Emäntä onnistui imaisemaan viruksen koneelle. Jos joku (Kalminen?) jaksaa ja viitsii, niin olisin kiitollinen lokien tulkinta-avusta. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:24:29, on 30.5.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\acs.exe C:\WINDOWS\system32\BrmfBAgS.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE C:\WINDOWS\system32\carpserv.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\SMC\SMCWCB-G WLAN Cardbus\Monitor.exe C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.saunalahti.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [CARPService] carpserv.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: SMCWCB-G WLAN Cardbus.lnk = C:\Program Files\SMC\SMCWCB-G WLAN Cardbus\Monitor.exe O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe O23 - Service: Brother BidiAgent Service for Resource manager (brmfbags) - Brother Industries, Ltd. - C:\WINDOWS\system32\BrmfBAgS.exe O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE O23 - Service: NetCom3 Service (Netcom3) - Unknown owner - C:\Program Files\Netcom3 Cleaner\PSCMonitor.exe (file missing) O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing) -- End of file - 6849 bytes Lisäksi ComboFixin loki: ComboFix 08-05-29.1 - 2008-05-30 15:59:38.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.175 [GMT 3:00] Running from: C:\Documents and Settings\\Työpöytä\ComboFix.exe Command switches used :: C:\Documents and Settings\\Työpöytä\CFScript.txt * Created a new restore point * Resident AV is active WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! FILE :: C:\WINDOWS\winudspm.exe . (((((((((((((((((((((((((((((((((((((( Muut poistot )))))))))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\winudspm.exe . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-04-28 to 2008-05-30 ))))))))))))))))) . 2008-05-30 15:52 . 2008-05-30 15:52 96,768 --a------ C:\is154890.exe 2008-05-30 15:43 . 2008-05-30 15:43 <KANSIO> d-------- C:\Program Files\Trend Micro 2008-05-28 08:54 . 2008-05-28 08:54 268 --ah----- C:\sqmdata03.sqm 2008-05-28 08:54 . 2008-05-28 08:54 244 --ah----- C:\sqmnoopt03.sqm 2008-05-17 13:30 . 2008-05-27 13:46 <KANSIO> d-------- C:\Program Files\DC++ 2008-05-13 11:21 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-05-13 11:21 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-05-13 11:21 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-05-13 11:21 . 2008-05-13 11:21 268 --ah----- C:\sqmdata02.sqm 2008-05-13 11:21 . 2008-05-13 11:21 244 --ah----- C:\sqmnoopt02.sqm 2008-05-13 10:05 . 2008-05-13 10:05 32,544 --a------ C:\WINDOWS\king-uninstall.exe 2008-05-13 09:42 . 2008-05-13 09:42 268 --ah----- C:\sqmdata01.sqm 2008-05-13 09:42 . 2008-05-13 09:42 244 --ah----- C:\sqmnoopt01.sqm 2008-05-13 00:17 . 2008-05-13 00:17 268 --ah----- C:\sqmdata00.sqm 2008-05-13 00:17 . 2008-05-13 00:17 244 --ah----- C:\sqmnoopt00.sqm 2008-05-12 23:34 . 2008-05-12 23:34 <KANSIO> d-------- C:\Program Files\Webteh 2008-05-12 23:01 . 2008-05-12 23:08 <KANSIO> d-------- C:\Program Files\Winamp 2008-05-12 23:01 . 2008-05-12 23:08 <KANSIO> d-------- C:\Documents and Settings\\Application Data\Winamp 2008-05-12 22:50 . 2008-05-12 22:50 <KANSIO> d-------- C:\Program Files\Spybot - Search & Destroy 2008-05-12 22:50 . 2008-05-12 23:30 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-05-12 22:43 . 2008-05-12 22:43 <KANSIO> d-------- C:\Program Files\ffdshow 2008-05-12 22:43 . 2008-05-04 12:28 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll 2008-05-12 22:43 . 2008-05-04 12:28 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2008-05-12 22:43 . 2008-05-04 12:28 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2008-05-12 22:42 . 2008-05-12 22:42 <KANSIO> d-------- C:\Program Files\AC3Filter 2008-05-12 22:42 . 2007-08-09 14:27 380,928 --a------ C:\WINDOWS\system32\ac3filter.acm 2008-05-12 22:33 . 2008-05-13 20:48 <KANSIO> d-------- C:\Documents and Settings\\Contacts 2008-05-12 22:18 . 2008-05-12 22:29 <KANSIO> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller 2008-05-12 22:17 . 2008-05-12 22:30 <KANSIO> d-------- C:\Program Files\Windows Live 2008-05-12 22:17 . 2008-05-12 22:17 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-05-12 21:53 . 2008-05-12 21:53 <KANSIO> d-------- C:\Program Files\SMC 2008-05-12 21:53 . 2008-05-12 21:53 17,801 --a------ C:\WINDOWS\system32\drivers\AegisP.sys 2008-05-12 21:52 . 2005-03-23 13:25 457,344 --a------ C:\WINDOWS\system32\drivers\SMCWCBG.sys 2008-05-12 21:43 . 2006-06-03 15:00 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö 2008-05-12 21:43 . 2006-06-03 15:00 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö 2008-05-12 21:43 . 2006-06-03 15:00 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä 2008-05-12 21:43 . 2006-06-03 15:00 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä 2008-05-12 21:43 . 2006-06-03 15:00 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö 2008-05-12 21:43 . 2006-06-03 15:00 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö 2008-05-12 21:43 . 2006-06-03 15:00 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit 2008-05-12 21:43 . 2006-06-03 15:00 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit 2008-05-12 21:43 . 2006-06-03 14:07 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit 2008-05-12 21:43 . 2006-06-03 14:07 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit 2008-05-12 21:43 . 2006-06-03 15:00 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko 2008-05-12 21:43 . 2006-06-03 15:00 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko 2008-05-12 21:43 . 2008-05-12 21:43 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja 2008-05-12 21:03 . 2006-06-03 15:16 229,303 --a------ C:\WINDOWS\hplj1010.hi2 2008-05-12 21:03 . 2006-06-03 15:16 16,102 --a------ C:\WINDOWS\hplj1010.bu2 . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-12 19:16 --------- d-----w C:\Program Files\Common Files\Adobe 2008-05-12 18:37 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-12 18:18 --------- d-----w C:\Documents and Settings\\Application Data\ScanSoft 2008-05-12 18:05 --------- d-----w C:\Program Files\Hewlett-Packard 2008-05-12 14:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk 2008-05-12 11:20 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-05-12 10:56 --------- d-----w C:\Program Files\Java 2008-04-03 07:15 --------- d-----w C:\Program Files\F-Secure Internet Security 2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll 2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-01 13:01 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-02-26 12:00 294,912 ----a-w C:\WINDOWS\system32\msctf.dll 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184] "SpyClean"="C:\Program Files\Netcom3 Cleaner\SpyClean.exe" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CARPService"="carpserv.exe" [2002-03-20 16:48 4608 C:\WINDOWS\system32\carpserv.exe] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2002-03-29 12:45 114688] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2002-03-29 12:44 528384] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [] "NeroCheck"="C:\WINDOWS\System32\\NeroCheck.exe" [2001-07-09 13:50 155648] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.exe" [2007-05-25 16:12 183208] "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 16:11 740208] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "Windows UDP Control"="winudspm.exe" [] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 02:12 15360] C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\ SMCWCB-G WLAN Cardbus.lnk - C:\Program Files\SMC\SMCWCB-G WLAN Cardbus\Monitor.exe [2005-06-07 17:56:34 430080] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.ac3filter"= ac3filter.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\WINDOWS\\system32\\ntvdm.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\Program Files\\DC++\\DCPlusPlus.exe"= R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-03-24 10:05] R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2008-02-13 14:43] R3 CVIA2AUD;Fujitsu VIA2 3D Environmental Audio;C:\WINDOWS\system32\drivers\cvia2aud.sys [2002-04-01 15:28] R3 CVIA2HALA;CVIA2HALA;C:\WINDOWS\system32\drivers\cvia2hal.sys [2002-04-01 15:31] R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 16:08] R3 HSFHWVIA;HSFHWVIA;C:\WINDOWS\system32\DRIVERS\HSFHWVIA.sys [2002-03-20 16:47] R3 SMCWCBG;SMCWCB-G WLAN Cardbus Service;C:\WINDOWS\system32\DRIVERS\SMCWCBG.sys [2005-03-23 13:25] R3 wlanndi5;wlanndi5 NDIS Protocol Driver;C:\WINDOWS\system32\wlanndi5.SYS [2004-04-21 17:51] S3 brfilt;Brother MFC Filter Driver;C:\WINDOWS\system32\Drivers\Brfilt.sys [2001-08-17 21:12] S3 brparimg;Brother Multi Function Parallel Image driver;C:\WINDOWS\system32\DRIVERS\BrParImg.sys [2001-08-17 21:12] S3 BrParWdm;Brother WDM Parallel Driver;C:\WINDOWS\system32\Drivers\BrParwdm.sys [2001-10-05 15:51] S3 Netcom3;NetCom3 Service;C:\Program Files\Netcom3 Cleaner\PSCMonitor.exe [] S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 16:09] S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 16:09] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{380553a0-6439-11dc-ba90-00e0009be9b2}] \Shell\AutoRun\command - F:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ea991230-7f0c-11dc-bab2-00e0009be9b2}] \Shell\AutoRun\command - F:\LaunchU3.exe -a *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-30 16:04:09 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-30 16:07:45 ComboFix-quarantined-files.txt 2008-05-30 13:07:34 Pre-Run: 10,633,986,048 tavua vapaana Post-Run: 10,628,980,736 tavua vapaana 151 --- E O F --- 2008-05-28 18:02:20
Ei tämä ollut paha enään !!! Mene alapalkista KÄYNNISTÄ ==> SUORITA valikkoon ja kirjoita services.msc OK Klikkaa Avautuva ikkuna suureksi ja ohjelma saraketta levität niin että näkyy kaikki. Etsi NetCom3 Service Klikkaa rivi aktiiviseksi ja Hiiren oikealla napilla pääset ko. riviltä valikkoon ==> Ominaisuudet/Propertiers josta muutat Ei käytössä. => Klikkaa käytä => OK Tämän lisäksi klikkaat vasemmalla puolella olevaa linkkiä Pysäytä palvelu . Poistu ohjelmasta. ------------------------------------------------------------------------- Avaa Muistio ja kopioi/liitä Lainaus: laatikon sisältö sinne: Tallenna nimellä CFScript (itse asiassa combofix tunnistaa tuon vaikka tiedostopääte ei olisi edes .txt). Sitten raahaa ja pudota CFScript ComboFix.exeen kuten alla.(Älä klikkaa) Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne. ----------------------------------------------------- Lataa Malwarebytes' Anti-Malware työpöydällesi. * Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman. * Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes' Anti-Malware ja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Finish. * Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version. * Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan. * Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset. * Varmistu, että kaikki on merkitty ja klikkaa Remove Selected. * Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt * Lähetä lokin sisältö seuraavassa viestissäsi . ------------------------------------------------------------ Sammuta selain ja muut ohjelmat Fixin ajaksi. (ei virustorjuntaa) Käynnistä HijackThis:ja Scan ja ruksaa seuraavat punaisella listatut tiedostot sekä poista ne.(fix Chekked) O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM..Run: [NeroCheck] C:WINDOWSSystem32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O23 - Service: NetCom3 Service (Netcom3) - Unknown owner - C:\Program Files\Netcom3 Cleaner\PSCMonitor.exe (file missing) Tyhjennä roskakori ja käynnistä koneesi uudelleen. Postita tänne seuraavat lokit: * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta) * (C:\ComboFix.txt) raportti * Malwarebytes' Anti-Malware\Logs\log-päiväys.txt .
Suuret kiitokset avusta! Seuraavassa raportit: HJT: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:37:26, on 30.5.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\acs.exe C:\WINDOWS\system32\BrmfBAgS.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe C:\Program Files\F-Secure Internet Security\FSPC\fspc.exe C:\WINDOWS\system32\carpserv.exe C:\Program Files\Synaptics\SynTP\SynTPLpr.exe C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\SMC\SMCWCB-G WLAN Cardbus\Monitor.exe C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.saunalahti.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O4 - HKLM\..\Run: [CARPService] carpserv.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: SMCWCB-G WLAN Cardbus.lnk = C:\Program Files\SMC\SMCWCB-G WLAN Cardbus\Monitor.exe O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe O23 - Service: Brother BidiAgent Service for Resource manager (brmfbags) - Brother Industries, Ltd. - C:\WINDOWS\system32\BrmfBAgS.exe O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE O23 - Service: Pml Driver HPZ12 - Unknown owner - C:\WINDOWS\system32\HPZipm12.exe (file missing) -- End of file - 6483 bytes ComboFix: ComboFix 08-05-29.1 - 2008-05-30 17:44:24.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.171 [GMT 3:00] Running from: C:\Documents and Settings\\Työpöytä\ComboFix.exe Command switches used :: C:\Documents and Settings\\Työpöytä\CFScript.txt * Created a new restore point * Resident AV is active WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! FILE :: C:\is154890.exe . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-04-28 to 2008-05-30 ))))))))))))))))) . 2008-05-30 15:43 . 2008-05-30 15:43 <KANSIO> d-------- C:\Program Files\Trend Micro 2008-05-28 08:54 . 2008-05-28 08:54 268 --ah----- C:\sqmdata03.sqm 2008-05-28 08:54 . 2008-05-28 08:54 244 --ah----- C:\sqmnoopt03.sqm 2008-05-17 13:30 . 2008-05-27 13:46 <KANSIO> d-------- C:\Program Files\DC++ 2008-05-13 11:21 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-05-13 11:21 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-05-13 11:21 . 2007-07-30 19:18 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-05-13 11:21 . 2008-05-13 11:21 268 --ah----- C:\sqmdata02.sqm 2008-05-13 11:21 . 2008-05-13 11:21 244 --ah----- C:\sqmnoopt02.sqm 2008-05-13 10:05 . 2008-05-13 10:05 32,544 --a------ C:\WINDOWS\king-uninstall.exe 2008-05-13 09:42 . 2008-05-13 09:42 268 --ah----- C:\sqmdata01.sqm 2008-05-13 09:42 . 2008-05-13 09:42 244 --ah----- C:\sqmnoopt01.sqm 2008-05-13 00:17 . 2008-05-13 00:17 268 --ah----- C:\sqmdata00.sqm 2008-05-13 00:17 . 2008-05-13 00:17 244 --ah----- C:\sqmnoopt00.sqm 2008-05-12 23:34 . 2008-05-12 23:34 <KANSIO> d-------- C:\Program Files\Webteh 2008-05-12 23:01 . 2008-05-12 23:08 <KANSIO> d-------- C:\Program Files\Winamp 2008-05-12 23:01 . 2008-05-12 23:08 <KANSIO> d-------- C:\Documents and Settings\\Application Data\Winamp 2008-05-12 22:50 . 2008-05-12 22:50 <KANSIO> d-------- C:\Program Files\Spybot - Search & Destroy 2008-05-12 22:50 . 2008-05-12 23:30 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-05-12 22:43 . 2008-05-12 22:43 <KANSIO> d-------- C:\Program Files\ffdshow 2008-05-12 22:43 . 2008-05-04 12:28 60,273 --a------ C:\WINDOWS\system32\pthreadGC2.dll 2008-05-12 22:43 . 2008-05-04 12:28 7,680 --a------ C:\WINDOWS\system32\ff_vfw.dll 2008-05-12 22:43 . 2008-05-04 12:28 547 --a------ C:\WINDOWS\system32\ff_vfw.dll.manifest 2008-05-12 22:42 . 2008-05-12 22:42 <KANSIO> d-------- C:\Program Files\AC3Filter 2008-05-12 22:42 . 2007-08-09 14:27 380,928 --a------ C:\WINDOWS\system32\ac3filter.acm 2008-05-12 22:33 . 2008-05-13 20:48 <KANSIO> d-------- C:\Documents and Settings\\Contacts 2008-05-12 22:18 . 2008-05-12 22:29 <KANSIO> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller 2008-05-12 22:17 . 2008-05-12 22:30 <KANSIO> d-------- C:\Program Files\Windows Live 2008-05-12 22:17 . 2008-05-12 22:17 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-05-12 21:53 . 2008-05-12 21:53 <KANSIO> d-------- C:\Program Files\SMC 2008-05-12 21:53 . 2008-05-12 21:53 17,801 --a------ C:\WINDOWS\system32\drivers\AegisP.sys 2008-05-12 21:52 . 2005-03-23 13:25 457,344 --a------ C:\WINDOWS\system32\drivers\SMCWCBG.sys 2008-05-12 21:43 . 2006-06-03 15:00 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö 2008-05-12 21:43 . 2006-06-03 15:00 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Verkkoympäristö 2008-05-12 21:43 . 2006-06-03 15:00 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä 2008-05-12 21:43 . 2006-06-03 15:00 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Työpöytä 2008-05-12 21:43 . 2006-06-03 15:00 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö 2008-05-12 21:43 . 2006-06-03 15:00 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Tulostinympäristö 2008-05-12 21:43 . 2006-06-03 15:00 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit 2008-05-12 21:43 . 2006-06-03 15:00 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja\Suosikit 2008-05-12 21:43 . 2006-06-03 14:07 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit 2008-05-12 21:43 . 2006-06-03 14:07 <KANSIO> d--h----- C:\Documents and Settings\Järjestelmänvalvoja\Mallit 2008-05-12 21:43 . 2006-06-03 15:00 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko 2008-05-12 21:43 . 2006-06-03 15:00 <KANSIO> dr------- C:\Documents and Settings\Järjestelmänvalvoja\Käynnistä-valikko 2008-05-12 21:43 . 2008-05-12 21:43 <KANSIO> d-------- C:\Documents and Settings\Järjestelmänvalvoja 2008-05-12 21:03 . 2006-06-03 15:16 229,303 --a------ C:\WINDOWS\hplj1010.hi2 2008-05-12 21:03 . 2006-06-03 15:16 16,102 --a------ C:\WINDOWS\hplj1010.bu2 . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-12 19:16 --------- d-----w C:\Program Files\Common Files\Adobe 2008-05-12 18:37 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-12 18:18 --------- d-----w C:\Documents and Settings\\Application Data\ScanSoft 2008-05-12 18:05 --------- d-----w C:\Program Files\Hewlett-Packard 2008-05-12 14:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk 2008-05-12 11:20 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-05-12 10:56 --------- d-----w C:\Program Files\Java 2008-04-03 07:15 --------- d-----w C:\Program Files\F-Secure Internet Security 2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll 2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll 2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-01 13:01 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-02-26 12:00 294,912 ----a-w C:\WINDOWS\system32\msctf.dll 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 05:38 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll . ((((((((((((((((((((((((((((( snapshot@2008-05-30_16.07.02,33 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-30 12:50:11 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-05-30 14:23:12 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-05-30 14:23:19 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_3dc.dat . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CARPService"="carpserv.exe" [2002-03-20 16:48 4608 C:\WINDOWS\system32\carpserv.exe] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2002-03-29 12:45 114688] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2002-03-29 12:44 528384] "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [] "NeroCheck"="C:\WINDOWS\System32\\NeroCheck.exe" [2001-07-09 13:50 155648] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.exe" [2007-05-25 16:12 183208] "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 16:11 740208] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 02:12 15360] C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\ SMCWCB-G WLAN Cardbus.lnk - C:\Program Files\SMC\SMCWCB-G WLAN Cardbus\Monitor.exe [2005-06-07 17:56:34 430080] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.ac3filter"= ac3filter.acm [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\WINDOWS\\system32\\ntvdm.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\Program Files\\DC++\\DCPlusPlus.exe"= R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-03-24 10:05] R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2008-02-13 14:43] R3 CVIA2AUD;Fujitsu VIA2 3D Environmental Audio;C:\WINDOWS\system32\drivers\cvia2aud.sys [2002-04-01 15:28] R3 CVIA2HALA;CVIA2HALA;C:\WINDOWS\system32\drivers\cvia2hal.sys [2002-04-01 15:31] R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 16:08] R3 HSFHWVIA;HSFHWVIA;C:\WINDOWS\system32\DRIVERS\HSFHWVIA.sys [2002-03-20 16:47] R3 SMCWCBG;SMCWCB-G WLAN Cardbus Service;C:\WINDOWS\system32\DRIVERS\SMCWCBG.sys [2005-03-23 13:25] R3 wlanndi5;wlanndi5 NDIS Protocol Driver;C:\WINDOWS\system32\wlanndi5.SYS [2004-04-21 17:51] S3 brfilt;Brother MFC Filter Driver;C:\WINDOWS\system32\Drivers\Brfilt.sys [2001-08-17 21:12] S3 brparimg;Brother Multi Function Parallel Image driver;C:\WINDOWS\system32\DRIVERS\BrParImg.sys [2001-08-17 21:12] S3 BrParWdm;Brother WDM Parallel Driver;C:\WINDOWS\system32\Drivers\BrParwdm.sys [2001-10-05 15:51] S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 16:09] S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 16:09] S4 Netcom3;NetCom3 Service;C:\Program Files\Netcom3 Cleaner\PSCMonitor.exe [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{380553a0-6439-11dc-ba90-00e0009be9b2}] \Shell\AutoRun\command - F:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ea991230-7f0c-11dc-bab2-00e0009be9b2}] \Shell\AutoRun\command - F:\LaunchU3.exe -a *Newly Created Service* - NETCOM3 . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-30 17:49:46 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-05-30 17:53:33 ComboFix-quarantined-files.txt 2008-05-30 14:53:16 ComboFix2.txt 2008-05-30 13:07:49 Pre-Run: 10,610,315,264 tavua vapaana Post-Run: 10,599,677,952 tavua vapaana 151 --- E O F --- 2008-05-28 18:02:20 Ja Anti-Malware: Malwarebytes' Anti-Malware 1.14 Tietokantaversio: 800 18:29:26 30.5.2008 mbam-log-5-30-2008 (18-29-26).txt Tarkistustyyppi: Täysi tarkistus (C:\|D:\|) Tarkistetut kohteet: 74754 Kulunut aika: 31 minute(s), 33 second(s) Saastuneita muistiprosesseja: 0 Saastuneita muistimoduuleja: 0 Saastuneita rekisteriavaimia: 0 Saastuneita rekisteriarvoja: 0 Saastuneita rekisterikohteita: 0 Saastuneita hakemistoja: 0 Saastuneita tiedostoja: 0 Saastuneita muistiprosesseja: (Haitallisia kohteita ei löydetty) Saastuneita muistimoduuleja: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriavaimia: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriarvoja: (Haitallisia kohteita ei löydetty) Saastuneita rekisterikohteita: (Haitallisia kohteita ei löydetty) Saastuneita hakemistoja: (Haitallisia kohteita ei löydetty) Saastuneita tiedostoja: (Haitallisia kohteita ei löydetty)
