "TkBellExe"="E:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-26 13:55 185896]
    "Windows UDP Control"="winudspm.exe" [2008-05-29 14:52 56832 E:\WINDOWS\winudspm.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="E:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 15:00 15360]

    E:\Documents and Settings\K„ytt„j„\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    OpenOffice.org 2.4.lnk - E:\Program Files\OpenOffice.org 2.4\program\quickstart.exe [2008-03-16 17:54:44 393216]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "E:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "E:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

    R0 d346bus;d346bus;E:\WINDOWS\system32\DRIVERS\d346bus.sys [2004-03-12 22:41]
    R0 d346prt;d346prt;E:\WINDOWS\system32\Drivers\d346prt.sys [2004-03-12 22:41]
    R0 FSFW;F-Secure Firewall Driver;E:\WINDOWS\system32\drivers\fsdfw.sys [2008-02-15 18:45]
    R1 F-Secure HIPS;F-Secure HIPS;E:\Program Files\F-Secure\HIPS\fshs.sys [2008-02-15 18:46]
    R3 F-Secure Gatekeeper;F-Secure Gatekeeper;E:\Program Files\F-Secure\Anti-Virus\minifilter\fsgk.sys [2008-02-15 18:45]
    S4 F-Secure Filter;F-Secure File System Filter;E:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2008-02-15 18:45]
    S4 F-Secure Recognizer;F-Secure File System Recognizer;E:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2008-02-15 18:45]

    *Newly Created Service* - CATCHME

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{28ABC5C0-4FCB-11CF-AAX5-81CX1C635612}]
    C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-29 17:04:19
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-05-29 17:05:04
    ComboFix-quarantined-files.txt 2008-05-29 14:05:00
    ComboFix2.txt 2008-05-29 14:00:08

    Pre-Run: 14,502,170,624 tavua vapaana
    Post-Run: 14,496,362,496 tavua vapaana

    169 --- E O F --- 2008-05-28 09:29:24
     
    Haksu83, May 29, 2008
    #1
  2. Haksu83

    Haksu83 Member

    Joined:
    May 29, 2008
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    Ajettu anti-malmware ja SDFix... Jos joku viisaampi osaa sanoa joko ollaan kuivilla vai vieläkö löytyy:

    HJT:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:25:22, on 29.5.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    E:\WINDOWS\System32\smss.exe
    E:\WINDOWS\system32\winlogon.exe
    E:\WINDOWS\system32\services.exe
    E:\WINDOWS\system32\lsass.exe
    E:\WINDOWS\system32\svchost.exe
    E:\WINDOWS\System32\svchost.exe
    E:\WINDOWS\system32\spoolsv.exe
    E:\WINDOWS\Explorer.EXE
    E:\Program Files\F-Secure\Common\FSM32.EXE
    E:\WINDOWS\RTHDCPL.EXE
    E:\Program Files\D-Tools\daemon.exe
    E:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
    E:\WINDOWS\system32\RUNDLL32.EXE
    E:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    E:\Program Files\Winamp\winampa.exe
    E:\Program Files\Common Files\Real\Update_OB\realsched.exe
    E:\WINDOWS\system32\ctfmon.exe
    E:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    E:\Program Files\Messenger\msmsgs.exe
    E:\Program Files\OpenOffice.org 2.4\program\soffice.exe
    E:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    E:\Program Files\F-Secure\Common\FSMA32.EXE
    E:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    E:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
    E:\WINDOWS\system32\nvsvc32.exe
    E:\Program Files\F-Secure\Common\FSMB32.EXE
    E:\WINDOWS\system32\PnkBstrA.exe
    E:\WINDOWS\system32\svchost.exe
    E:\Program Files\F-Secure\Common\FCH32.EXE
    E:\Program Files\F-Secure\Common\FAMEH32.EXE
    E:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    E:\Program Files\F-Secure\FSGUI\fsguidll.exe
    E:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    E:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    E:\Program Files\F-Secure\Common\FNRB32.EXE
    E:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    E:\Program Files\F-Secure\Common\FIH32.EXE
    E:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    E:\Program Files\Mozilla Firefox\firefox.exe
    E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - E:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - E:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - E:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O4 - HKLM\..\Run: [F-Secure Manager] "E:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "E:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [SSBkgdUpdate] "E:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
    O4 - HKLM\..\Run: [OpwareSE4] "E:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [WinampAgent] "E:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [TkBellExe] "E:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [SDFix] C:\SDF\SDFix\RunThis.bat /second
    O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "E:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [MSMSGS] "E:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] E:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: OpenOffice.org 2.4.lnk = E:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://E:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://E:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://E:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://E:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1207138527674
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{8624B6F8-E781-43DF-AB3F-0447D5187140}: NameServer = 213.139.190.3 212.50.131.153
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - E:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - E:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - E:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - E:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - E:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - E:\WINDOWS\system32\PnkBstrA.exe

    --
    End of file - 7674 bytes
     
    Haksu83, May 29, 2008
    #2

Share This Page