Netti tuntuis hidastelevan

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by teho12, Mar 25, 2008.

  1. teho12

    teho12 Member

    Joined:
    Feb 21, 2008
    Messages:
    52
    Likes Received:
    0
    Trophy Points:
    16
    tässä loki:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:07:45, on 25.3.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.20733)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\CTHELPER.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\ctfmon.exe
    D:\program files\valve\steam\steam.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.update.microsoft.com/microsoftupdate/v6/default.aspx?ln=en-us
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Steam] "d:\program files\valve\steam\steam.exe" -silent
    O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
    O4 - Startup: Logitech tuoterekisteröinti.lnk = C:\Program Files\Common Files\LogiShrd\eReg\SetPoint\eReg.exe
    O4 - Startup: Registration Ghost Recon Advanced Warfighter.LNK = D:\Program Files\Ubisoft\Ghost Recon Advanced Warfighter\Support\Register\RegistrationReminder.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: SetPointII.lnk = ?
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 6811 bytes
     
    teho12, Mar 25, 2008
    #1
  2. mind92

    mind92 Regular member

    Joined:
    Feb 2, 2008
    Messages:
    188
    Likes Received:
    0
    Trophy Points:
    26
    poista lisää poista sovelluksesta: yahoo toolbar sitten poista vikasiedossa kansio C:\Program Files\Yahoo!
    --------
    sitten merkkaa hjt:lla paina fix checked
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    -------------

    Lataa SmitfraudFix (by S!Ri) työpöydällesi.

    Tuplaklikkaa tiedostoa SmitfraudFix.exe

    Valitse optio #1 - Search kirjoittamalla 1 ja painamalla "Enter"; tekstitiedosto avautuu, joka listaa tarttuneet tiedostot (jos olemassa).
    Postita tämän tekstitiedoston sisältö viestiketjuusi.

    **Jos työkalu ei käynnisty työpöydältä niin siirrä SmitfraudFix.exe suoraan järjestelmäaseman juureen (yleensä C:). Kokeile sitten käynnistää ohjelma uudestaan sieltä.

    Huomaa : process.exe filun tunnistaa jotkut Anti-virus ohjelmat (AntiVir, Dr.Web, Kaspersky) "Haittakaluna"; se ei ole virus, vaan ohjelma joka pysäyttää prosesseja. A/V ohjelmat eivät pysty tunnistamaan hyvän ja pahan käytön tälläisten ohjelmian väliltä, silloin ne saattavat varoittaa käyttäjää.
    http://www.beyondlogic.org/consulting/processutil/processutil.htm
    ------
    sitte postaa toi smitfraudfixin loki ja uus hjt
     
    mind92, Mar 25, 2008
    #2
  3. teho12

    teho12 Member

    Joined:
    Feb 21, 2008
    Messages:
    52
    Likes Received:
    0
    Trophy Points:
    16
    eipäs näytä olevan yahoo toolbar siellä lisää tai poista sovellus kohas
     
    teho12, Mar 25, 2008
    #3
  4. teho12

    teho12 Member

    Joined:
    Feb 21, 2008
    Messages:
    52
    Likes Received:
    0
    Trophy Points:
    16
    Sitä yahoo toolbar hommaa en löytänyt sieltä lisää tai sovellus paikasta mutta poistin sen kansion
    tässä nää lokit:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:30:09, on 25.3.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.20733)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\CTHELPER.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\ctfmon.exe
    D:\program files\valve\steam\steam.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    d:\program files\valve\steam\steamapps\cueman\sourcesdk\bin\SDKLauncher.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.update.microsoft.com/microsoftupdate/v6/default.aspx?ln=en-us
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Steam] "d:\program files\valve\steam\steam.exe" -silent
    O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
    O4 - Startup: Logitech tuoterekisteröinti.lnk = C:\Program Files\Common Files\LogiShrd\eReg\SetPoint\eReg.exe
    O4 - Startup: Registration Ghost Recon Advanced Warfighter.LNK = D:\Program Files\Ubisoft\Ghost Recon Advanced Warfighter\Support\Register\RegistrationReminder.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: SetPointII.lnk = ?
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 6740 bytes

    ja sitten toinen loki:

    SmitFraudFix v2.308

    Scan done at 15:29:30,56, ti 25.03.2008
    Run from C:\Program Files\Mozilla Firefox\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in normal mode

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\CTHELPER.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\ctfmon.exe
    D:\program files\valve\steam\steam.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    d:\program files\valve\steam\steamapps\cueman\sourcesdk\bin\SDKLauncher.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\cmd.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    »»»»»»»»»»»»»»»»»»»»»»»» C:\


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\jr


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\jr\Application Data


    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu


    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\jr\FAVORI~1


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components



    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
    !!!Attention, following keys are not inevitably infected!!!

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» VACFix
    !!!Attention, following keys are not inevitably infected!!!

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
    "System"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Rustock



    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: NVIDIA nForce Networking Controller - Packet Scheduler Miniport
    DNS Server Search Order: 193.229.0.40
    DNS Server Search Order: 193.229.0.42

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{65E78C40-16CE-4DDC-81EE-8A8EE217E2A8}: DhcpNameServer=193.229.0.40 193.229.0.42
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{65E78C40-16CE-4DDC-81EE-8A8EE217E2A8}: DhcpNameServer=193.229.0.40 193.229.0.42
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{65E78C40-16CE-4DDC-81EE-8A8EE217E2A8}: DhcpNameServer=193.229.0.40 193.229.0.42
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=193.229.0.40 193.229.0.42
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=193.229.0.40 193.229.0.42
    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=193.229.0.40 193.229.0.42


    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


    »»»»»»»»»»»»»»»»»»»»»»»» End



     
    teho12, Mar 25, 2008
    #4
  5. mind92

    mind92 Regular member

    Joined:
    Feb 2, 2008
    Messages:
    188
    Likes Received:
    0
    Trophy Points:
    26
    ok, se yahoo toolbarin olo siel lisää poista sovelluksissa oli vain varmistus. mutta tees nämä
    -------
    Ohje AVG:n Anti-Spyware 7.5:n käyttöön
    Huom! Tässä ohjeessa sammutetaan tuo reaaliaikasuojaus (Shield). Näin vältetään tilanteet joissa suojaus estäisi esim HijackThis:n työkalun toimintaa.

    Tallenna nämä ohjeet tekstitiedostoon tai tulosta nämä, muuten et pääse niihin käsiksi vikasietotilasta

    Lataa AVG:n Anti-Spyware 7.5:n
    ja tallenna ohjelma työpöydällesi.
    o Kun olet ladannut ohjelman, kaksoisklikkaa asennuohjelman pikakuvaketta työpöydälläsi, asennus alkaa.
    o Asennuksen jälkeen täytyy ohjelma käynnistää ja sen tunnisteet päivittää.
    o Käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Update" kuvaketta päävalikossa. Sen jälkeen klikkaa "Update now" painiketta.

    o Sitten klikkaa "Start Update" kuvaketta jolloin päivitys alkaa.

    o Kun päivitykset on ladattu, klikkaa "Scanner" kuvaketta ikkunan ylälaidassa. Valitse sitten "Settings" välilehti.
    o Kun "Settings" valikko on auennut, klikkaa "Recommended actions" ja sitten valitse "Quarantine".

    o Sitten "Reports" valikon alta:
    o Laita täppi kohtaan "Automatically generate report after every scan"
    o Ota täppi pois kohdasta"Only if threats were found"

    o Sitten klikkaa "Shield" kuvaketta ikkunan ylälaidassa
    o "Resident shield is", muuta tila active:sta inactive:ksi
    o Sulje ohjelma, ÄLÄ skannaa vielä.

    Käynnistä koneesi vikasietotilaan,
    sammuta ja käynnistä
    käynnistyksen yhteydessä naputtele F8
    valitse nuoli näppäimellä vikasietotila
    paina enter ja enter

    Toisissa koneissa paukutetaan F8:sin sijasta F5:tä

    HUOM! Älä käytä muita ohjelmia AVG:n skannauksen aikana, tämä saattaa häiritä skannausta.
    o Kun vikasietotilassa, käynnistä AVG:n Anti-Spyware.
    o Klikkaa "Scanner" kuvaketta ikkunan ylälaidassa ja valitse "Scan" välilehti. Sitten klikkaa "Complete System Scan".
    o Ewido aloittaa nyt tietokoneen skannaamisen, ole kärsivällinen sillä skannaus vie aikaa.

    Kun skannaus on valmis:
    TÄRKEÄÄ : Älä klikkaa "Save Scan Report" ennen kuin klikkaat "Apply all Actions"
    o Varmistu, että Set all elements to: näyttää Quarantine (1), jos ei, klikkaa linkkiä ja valitse Quarantine popup-valikosta.
    o Sinulta kysytään mitä tehdä jos infektioita löytyi, valitse silloin "Apply all actions"
    [​IMG]
    o Sitten klikkaa "Reports" kuvaketta ohjelma yläosasta.
    o Klikkaa "Save report as" painiketta ikkunan vasemmassa alalaidassa ja tallenna raportti työpöydälle.
    o Sulje ohjelma, käynnistä kone normaalisti ja lähetä AVG:n raportti viestikejuusi.

    __________

    • Avaa HiJackThis
    • Klikkaa "Configure" valintaa oikealla alhaalla
    • Klikkaa "Misc Tools"
    • Klikkaa boxia joka sanoo "Uninstall Manager"
    • Klikkaa valintaa "Save list"
    • Kopioi ja liitä kyseinen lista muistiosta postiisi
     
    mind92, Mar 25, 2008
    #5
  6. teho12

    teho12 Member

    Joined:
    Feb 21, 2008
    Messages:
    52
    Likes Received:
    0
    Trophy Points:
    16
    tässä tää ihme tarkistus loki aika tyhjä

    ---------------------------------------------------------
    AVG Anti-Spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 16:23:36 25.3.2008

    + Scan result:



    Nothing found.


    ::Report end

    ja sitten se toinen jonka pyysit

    3DMark06
    Ad-Aware 2007
    Adobe Flash Player Plugin
    Adobe Shockwave Player
    AGEIA PhysX v7.09.13
    anysee Driver(2007.07.24,AD01050128) Uninstall
    avast! Antivirus
    AVG Anti-Spyware 7.5
    CDDRV_Installer
    Condition Zero
    Condition Zero Deleted Scenes
    Corel Paint Shop Pro Photo X2
    Counter-Strike
    Counter-Strike(TM)
    Counter-Strike: Source
    Day of Defeat
    Day of Defeat: Source
    Deathmatch Classic
    DivX Content Uploader
    DivX Web Player
    er100LT
    Free eXPert PDF Reader
    G9 Device Package
    Garry's Mod
    GCFScape 1.6.6
    Ghost Recon Advanced Warfighter
    GTA San Andreas
    Half-Life 2
    Half-Life 2: Deathmatch
    Half-Life 2: Episode One
    Half-Life 2: Episode Two
    Half-Life Dedicated Server Update Tool
    Half-Life(R) 2
    High Definition Audio Driver Package - KB888111
    HijackThis 2.0.2
    Hotfix for Microsoft .NET Framework 3.0 (KB932471)
    Hotfix for Windows Media Player 11 (KB939683)
    IIS 6.0 Resource Kit Tools
    IIS6 Manager
    InterVideo FilterSDK for AMT
    Java(TM) 6 Update 3
    Java(TM) 6 Update 5
    KhalInstallWrapper
    Logitech SetPoint
    Logitech SetPoint 5.00
    Max Payne
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft .NET Framework 2.0 Service Pack 1
    Microsoft .NET Framework 3.0 Service Pack 1
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
    Microsoft Office Professional Edition 2003
    Microsoft Office XP Web-komponentit
    Microsoft Silverlight
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2005 Redistributable
    mIRC
    Mopokorttikoulu
    Mozilla Firefox (2.0.0.12)
    MSXML 4.0 SP2 (KB936181)
    MSXML 6.0 Parser (KB933579)
    MTA: Race for San Andreas 1.1.1
    Musicmatch® Jukebox
    Need for Speed™ ProStreet
    Nero 6 Ultra Edition
    NVIDIA Drivers
    Portal
    Realtek High Definition Audio Driver
    Ricochet
    San Andreas Mod Installer
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB939653)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows XP (KB921503)
    Security Update for Windows XP (KB933729)
    Security Update for Windows XP (KB936021)
    Security Update for Windows XP (KB937894)
    Security Update for Windows XP (KB938829)
    Security Update for Windows XP (KB941202)
    Security Update for Windows XP (KB941568)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB941644)
    Security Update for Windows XP (KB943055)
    Security Update for Windows XP (KB943460)
    Security Update for Windows XP (KB943485)
    Security Update for Windows XP (KB944653)
    Security Update for Windows XP (KB946026)
    Skype™ 3.6
    Source Dedicated Server
    Source SDK
    Source SDK Base
    Source SDK Base - Orange Box
    SSL Diagnostics 1.1 (x86)
    Steam(TM)
    Team Fortress 2
    Team Fortress 2 Dedicated Server
    TeamSpeak 2 RC2
    TextPad 4.7
    TextPad Lexicons
    Unreal Tournament 3
    Update for Windows XP (KB933360)
    Update for Windows XP (KB938828)
    Update for Windows XP (KB942763)
    Ventrilo Client
    VideoLAN VLC media player 0.8.6d
    Windows Imaging Component
    Windows Live installer
    Windows Live Messenger
    Windows Live OneCare safety scanner
    Windows Liven kirjautumisavustaja
    Windows Presentation Foundation
    WinRAR-pakkausohjelma
    VTFEdit 1.2.4
    ZoneAlarm

    Tota unreal tournament 3 en oo muistaakseni asentanu enkä omista koko peliä
     
    teho12, Mar 25, 2008
    #6
  7. mind92

    mind92 Regular member

    Joined:
    Feb 2, 2008
    Messages:
    188
    Likes Received:
    0
    Trophy Points:
    26
    selevä... poistas tuo Java(TM) 6 Update 3 ohjauspaneelin kautta.
    -----------
    Lataa tuolta
    CCleaner v2.05.555- Standard Build    , ÄLÄ aseenna Yahoo toolbaria!

    laita asetukset näin:
    Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.

    aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
    aja Rekisteri > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi
    --------------
    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt ((tai vistassa C:\Users\Omistaja\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs )))
    8. Lähetä lokin sisältö seuraavassa viestissäsi.
    ------
    ajeleppa noi tost viel... :)

     
    mind92, Mar 25, 2008
    #7
  8. teho12

    teho12 Member

    Joined:
    Feb 21, 2008
    Messages:
    52
    Likes Received:
    0
    Trophy Points:
    16
    tässä tuo loki

    Malwarebytes' Anti-Malware 1.09
    Tietokantaversio: 540

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|X:\|Y:\|)
    Tarkistetut kohteet: 129766
    Kulunut aika: 22 minute(s), 12 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 2
    Saastuneita rekisteriarvoja: 3
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{daed9266-8c28-4c1c-8b58-5c66eff1d302} (Search.Hijack) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\MsSC2 (Trojan.Downloader) -> Quarantined and deleted successfully.

    Saastuneita rekisteriarvoja:
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\*.securewebinfo.com (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\*.safetyincludes.com (Trojan.Zlob) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\New Windows\Allow\*.securemanaging.com (Trojan.Zlob) -> Quarantined and deleted successfully.

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)

     
    teho12, Mar 25, 2008
    #8
  9. mind92

    mind92 Regular member

    Joined:
    Feb 2, 2008
    Messages:
    188
    Likes Received:
    0
    Trophy Points:
    26
    ajappa toi viel päälle:
    SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
    ---------
    sendaa sit uus hjt
     
    mind92, Mar 25, 2008
    #9
  10. teho12

    teho12 Member

    Joined:
    Feb 21, 2008
    Messages:
    52
    Likes Received:
    0
    Trophy Points:
    16
    loki:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:56:08, on 25.3.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.20733)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\system32\PSIService.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\CTHELPER.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ctfmon.exe
    D:\program files\valve\steam\steam.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Skype\Plugin Manager\skypePM.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.update.microsoft.com/microsoftupdate/v6/default.aspx?ln=en-us
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
    O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Steam] "d:\program files\valve\steam\steam.exe" -silent
    O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
    O4 - Startup: Logitech tuoterekisteröinti.lnk = C:\Program Files\Common Files\LogiShrd\eReg\SetPoint\eReg.exe
    O4 - Startup: Registration Ghost Recon Advanced Warfighter.LNK = D:\Program Files\Ubisoft\Ghost Recon Advanced Warfighter\Support\Register\RegistrationReminder.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O4 - Global Startup: SetPointII.lnk = ?
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://D:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - D:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 6920 bytes

    ja toinen


    SDFix: Version 1.161

    Run by jr on ti 25.03.2008 at 18:49

    Microsoft Windows XP [Version 5.1.2600]
    Running From: C:\DOCUME~1\jr\Desktop\SDFix

    Checking Services :


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File

    Rebooting


    Checking Files :

    Trojan Files Found:

    C:\WINDOWS\system32\mswinup.exe - Deleted
    C:\WINDOWS\system32\winsvcup.exe - Deleted
    C:\WINDOWS\system32\winupsvc.exe - Deleted





    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-03-25 18:51:56
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
    "s1"=dword:2df9c43f
    "s2"=dword:110480d0
    "h0"=dword:00000002

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
    "p0"="C:\Program Files\DAEMON Tools Pro\"
    "h0"=dword:00000000
    "hdf12"=hex:1c,5c,0a,be,39,05,a3,8c,ab,c9,9b,5b,4e,19,ec,c0,b9,de,4c,1d,6c,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
    "a0"=hex:20,01,00,00,61,5c,a9,c3,74,da,96,41,c1,e6,a1,20,7f,c8,1c,71,e7,..
    "hdf12"=hex:be,6f,0d,98,a3,8b,7b,d9,17,39,e2,c7,a4,f8,31,04,2e,25,fc,62,04,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
    "hdf12"=hex:b8,f1,2b,2a,f5,b8,5d,49,82,58,1b,32,d5,67,c9,8e,bc,d0,53,10,e3,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1]
    "hdf12"=hex:7d,a6,f8,50,e6,13,bf,16,9b,b4,95,01,ab,18,e7,3d,80,b6,23,4a,9e,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
    "a0"=hex:20,01,00,00,18,f1,ae,c3,19,24,e8,96,d0,c4,d9,53,9d,a5,18,eb,3d,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="D:\Program Files\DAEMON Tools Lite\"
    "h0"=dword:00000001
    "khjeh"=hex:16,4d,43,ae,c8,24,9f,54,c0,06,fc,c3,a3,61,c8,a5,79,28,b8,21,0b,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,d0,b0,5b,9a,c1,0a,0c,b1,48,56,b8,a9,84,3a,69,85,06,..
    "khjeh"=hex:92,c9,2a,5f,ae,48,b8,fe,06,4e,7a,e6,57,53,75,d0,59,92,ec,7d,57,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:38,2f,09,7d,39,97,e4,fd,50,07,dd,0f,ab,61,b8,b3,c6,6e,94,fd,69,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
    "khjeh"=hex:5f,51,38,7e,ab,a7,ca,1f,9c,5f,ba,98,c4,bf,c5,31,6f,0a,d0,54,af,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
    "khjeh"=hex:fb,00,ef,44,aa,da,0c,b6,83,68,3c,ef,4a,55,a5,eb,6f,df,c8,74,37,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC]
    "p0"="C:\Program Files\DAEMON Tools Pro\"
    "h0"=dword:00000000
    "hdf12"=hex:1c,5c,0a,be,39,05,a3,8c,ab,c9,9b,5b,4e,19,ec,c0,b9,de,4c,1d,6c,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001]
    "a0"=hex:20,01,00,00,61,5c,a9,c3,74,da,96,41,c1,e6,a1,20,7f,c8,1c,71,e7,..
    "hdf12"=hex:be,6f,0d,98,a3,8b,7b,d9,17,39,e2,c7,a4,f8,31,04,2e,25,fc,62,04,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0]
    "hdf12"=hex:b8,f1,2b,2a,f5,b8,5d,49,82,58,1b,32,d5,67,c9,8e,bc,d0,53,10,e3,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq1]
    "hdf12"=hex:7d,a6,f8,50,e6,13,bf,16,9b,b4,95,01,ab,18,e7,3d,80,b6,23,4a,9e,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002]
    "a0"=hex:20,01,00,00,18,f1,ae,c3,19,24,e8,96,d0,c4,d9,53,9d,a5,18,eb,3d,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="D:\Program Files\DAEMON Tools Lite\"
    "h0"=dword:00000001
    "khjeh"=hex:16,4d,43,ae,c8,24,9f,54,c0,06,fc,c3,a3,61,c8,a5,79,28,b8,21,0b,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,d0,b0,5b,9a,c1,0a,0c,b1,48,56,b8,a9,84,3a,69,85,06,..
    "khjeh"=hex:92,c9,2a,5f,ae,48,b8,fe,06,4e,7a,e6,57,53,75,d0,59,92,ec,7d,57,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:38,2f,09,7d,39,97,e4,fd,50,07,dd,0f,ab,61,b8,b3,c6,6e,94,fd,69,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
    "khjeh"=hex:5f,51,38,7e,ab,a7,ca,1f,9c,5f,ba,98,c4,bf,c5,31,6f,0a,d0,54,af,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42]
    "khjeh"=hex:fb,00,ef,44,aa,da,0c,b6,83,68,3c,ef,4a,55,a5,eb,6f,df,c8,74,37,..

    scanning hidden registry entries ...

    scanning hidden files ...


    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 93


    Remaining Services :



    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "C:\\Egyde-v3.26\\Egyde-v3.26.exe"="C:\\Egyde-v3.26\\Egyde-v3.26.exe:*:Enabled:FTP Browsing and more..."
    "C:\\FlashFXP.v3.4.0.Build.1145\\FlashFXP.exe"="C:\\FlashFXP.v3.4.0.Build.1145\\FlashFXP.exe:*:Enabled:FlashFXP"
    "C:\\Egyde-v3.65b\\Egyde-v3.65b.exe"="C:\\Egyde-v3.65b\\Egyde-v3.65b.exe:*:Enabled:Egyde-v3.65b"
    "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
    "F:\\utorrent 1.7.3_mult100_leecher.exe"="F:\\utorrent 1.7.3_mult100_leecher.exe:*:Enabled:µTorrent"
    "D:\\Program Files\\Valve\\Steam\\SteamApps\\cueman\\counter-strike source\\hl2.exe"="D:\\Program Files\\Valve\\Steam\\SteamApps\\cueman\\counter-strike source\\hl2.exe:*:Enabled:hl2"
    "D:\\Program Files\\Valve\\server\\srcds.exe"="D:\\Program Files\\Valve\\server\\srcds.exe:*:Enabled:srcds"
    "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe:*:Enabled:Remote Assistance - Windows Messenger and Voice"
    "D:\\Program Files\\Valve\\Steam\\SteamApps\\cueman\\source sdk base\\hl2.exe"="D:\\Program Files\\Valve\\Steam\\SteamApps\\cueman\\source sdk base\\hl2.exe:*:Enabled:hl2"
    "D:\\Program Files\\Valve\\Steam\\SteamApps\\cueman\\team fortress 2\\hl2.exe"="D:\\Program Files\\Valve\\Steam\\SteamApps\\cueman\\team fortress 2\\hl2.exe:*:Enabled:hl2"
    "D:\\Program Files\\MTA San Andreas\\server\\MTA Server.exe"="D:\\Program Files\\MTA San Andreas\\server\\MTA Server.exe:*:Enabled:MTA Server"
    "D:\\Program Files\\Rockstar Games\\GTA San Andreas\\samp-server.exe"="D:\\Program Files\\Rockstar Games\\GTA San Andreas\\samp-server.exe:*:Enabled:samp-server"
    "D:\\Program Files\\PacSteamT\\SteamApps\\teho12\\garrysmod\\hl2.exe"="D:\\Program Files\\PacSteamT\\SteamApps\\teho12\\garrysmod\\hl2.exe:*:Enabled:hl2"
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

    Remaining Files :


    File Backups: - C:\DOCUME~1\jr\Desktop\SDFix\backups\backups.zip

    Files with Hidden Attributes :

    Mon 24 Mar 2008 88 ..SHR --- "C:\WINDOWS\system32\01F09FBF89.sys"
    Tue 25 Mar 2008 2,516 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"

    Finished!
     
    teho12, Mar 25, 2008
    #10
  11. Hujo

    Hujo Guest


    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, Mar 25, 2008
    #11
  12. teho12

    teho12 Member

    Joined:
    Feb 21, 2008
    Messages:
    52
    Likes Received:
    0
    Trophy Points:
    16
    ComboFix 08-03-25.1 - jr 2008-03-25 20:26:34.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1304 [GMT 2:00]
    Running from: D:\temp\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((( Files Created from 2008-02-25 to 2008-03-25 )))))))))))))))))))))))))))))))
    .

    2008-03-25 18:48 . 2008-03-25 18:48 <DIR> d-------- C:\WINDOWS\ERUNT
    2008-03-25 17:48 . 2008-03-25 17:48 <DIR> d-------- C:\Documents and Settings\jr\Application Data\Malwarebytes
    2008-03-25 17:48 . 2008-03-25 17:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-03-24 19:01 . 2008-03-24 19:02 <DIR> d-------- C:\Program Files\Common Files\Corel
    2008-03-24 18:01 . 2008-03-24 18:01 <DIR> d-------- C:\Documents and Settings\jr\Application Data\Grisoft
    2008-03-24 18:01 . 2008-03-24 18:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-03-24 18:01 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-03-21 10:45 . 2008-03-25 19:56 17,416,224 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
    2008-03-21 10:45 . 2008-03-25 18:47 202,220 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
    2008-03-21 10:43 . 2008-03-21 10:43 <DIR> d-------- C:\Program Files\Zone Labs
    2008-03-21 10:43 . 2008-03-21 10:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
    2008-03-21 10:42 . 2008-03-25 19:57 <DIR> d-------- C:\WINDOWS\Internet Logs
    2008-03-21 10:42 . 2008-03-21 10:42 <DIR> d-------- C:\Program Files\Alwil Software
    2008-03-16 14:40 . 2008-03-18 15:05 <DIR> d-------- C:\Documents and Settings\jr\Application Data\F-Secure
    2008-03-16 14:35 . 2008-03-21 10:40 <DIR> d-------- C:\Program Files\Elisa Tietoturvapalvelu
    2008-03-16 14:35 . 2008-03-21 10:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
    2008-03-14 22:18 . 2008-03-24 19:06 88 -r-hs---- C:\WINDOWS\system32\01F09FBF89.sys
    2008-03-14 22:17 . 2008-03-14 22:18 <DIR> d-------- C:\Documents and Settings\jr\Application Data\Corel
    2008-03-14 22:17 . 2008-03-14 22:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Corel
    2008-03-14 22:13 . 2008-03-25 20:04 2,516 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
    2008-03-03 13:34 . 2008-03-03 13:34 93,782 --a------ C:\WINDOWS\Mopokorttikoulu Uninstaller.exe
    2008-03-02 21:41 . 2007-04-09 13:23 28,040 --a------ C:\WINDOWS\system32\mdimon.dll
    2008-03-02 21:41 . 2008-03-02 21:41 390 --a------ C:\WINDOWS\ODBC.INI
    2008-03-02 21:40 . 2008-03-08 09:03 <DIR> d-------- C:\Program Files\Microsoft Works
    2008-03-02 21:39 . 2008-03-02 21:41 <DIR> d-------- C:\WINDOWS\SHELLNEW
    2008-03-02 21:39 . 2008-03-02 21:39 <DIR> d-------- C:\Program Files\Microsoft.NET

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-03-25 18:27 --------- d-----w C:\Documents and Settings\jr\Application Data\Skype
    2008-03-25 17:58 --------- d-----w C:\Documents and Settings\jr\Application Data\skypePM
    2008-03-25 17:56 3,238,400 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
    2008-03-25 17:56 1,347,584 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
    2008-03-25 15:57 --------- d-----w C:\Documents and Settings\jr\Application Data\uTorrent
    2008-03-25 15:37 --------- d-----w C:\Program Files\Java
    2008-03-25 13:29 3,362 ----a-w C:\WINDOWS\system32\tmp.reg
    2008-03-22 17:17 --------- d-----w C:\Program Files\Windows Live Safety Center
    2008-03-20 12:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\fssg
    2008-03-18 13:07 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-03-18 13:07 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
    2008-03-18 13:06 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
    2008-03-11 14:42 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
    2008-03-03 11:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-02-22 13:16 --------- d-----w C:\Program Files\Microsoft Silverlight
    2008-02-21 08:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-02-21 02:05 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
    2008-02-21 02:05 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
    2008-02-20 21:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-02-20 21:53 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-02-20 20:19 --------- d-----w C:\Program Files\Common Files\Scanner
    2008-02-16 17:46 85,504 ----a-w C:\WINDOWS\system32\VACFix.exe
    2008-02-08 08:37 82,432 ----a-w C:\WINDOWS\system32\IEDFix.exe
    2008-02-02 08:02 --------- d-----w C:\Program Files\MUSICMATCH
    2008-02-02 08:01 --------- d-----w C:\Documents and Settings\jr\Application Data\Musicmatch
    2008-01-28 12:54 --------- d-----w C:\Documents and Settings\jr\Application Data\Yahoo!
    2008-01-26 18:07 --------- d-----w C:\Documents and Settings\jr\Application Data\Logitech
    2008-01-26 17:58 --------- d-----w C:\Program Files\Logitech
    2008-01-26 17:58 --------- d-----w C:\Program Files\Common Files\LogiShrd
    2008-01-26 17:58 --------- d-----w C:\Documents and Settings\jr\Application Data\InstallShield
    2008-01-26 17:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
    2008-01-26 17:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
    2008-01-26 17:45 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
    2008-01-26 17:45 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
    2008-01-26 17:44 --------- d-----w C:\Documents and Settings\jr\Application Data\Leadertech
    2008-01-26 17:35 --------- d-----w C:\Documents and Settings\jr\Application Data\CyberLink
    2008-01-25 20:36 503,808 ----a-w C:\WINDOWS\system32\msvcp71.dll
    2008-01-25 20:36 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
    2008-01-25 20:36 1,047,552 ----a-w C:\WINDOWS\system32\mfc71u.dll
    2008-01-25 20:35 89,088 ----a-w C:\WINDOWS\system32\atl71.dll
    2008-01-18 19:46 108,544 ------w C:\WINDOWS\system32\pxcpyi64.exe
    2008-01-18 19:46 104,960 ------w C:\WINDOWS\system32\pxinsi64.exe
    2008-01-05 13:06 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
    2008-01-04 16:24 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
    2008-01-04 16:23 81,920 ------r C:\WINDOWS\bwUnin-6.1.4.68-8876480L.exe
    2008-01-03 19:37 1,236,992 ----a-w C:\WINDOWS\system32\cpuz142.exe
    2007-11-18 16:49 22,328 ----a-w C:\Documents and Settings\jr\Application Data\PnkBstrK.sys
    2007-11-18 11:41 16,384 --sha-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
    2007-11-18 11:41 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    2007-11-18 11:41 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012007111820071119\index.dat
    2007-11-18 11:41 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
    "Steam"="d:\program files\valve\steam\steam.exe" [2008-03-24 21:16 1266936]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
    "nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
    "CTHelper"="CTHELPER.EXE" [2006-08-17 10:32 17920 C:\WINDOWS\CTHELPER.EXE]
    "CTxfiHlp"="CTXFIHLP.EXE" [2006-08-17 10:32 18944 C:\WINDOWS\system32\CTXFIHLP.EXE]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
    "RTHDCPL"="RTHDCPL.EXE" [2007-10-25 11:57 16855552 C:\WINDOWS\RTHDCPL.exe]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]
    "anysee_TR"="" []
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 03:10 55824 C:\WINDOWS\KHALMNPR.Exe]
    "Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 14:00 143360]
    "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
    "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-09-06 16:14 919016]
    "!AVG Anti-Spyware"="D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]
    "Corel Photo Downloader"="C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2007-08-28 12:00 531272]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "ShowDeskFix"="regsvr32 /s /n /i:u shell32" []

    C:\Documents and Settings\jr\Start Menu\Programs\Startup\
    Logitech tuoterekister”inti.lnk - C:\Program Files\Common Files\LogiShrd\eReg\SetPoint\eReg.exe [2007-08-02 11:49:24 2979080]
    Registration Ghost Recon Advanced Warfighter.LNK - D:\Program Files\Ubisoft\Ghost Recon Advanced Warfighter\Support\Register\RegistrationReminder.exe [2008-01-09 18:47:15 868352]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-01-27 17:18:24 784912]
    SetPointII.lnk - C:\Program Files\Logitech\SetPoint II\SetpointII.exe [2007-08-30 18:13:06 319488]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll 2007-11-15 10:10 72208 c:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "D:\\Program Files\\Valve\\Steam\\SteamApps\\cueman\\counter-strike source\\hl2.exe"=
    "D:\\Program Files\\Valve\\server\\srcds.exe"=
    "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
    "D:\\Program Files\\Valve\\Steam\\SteamApps\\cueman\\source sdk base\\hl2.exe"=
    "D:\\Program Files\\Valve\\Steam\\SteamApps\\cueman\\team fortress 2\\hl2.exe"=
    "D:\\Program Files\\Rockstar Games\\GTA San Andreas\\samp-server.exe"=
    "D:\\Program Files\\PacSteamT\\SteamApps\\teho12\\garrysmod\\hl2.exe"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=

    R1 AMTBDA_P861F;anysee Capture Service;C:\WINDOWS\system32\DRIVERS\anyseeTU.SYS [2007-07-24 10:51]
    S3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2006-08-17 10:16]

    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-03-25 20:27:38
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-03-25 20:27:58
    ComboFix-quarantined-files.txt 2008-03-25 18:27:56
    .
    2008-03-20 17:30:19 --- E O F ---
     
    teho12, Mar 25, 2008
    #12
  13. mind92

    mind92 Regular member

    Joined:
    Feb 2, 2008
    Messages:
    188
    Likes Received:
    0
    Trophy Points:
    26
    vieläkös netti hidastelee? pistäs sit seukki viestii uus hjt
     
    Last edited: Mar 26, 2008
    mind92, Mar 26, 2008
    #13

Share This Page