No sitä mese viirusta!! + hjt-logi

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by angelmoon, Jun 11, 2008.

  1. angelmoon

    angelmoon Regular member

    Joined:
    Sep 16, 2003
    Messages:
    207
    Likes Received:
    0
    Trophy Points:
    26
    Kaverit puhunu että niitä kuvalinkkejä meseni on lähetelly. Olen ajanut Anti-Malwaren ja a-squared Freen, mutta liekö vielä puhdistunut. Meseä en vielä ole poistanut, mutta en ole sitä käyttänytkään.

    Täsä lokia vielä.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:44:26, on 11.6.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\a-squared Free\a2service.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\Program Files\Comodo\Firewall\cmdagent.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Comodo\Firewall\CPF.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1189507886546
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_06) -
    O16 - DPF: {CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_07) -
    O17 - HKLM\System\CCS\Services\Tcpip\..\{83CE7CD7-0037-4ADD-A737-0E6E337BEC94}: NameServer = 192.168.0.254
    O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe

    --
    End of file - 6083 bytes
     
    angelmoon, Jun 11, 2008
    #1
  2. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    Lähetäs tänne sen Antimalwaren logi niin katsotaan näkyykö siinä meseviruksen poisto ja tee alla olevien ohjeiden mukaan.

    1. Lataa Combofix.exe työpöydällesi jommastakummasta linkistä:
    Combofix.exe
    Combofix.exe

    Avaa Combofix.exe ja seuraa näyttöön tulevia ohjeita

    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
    Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne.

    Tyhjennä roskakori ja käynnistä koneesi uudelleen.

    Postita tänne seuraavat lokit:
    * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
    * (C:\ComboFix.txt) raportti
    *
     
    yaht, Jun 11, 2008
    #2
  3. angelmoon

    angelmoon Regular member

    Joined:
    Sep 16, 2003
    Messages:
    207
    Likes Received:
    0
    Trophy Points:
    26
    Pari päivää sitte tuo Anti-Malware löysi jotain ja poistin ne, mutta en tallentanut sitä raporttia. Tässä uusi raportti. Ja perässä Combofix raportti.

    Malwarebytes' Anti-Malware 1.17
    Tietokantaversio: 848

    0:22:40 12.6.2008
    mbam-log-6-12-2008 (00-22-40).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|E:\|F:\|G:\|)
    Tarkistetut kohteet: 119854
    Kulunut aika: 41 minute(s), 38 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)



    =================================================
    =================================================



    ComboFix 08-06-10.5 - Mane 2008-06-12 0:27:08.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1035.18.978 [GMT 3:00]
    Running from: C:\Documents and Settings\Mane\Työpöytä\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\MSINET.oca

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-11 to 2008-06-11 )))))))))))))))))
    .

    2008-06-11 19:53 . 2008-06-11 19:53 1,374 --a------ C:\WINDOWS\imsins.BAK
    2008-06-11 15:14 . 2008-04-14 18:59 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
    2008-06-11 15:14 . 2008-05-08 17:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
    2008-06-11 06:34 . 2008-06-11 06:35 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-06-11 06:34 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-06-11 06:34 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-06-11 06:30 . 2008-06-11 06:30 <KANSIO> d-------- C:\Documents and Settings\Mane\Application Data\Malwarebytes
    2008-06-11 06:30 . 2008-06-11 06:30 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-06-09 23:12 . 2008-06-11 22:49 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-06-09 23:12 . 2008-06-09 23:12 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-06-08 13:31 . 2008-06-08 13:31 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-06-07 00:57 . 2008-06-07 02:59 <KANSIO> d-------- C:\Program Files\a-squared Free
    2008-05-12 01:27 . 2008-05-12 01:27 <KANSIO> d-------- C:\WINDOWS\system32\fi
    2008-05-12 01:27 . 2008-05-12 01:27 <KANSIO> d-------- C:\WINDOWS\system32\bits
    2008-05-12 01:27 . 2008-05-12 01:27 <KANSIO> d-------- C:\WINDOWS\l2schemas
    2008-05-12 00:10 . 2008-04-14 19:11 870,784 --------- C:\WINDOWS\system32\ati3d1ag.dll
    2008-05-12 00:10 . 2008-04-14 19:11 377,984 --------- C:\WINDOWS\system32\ati2dvaa.dll
    2008-05-12 00:10 . 2008-04-14 19:11 233,472 --------- C:\WINDOWS\system32\azroles.dll
    2008-05-12 00:10 . 2008-04-14 19:11 136,192 --------- C:\WINDOWS\system32\aaclient.dll
    2008-05-12 00:10 . 2004-07-17 11:36 64,352 --------- C:\WINDOWS\system32\drivers\ativmc20.cod
    2008-05-12 00:10 . 2008-04-14 19:11 32,768 --------- C:\WINDOWS\system32\ativtmxx.dll
    2008-05-12 00:10 . 2008-04-14 19:12 23,040 --------- C:\WINDOWS\system32\ativmvxx.ax
    2008-05-12 00:10 . 2008-04-14 19:12 9,728 --------- C:\WINDOWS\system32\ativdaxx.ax
    2008-05-12 00:10 . 2008-04-14 19:11 7,168 --------- C:\WINDOWS\system32\bitsprx4.dll

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-11 19:52 --------- d-----w C:\Program Files\Mozilla Thunderbird
    2008-06-11 16:52 --------- d-----w C:\Documents and Settings\Mane\Application Data\uTorrent
    2008-06-11 05:48 --------- d-----w C:\Documents and Settings\Mane\Application Data\AVG7
    2008-06-04 11:54 --------- d-----w C:\Program Files\TVUPlayer
    2008-06-02 20:19 --------- d-----w C:\Program Files\The All-Seeing Eye
    2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
    2008-05-07 05:12 1,288,704 ----a-w C:\WINDOWS\system32\quartz.dll
    2008-04-26 17:51 --------- d-----w C:\Documents and Settings\Mane\Application Data\VideoReDoPlus
    2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-04-22 16:22 --------- d-----w C:\Program Files\Xbox Controller
    2008-04-21 15:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-04-16 21:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trymedia
    2008-04-14 16:27 1,804 ----a-w C:\WINDOWS\system32\dcache.bin
    2008-04-14 16:15 331,264 ----a-w C:\WINDOWS\system32\netsetup.exe
    2008-04-14 16:11 997,888 ----a-w C:\WINDOWS\system32\msgina.dll
    2008-04-14 16:10 9,344 ----a-w C:\WINDOWS\system32\framebuf.dll
    2008-04-14 16:09 3,072 ----a-w C:\WINDOWS\system32\dpnlobby.dll
    2008-04-14 16:09 3,072 ----a-w C:\WINDOWS\system32\dpnaddr.dll
    2008-04-14 16:09 285,696 ----a-w C:\WINDOWS\system32\atmfd.dll
    2008-04-14 16:09 16,896 ----a-w C:\WINDOWS\system32\cfgmgr32.dll
    2008-04-14 15:59 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
    2008-04-14 15:51 80,256 ----a-w C:\WINDOWS\system32\drivers\parport.sys
    2008-04-14 15:51 73,344 ----a-w C:\WINDOWS\system32\drivers\sr.sys
    2008-04-14 15:51 68,096 ----a-w C:\WINDOWS\system32\drivers\pci.sys
    2008-04-14 15:51 46,720 ----a-w C:\WINDOWS\system32\drivers\p3.sys
    2008-04-14 15:51 120,064 ----a-w C:\WINDOWS\system32\drivers\pcmcia.sys
    2008-04-14 15:49 2,191,360 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
    2008-04-14 15:49 2,068,224 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
    2008-04-14 15:48 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll
    2008-04-14 15:47 800,000 ----a-w C:\WINDOWS\system32\drivers\dmboot.sys
    2008-04-14 15:47 154,112 ----a-w C:\WINDOWS\system32\drivers\dmio.sys
    2008-04-14 15:46 79,872 ----a-w C:\WINDOWS\system32\msxml6r.dll
    2008-04-14 15:46 37,120 ----a-w C:\WINDOWS\system32\drivers\isapnp.sys
    2008-04-14 15:46 24,576 ----a-w C:\WINDOWS\system32\drivers\kbdclass.sys
    2008-04-14 15:46 14,720 ----a-w C:\WINDOWS\system32\drivers\kbdhid.sys
    2008-04-14 15:45 80,384 ------w C:\WINDOWS\system32\msshavmsg.dll
    2008-04-14 15:45 40,704 ----a-w C:\WINDOWS\system32\drivers\crusoe.sys
    2008-04-14 15:45 40,320 ------w C:\WINDOWS\system32\drivers\intelppm.sys
    2008-04-14 15:44 48,640 ----a-w C:\WINDOWS\system32\inetres.dll
    2008-04-14 15:43 556,032 ----a-w C:\WINDOWS\system32\shdoclc.dll
    2008-04-14 15:43 52,096 ----a-w C:\WINDOWS\system32\drivers\i8042prt.sys
    2008-04-14 15:42 64,512 ----a-w C:\WINDOWS\system32\drivers\serial.sys
    2008-04-14 15:42 25,600 ------w C:\WINDOWS\system32\drivers\hidbth.sys
    2008-04-14 15:41 9,728 ----a-w C:\WINDOWS\system32\gpkrsrc.dll
    2008-04-14 15:41 1,845,888 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-04-14 15:40 65,536 ----a-w C:\WINDOWS\system32\browselc.dll
    2008-04-14 15:40 57,472 ----a-w C:\WINDOWS\system32\drivers\redbook.sys
    2008-04-14 15:39 51,840 ----a-w C:\WINDOWS\system32\drivers\volsnap.sys
    2008-04-14 15:39 44,544 ----a-w C:\WINDOWS\system32\drivers\fips.sys
    2008-04-14 15:38 39,808 ----a-w C:\WINDOWS\system32\drivers\processr.sys
    2008-04-14 15:38 103,424 ----a-w C:\WINDOWS\system32\dpcdll.dll
    2008-04-14 15:37 41,728 ----a-w C:\WINDOWS\system32\drivers\amdk7.sys
    2008-04-14 15:37 41,344 ----a-w C:\WINDOWS\system32\drivers\amdk6.sys
    2008-04-14 15:36 30,080 ----a-w C:\WINDOWS\system32\drivers\modem.sys
    2008-04-14 15:36 23,040 ----a-w C:\WINDOWS\system32\drivers\mouclass.sys
    2008-04-14 15:36 187,904 ----a-w C:\WINDOWS\system32\drivers\acpi.sys
    2008-04-14 06:12 11,264 ------w C:\WINDOWS\system32\spnpinst.exe
    2008-04-14 06:11 992,256 ----a-w C:\WINDOWS\system32\setupapi.dll
    2008-04-14 06:11 423,936 ----a-w C:\WINDOWS\system32\licdll.dll
    2008-04-13 19:28 175,744 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys
    2008-04-13 19:21 162,816 ----a-w C:\WINDOWS\system32\drivers\netbt.sys
    2008-04-13 19:20 91,520 ----a-w C:\WINDOWS\system32\drivers\ndiswan.sys
    2008-04-13 19:20 361,344 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
    2008-04-13 19:20 182,656 ----a-w C:\WINDOWS\system32\drivers\ndis.sys
    2008-04-13 19:19 75,264 ----a-w C:\WINDOWS\system32\drivers\ipsec.sys
    2008-04-13 19:19 51,328 ----a-w C:\WINDOWS\system32\drivers\rasl2tp.sys
    2008-04-13 19:19 48,384 ----a-w C:\WINDOWS\system32\drivers\raspptp.sys
    2008-04-13 19:19 146,048 ----a-w C:\WINDOWS\system32\drivers\portcls.sys
    2008-04-13 19:19 138,112 ----a-w C:\WINDOWS\system32\drivers\afd.sys
    2008-04-13 19:17 83,072 ----a-w C:\WINDOWS\system32\drivers\wdmaud.sys
    2008-04-13 19:17 456,576 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
    2008-04-13 19:17 105,344 ----a-w C:\WINDOWS\system32\drivers\mup.sys
    2008-04-13 19:16 49,536 ----a-w C:\WINDOWS\system32\drivers\classpnp.sys
    2008-04-13 19:16 141,056 ----a-w C:\WINDOWS\system32\drivers\ks.sys
    2008-04-13 19:15 60,800 ----a-w C:\WINDOWS\system32\drivers\sysaudio.sys
    2008-04-13 19:15 574,976 ----a-w C:\WINDOWS\system32\drivers\ntfs.sys
    2008-04-13 19:15 334,848 ----a-w C:\WINDOWS\system32\drivers\srv.sys
    2008-04-13 19:14 63,744 ----a-w C:\WINDOWS\system32\drivers\cdfs.sys
    2008-04-13 19:14 143,744 ----a-w C:\WINDOWS\system32\drivers\fastfat.sys
    2008-04-13 19:00 225,664 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
    2008-04-13 19:00 19,072 ----a-w C:\WINDOWS\system32\drivers\tdi.sys
    2008-04-13 18:57 41,472 ----a-w C:\WINDOWS\system32\drivers\raspppoe.sys
    2008-04-13 18:57 40,576 ----a-w C:\WINDOWS\system32\drivers\ndproxy.sys
    2008-04-13 18:57 34,560 ----a-w C:\WINDOWS\system32\drivers\wanarp.sys
    2008-04-13 18:57 20,864 ----a-w C:\WINDOWS\system32\drivers\ipinip.sys
    2008-04-13 18:57 152,832 ----a-w C:\WINDOWS\system32\drivers\ipnat.sys
    2008-04-13 18:57 14,336 ----a-w C:\WINDOWS\system32\drivers\asyncmac.sys
    2008-04-13 18:57 10,112 ----a-w C:\WINDOWS\system32\drivers\ndistapi.sys
    2008-04-13 18:56 88,320 ----a-w C:\WINDOWS\system32\drivers\nwlnkipx.sys
    2008-04-13 18:56 69,120 ----a-w C:\WINDOWS\system32\drivers\psched.sys
    2008-04-13 18:56 35,072 ----a-w C:\WINDOWS\system32\drivers\msgpc.sys
    2008-04-13 18:56 34,688 ----a-w C:\WINDOWS\system32\drivers\netbios.sys
    2008-04-13 18:56 30,592 ----a-w C:\WINDOWS\system32\drivers\rndismp.sys
    2008-04-13 18:56 30,592 ------w C:\WINDOWS\system32\drivers\rndismpx.sys
    2008-04-13 18:56 12,800 ----a-w C:\WINDOWS\system32\drivers\usb8023.sys
    2008-04-13 18:56 12,800 ------w C:\WINDOWS\system32\drivers\usb8023x.sys
    2008-04-13 18:56 12,288 ----a-w C:\WINDOWS\system32\drivers\tunmp.sys
    2008-04-13 18:55 14,592 ----a-w C:\WINDOWS\system32\drivers\ndisuio.sys
    2008-04-13 18:54 11,264 ----a-w C:\WINDOWS\system32\drivers\irenum.sys
    2008-04-13 18:53 71,552 ----a-w C:\WINDOWS\system32\drivers\bridge.sys
    2007-01-15 20:01 56 --sh--r C:\WINDOWS\system32\6FB4B5F02D.sys
    2007-01-15 20:01 2,098 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 19:12 15360]
    "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Cmaudio"="cmicnfg.cpl" []
    "BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 19:12 110592 C:\WINDOWS\system32\bthprops.cpl]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
    "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35 90112]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57 282624]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
    "COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2008-04-10 11:46 1115728]
    "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-18 08:34 579584]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 19:12 15360]
    "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-10 12:11 219136]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.JPEG"= JPEGCODE.DLL
    "VIDC.MPEG"= JPEGCODE.DLL
    "VIDC.HFYU"= huffyuv.dll
    "vidc.DIV3"= DivXc32.dll
    "vidc.DIV4"= DivXc32f.dll
    "msacm.divxa32"= DivXa32.acm
    "vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UpdatesDisableNotify"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\uTorrent\\utorrent.exe"=
    "F:\\Pelit\\TrackMania United\\TmUnited.exe"=
    "C:\\WINDOWS\\system32\\dpvsetup.exe"=
    "F:\\Pelit\\Half-Life2\\Steam\\SteamApps\\angelmoon\\counter-strike source\\hl2.exe"=
    "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
    "C:\\Program Files\\TVAnts\\Tvants.exe"=
    "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
    "C:\\Program Files\\SopCast\\SopCast.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
    "F:\\Pelit\\FEAR\\FEAR.exe"=
    "F:\\Pelit\\FEAR\\FEARMP.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

    S3 PID_0920;Logitech QuickCam Express(PID_0920);C:\WINDOWS\system32\DRIVERS\LV532AV.SYS [2003-09-04 20:38]
    S3 s125bus;Sony Ericsson Device 125 driver (WDM);C:\WINDOWS\system32\DRIVERS\s125bus.sys [2007-04-24 11:33]
    S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s125mdfl.sys [2007-04-24 11:33]
    S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s125mdm.sys [2007-04-24 11:33]
    S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s125mgmt.sys [2007-04-24 11:33]
    S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s125obex.sys [2007-04-24 11:33]
    S3 TFBULK;Topfield USB client driver;C:\WINDOWS\system32\drivers\TfBulk.sys [2003-08-26 14:11]
    S3 XPAD;XBox Controllers USB HID Mini Driver;C:\WINDOWS\system32\Drivers\xpad.sys [2004-08-01 19:18]

    *Newly Created Service* - CATCHME
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-12 00:28:41
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-06-12 0:30:59
    ComboFix-quarantined-files.txt 2008-06-11 21:30:16

    Pre-Run: 6,768,943,104 tavua vapaana
    Post-Run: 6,770,364,416 tavua vapaana

    218 --- E O F --- 2008-06-11 16:55:01
     
    angelmoon, Jun 11, 2008
    #3
  4. angelmoon

    angelmoon Regular member

    Joined:
    Sep 16, 2003
    Messages:
    207
    Likes Received:
    0
    Trophy Points:
    26
    Ja sitten näillä ohjeilla:

    Tyhjennä roskakori ja käynnistä koneesi uudelleen.

    Postita tänne seuraavat lokit:
    * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
    * (C:\ComboFix.txt) raportti


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 0:42:36, on 12.6.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\a-squared Free\a2service.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Comodo\Firewall\CPF.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
    C:\Program Files\Comodo\Firewall\cmdagent.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\Comodo\Firewall\CPF.exe" /background
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1189507886546
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_06) -
    O16 - DPF: {CAFEEFAC-0014-0001-0007-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1_07) -
    O17 - HKLM\System\CCS\Services\Tcpip\..\{83CE7CD7-0037-4ADD-A737-0E6E337BEC94}: NameServer = 192.168.0.254
    O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe

    --
    End of file - 6226 bytes


    ===============================
    ===============================

    ComboFix 08-06-10.5 - Mane 2008-06-12 0:27:08.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1035.18.978 [GMT 3:00]
    Running from: C:\Documents and Settings\Mane\Työpöytä\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\MSINET.oca

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-11 to 2008-06-11 )))))))))))))))))
    .

    2008-06-11 19:53 . 2008-06-11 19:53 1,374 --a------ C:\WINDOWS\imsins.BAK
    2008-06-11 15:14 . 2008-04-14 18:59 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
    2008-06-11 15:14 . 2008-05-08 17:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
    2008-06-11 06:34 . 2008-06-11 06:35 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-06-11 06:34 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-06-11 06:34 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-06-11 06:30 . 2008-06-11 06:30 <KANSIO> d-------- C:\Documents and Settings\Mane\Application Data\Malwarebytes
    2008-06-11 06:30 . 2008-06-11 06:30 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-06-09 23:12 . 2008-06-11 22:49 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-06-09 23:12 . 2008-06-09 23:12 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-06-08 13:31 . 2008-06-08 13:31 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-06-07 00:57 . 2008-06-07 02:59 <KANSIO> d-------- C:\Program Files\a-squared Free
    2008-05-12 01:27 . 2008-05-12 01:27 <KANSIO> d-------- C:\WINDOWS\system32\fi
    2008-05-12 01:27 . 2008-05-12 01:27 <KANSIO> d-------- C:\WINDOWS\system32\bits
    2008-05-12 01:27 . 2008-05-12 01:27 <KANSIO> d-------- C:\WINDOWS\l2schemas
    2008-05-12 00:10 . 2008-04-14 19:11 870,784 --------- C:\WINDOWS\system32\ati3d1ag.dll
    2008-05-12 00:10 . 2008-04-14 19:11 377,984 --------- C:\WINDOWS\system32\ati2dvaa.dll
    2008-05-12 00:10 . 2008-04-14 19:11 233,472 --------- C:\WINDOWS\system32\azroles.dll
    2008-05-12 00:10 . 2008-04-14 19:11 136,192 --------- C:\WINDOWS\system32\aaclient.dll
    2008-05-12 00:10 . 2004-07-17 11:36 64,352 --------- C:\WINDOWS\system32\drivers\ativmc20.cod
    2008-05-12 00:10 . 2008-04-14 19:11 32,768 --------- C:\WINDOWS\system32\ativtmxx.dll
    2008-05-12 00:10 . 2008-04-14 19:12 23,040 --------- C:\WINDOWS\system32\ativmvxx.ax
    2008-05-12 00:10 . 2008-04-14 19:12 9,728 --------- C:\WINDOWS\system32\ativdaxx.ax
    2008-05-12 00:10 . 2008-04-14 19:11 7,168 --------- C:\WINDOWS\system32\bitsprx4.dll

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-11 19:52 --------- d-----w C:\Program Files\Mozilla Thunderbird
    2008-06-11 16:52 --------- d-----w C:\Documents and Settings\Mane\Application Data\uTorrent
    2008-06-11 05:48 --------- d-----w C:\Documents and Settings\Mane\Application Data\AVG7
    2008-06-04 11:54 --------- d-----w C:\Program Files\TVUPlayer
    2008-06-02 20:19 --------- d-----w C:\Program Files\The All-Seeing Eye
    2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
    2008-05-07 05:12 1,288,704 ----a-w C:\WINDOWS\system32\quartz.dll
    2008-04-26 17:51 --------- d-----w C:\Documents and Settings\Mane\Application Data\VideoReDoPlus
    2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-04-22 16:22 --------- d-----w C:\Program Files\Xbox Controller
    2008-04-21 15:12 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-04-16 21:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trymedia
    2008-04-14 16:27 1,804 ----a-w C:\WINDOWS\system32\dcache.bin
    2008-04-14 16:15 331,264 ----a-w C:\WINDOWS\system32\netsetup.exe
    2008-04-14 16:11 997,888 ----a-w C:\WINDOWS\system32\msgina.dll
    2008-04-14 16:10 9,344 ----a-w C:\WINDOWS\system32\framebuf.dll
    2008-04-14 16:09 3,072 ----a-w C:\WINDOWS\system32\dpnlobby.dll
    2008-04-14 16:09 3,072 ----a-w C:\WINDOWS\system32\dpnaddr.dll
    2008-04-14 16:09 285,696 ----a-w C:\WINDOWS\system32\atmfd.dll
    2008-04-14 16:09 16,896 ----a-w C:\WINDOWS\system32\cfgmgr32.dll
    2008-04-14 15:59 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
    2008-04-14 15:51 80,256 ----a-w C:\WINDOWS\system32\drivers\parport.sys
    2008-04-14 15:51 73,344 ----a-w C:\WINDOWS\system32\drivers\sr.sys
    2008-04-14 15:51 68,096 ----a-w C:\WINDOWS\system32\drivers\pci.sys
    2008-04-14 15:51 46,720 ----a-w C:\WINDOWS\system32\drivers\p3.sys
    2008-04-14 15:51 120,064 ----a-w C:\WINDOWS\system32\drivers\pcmcia.sys
    2008-04-14 15:49 2,191,360 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
    2008-04-14 15:49 2,068,224 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
    2008-04-14 15:48 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll
    2008-04-14 15:47 800,000 ----a-w C:\WINDOWS\system32\drivers\dmboot.sys
    2008-04-14 15:47 154,112 ----a-w C:\WINDOWS\system32\drivers\dmio.sys
    2008-04-14 15:46 79,872 ----a-w C:\WINDOWS\system32\msxml6r.dll
    2008-04-14 15:46 37,120 ----a-w C:\WINDOWS\system32\drivers\isapnp.sys
    2008-04-14 15:46 24,576 ----a-w C:\WINDOWS\system32\drivers\kbdclass.sys
    2008-04-14 15:46 14,720 ----a-w C:\WINDOWS\system32\drivers\kbdhid.sys
    2008-04-14 15:45 80,384 ------w C:\WINDOWS\system32\msshavmsg.dll
    2008-04-14 15:45 40,704 ----a-w C:\WINDOWS\system32\drivers\crusoe.sys
    2008-04-14 15:45 40,320 ------w C:\WINDOWS\system32\drivers\intelppm.sys
    2008-04-14 15:44 48,640 ----a-w C:\WINDOWS\system32\inetres.dll
    2008-04-14 15:43 556,032 ----a-w C:\WINDOWS\system32\shdoclc.dll
    2008-04-14 15:43 52,096 ----a-w C:\WINDOWS\system32\drivers\i8042prt.sys
    2008-04-14 15:42 64,512 ----a-w C:\WINDOWS\system32\drivers\serial.sys
    2008-04-14 15:42 25,600 ------w C:\WINDOWS\system32\drivers\hidbth.sys
    2008-04-14 15:41 9,728 ----a-w C:\WINDOWS\system32\gpkrsrc.dll
    2008-04-14 15:41 1,845,888 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-04-14 15:40 65,536 ----a-w C:\WINDOWS\system32\browselc.dll
    2008-04-14 15:40 57,472 ----a-w C:\WINDOWS\system32\drivers\redbook.sys
    2008-04-14 15:39 51,840 ----a-w C:\WINDOWS\system32\drivers\volsnap.sys
    2008-04-14 15:39 44,544 ----a-w C:\WINDOWS\system32\drivers\fips.sys
    2008-04-14 15:38 39,808 ----a-w C:\WINDOWS\system32\drivers\processr.sys
    2008-04-14 15:38 103,424 ----a-w C:\WINDOWS\system32\dpcdll.dll
    2008-04-14 15:37 41,728 ----a-w C:\WINDOWS\system32\drivers\amdk7.sys
    2008-04-14 15:37 41,344 ----a-w C:\WINDOWS\system32\drivers\amdk6.sys
    2008-04-14 15:36 30,080 ----a-w C:\WINDOWS\system32\drivers\modem.sys
    2008-04-14 15:36 23,040 ----a-w C:\WINDOWS\system32\drivers\mouclass.sys
    2008-04-14 15:36 187,904 ----a-w C:\WINDOWS\system32\drivers\acpi.sys
    2008-04-14 06:12 11,264 ------w C:\WINDOWS\system32\spnpinst.exe
    2008-04-14 06:11 992,256 ----a-w C:\WINDOWS\system32\setupapi.dll
    2008-04-14 06:11 423,936 ----a-w C:\WINDOWS\system32\licdll.dll
    2008-04-13 19:28 175,744 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys
    2008-04-13 19:21 162,816 ----a-w C:\WINDOWS\system32\drivers\netbt.sys
    2008-04-13 19:20 91,520 ----a-w C:\WINDOWS\system32\drivers\ndiswan.sys
    2008-04-13 19:20 361,344 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
    2008-04-13 19:20 182,656 ----a-w C:\WINDOWS\system32\drivers\ndis.sys
    2008-04-13 19:19 75,264 ----a-w C:\WINDOWS\system32\drivers\ipsec.sys
    2008-04-13 19:19 51,328 ----a-w C:\WINDOWS\system32\drivers\rasl2tp.sys
    2008-04-13 19:19 48,384 ----a-w C:\WINDOWS\system32\drivers\raspptp.sys
    2008-04-13 19:19 146,048 ----a-w C:\WINDOWS\system32\drivers\portcls.sys
    2008-04-13 19:19 138,112 ----a-w C:\WINDOWS\system32\drivers\afd.sys
    2008-04-13 19:17 83,072 ----a-w C:\WINDOWS\system32\drivers\wdmaud.sys
    2008-04-13 19:17 456,576 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
    2008-04-13 19:17 105,344 ----a-w C:\WINDOWS\system32\drivers\mup.sys
    2008-04-13 19:16 49,536 ----a-w C:\WINDOWS\system32\drivers\classpnp.sys
    2008-04-13 19:16 141,056 ----a-w C:\WINDOWS\system32\drivers\ks.sys
    2008-04-13 19:15 60,800 ----a-w C:\WINDOWS\system32\drivers\sysaudio.sys
    2008-04-13 19:15 574,976 ----a-w C:\WINDOWS\system32\drivers\ntfs.sys
    2008-04-13 19:15 334,848 ----a-w C:\WINDOWS\system32\drivers\srv.sys
    2008-04-13 19:14 63,744 ----a-w C:\WINDOWS\system32\drivers\cdfs.sys
    2008-04-13 19:14 143,744 ----a-w C:\WINDOWS\system32\drivers\fastfat.sys
    2008-04-13 19:00 225,664 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
    2008-04-13 19:00 19,072 ----a-w C:\WINDOWS\system32\drivers\tdi.sys
    2008-04-13 18:57 41,472 ----a-w C:\WINDOWS\system32\drivers\raspppoe.sys
    2008-04-13 18:57 40,576 ----a-w C:\WINDOWS\system32\drivers\ndproxy.sys
    2008-04-13 18:57 34,560 ----a-w C:\WINDOWS\system32\drivers\wanarp.sys
    2008-04-13 18:57 20,864 ----a-w C:\WINDOWS\system32\drivers\ipinip.sys
    2008-04-13 18:57 152,832 ----a-w C:\WINDOWS\system32\drivers\ipnat.sys
    2008-04-13 18:57 14,336 ----a-w C:\WINDOWS\system32\drivers\asyncmac.sys
    2008-04-13 18:57 10,112 ----a-w C:\WINDOWS\system32\drivers\ndistapi.sys
    2008-04-13 18:56 88,320 ----a-w C:\WINDOWS\system32\drivers\nwlnkipx.sys
    2008-04-13 18:56 69,120 ----a-w C:\WINDOWS\system32\drivers\psched.sys
    2008-04-13 18:56 35,072 ----a-w C:\WINDOWS\system32\drivers\msgpc.sys
    2008-04-13 18:56 34,688 ----a-w C:\WINDOWS\system32\drivers\netbios.sys
    2008-04-13 18:56 30,592 ----a-w C:\WINDOWS\system32\drivers\rndismp.sys
    2008-04-13 18:56 30,592 ------w C:\WINDOWS\system32\drivers\rndismpx.sys
    2008-04-13 18:56 12,800 ----a-w C:\WINDOWS\system32\drivers\usb8023.sys
    2008-04-13 18:56 12,800 ------w C:\WINDOWS\system32\drivers\usb8023x.sys
    2008-04-13 18:56 12,288 ----a-w C:\WINDOWS\system32\drivers\tunmp.sys
    2008-04-13 18:55 14,592 ----a-w C:\WINDOWS\system32\drivers\ndisuio.sys
    2008-04-13 18:54 11,264 ----a-w C:\WINDOWS\system32\drivers\irenum.sys
    2008-04-13 18:53 71,552 ----a-w C:\WINDOWS\system32\drivers\bridge.sys
    2007-01-15 20:01 56 --sh--r C:\WINDOWS\system32\6FB4B5F02D.sys
    2007-01-15 20:01 2,098 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 19:12 15360]
    "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Cmaudio"="cmicnfg.cpl" []
    "BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 19:12 110592 C:\WINDOWS\system32\bthprops.cpl]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
    "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35 90112]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57 282624]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
    "COMODO Firewall Pro"="C:\Program Files\Comodo\Firewall\CPF.exe" [2008-04-10 11:46 1115728]
    "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-18 08:34 579584]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 19:12 15360]
    "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-10 12:11 219136]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.JPEG"= JPEGCODE.DLL
    "VIDC.MPEG"= JPEGCODE.DLL
    "VIDC.HFYU"= huffyuv.dll
    "vidc.DIV3"= DivXc32.dll
    "vidc.DIV4"= DivXc32f.dll
    "msacm.divxa32"= DivXa32.acm
    "vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UpdatesDisableNotify"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\uTorrent\\utorrent.exe"=
    "F:\\Pelit\\TrackMania United\\TmUnited.exe"=
    "C:\\WINDOWS\\system32\\dpvsetup.exe"=
    "F:\\Pelit\\Half-Life2\\Steam\\SteamApps\\angelmoon\\counter-strike source\\hl2.exe"=
    "C:\\Program Files\\TVUPlayer\\TVUPlayer.exe"=
    "C:\\Program Files\\TVAnts\\Tvants.exe"=
    "C:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
    "C:\\Program Files\\SopCast\\SopCast.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
    "F:\\Pelit\\FEAR\\FEAR.exe"=
    "F:\\Pelit\\FEAR\\FEARMP.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

    S3 PID_0920;Logitech QuickCam Express(PID_0920);C:\WINDOWS\system32\DRIVERS\LV532AV.SYS [2003-09-04 20:38]
    S3 s125bus;Sony Ericsson Device 125 driver (WDM);C:\WINDOWS\system32\DRIVERS\s125bus.sys [2007-04-24 11:33]
    S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s125mdfl.sys [2007-04-24 11:33]
    S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s125mdm.sys [2007-04-24 11:33]
    S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s125mgmt.sys [2007-04-24 11:33]
    S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s125obex.sys [2007-04-24 11:33]
    S3 TFBULK;Topfield USB client driver;C:\WINDOWS\system32\drivers\TfBulk.sys [2003-08-26 14:11]
    S3 XPAD;XBox Controllers USB HID Mini Driver;C:\WINDOWS\system32\Drivers\xpad.sys [2004-08-01 19:18]

    *Newly Created Service* - CATCHME
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-12 00:28:41
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-06-12 0:30:59
    ComboFix-quarantined-files.txt 2008-06-11 21:30:16

    Pre-Run: 6,768,943,104 tavua vapaana
    Post-Run: 6,770,364,416 tavua vapaana

    218 --- E O F --- 2008-06-11 16:55:01
     
    angelmoon, Jun 11, 2008
    #4
  5. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    Ihan puhtaalta tuo näyttää javan päivitys viellä.

    Javan päivitys ja välimuistin tyhjennys:

    1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
    2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
    Niissä pitäisi olla seuraava kuva vieressä:[​IMG]

    3. Valitse kaikki entiset Java versiosi ja valitse Poista.
    4. Asenna uusin Java päivitys seuraavasta linkistä..
    5. Käynnistä kone uudelleen asennuksen jälkeen:

    http://java.sun.com/javase/downloads/index.jsp

    Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u6

    Paina Download

    Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.

    6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).

    7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.

    (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
    Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).

    8. Varmista että kaikki kaksi valintaa ovat rastitettuja:

    *Applications and Applets

    *Trace and Log Files

    Ja paina OK -nappia

    9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.

    10. Klikkaa OK jättääksesi Java asetusikkunasi.
     
    yaht, Jun 12, 2008
    #5
  6. angelmoon

    angelmoon Regular member

    Joined:
    Sep 16, 2003
    Messages:
    207
    Likes Received:
    0
    Trophy Points:
    26
    Kiitos... Täytyy tuo java duunata vielä kuntoon.
     
    angelmoon, Jun 12, 2008
    #6

Share This Page