ensin oli näin:http://keskustelu.afterdawn.com/thread_view.cfm/733306 ja tänään kun avasin konetta ei enään työpöytää, vikasietotilassa toimii, normaalisti sisässä toimii vain tehtävähallinnan kautta ... tässä combofix loki: ComboFix 08-12-25.04 - J„rjestelm„nvalvoja 2008-12-26 12:20:38.2 - NTFSx86 Sijainti: C:\ComboFix.exe VAROITUS - PALAUTUSKONSOLIA EI OLE ASENNETTU !! . (((((((((((((((((((((((((((((((((((((( Muut poistot )))))))))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Jõrjestelmõnvalvoja\Local Settings\Temporary Internet Files\ c:\documents and settings\M÷lli\Local Settings\Temporary Internet Files\ . ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-11-26 to 2008-12-26 ))))))))))))))))) . 2008-12-26 11:56 . 2008-12-26 11:56 0 --a------ c:\windows\nsreg.dat 2008-12-26 11:43 . 2008-12-26 11:43 2,886,797 -ra------ C:\ComboFix.exe 2008-12-25 19:43 . 2008-12-25 19:43 <KANSIO> d-------- c:\program files\Opera 10 Preview 2008-12-25 17:53 . 2008-12-25 17:53 153,088 --a------ c:\windows\triedit.dll 2008-12-25 17:52 . 2008-12-25 17:52 117,248 --a------ c:\windows\DHTMLED.OCX 2008-12-25 16:38 . 2008-12-25 16:38 <KANSIO> d-------- c:\documents and settings\M”lli 2008-12-25 13:31 . 2008-12-25 13:45 <KANSIO> d-------- C:\Kaspersky 2008-12-24 16:39 . 2008-12-24 16:39 230 --a------ c:\windows\system32\spupdsvc.inf 2008-12-24 16:24 . 2008-12-24 16:24 <KANSIO> d-------- c:\program files\Opera 2008-12-24 15:35 . 2001-10-05 15:59 12,160 --a------ c:\windows\system32\drivers\mouhid.sys 2008-12-24 15:35 . 2001-10-05 15:59 12,160 --a--c--- c:\windows\system32\dllcache\mouhid.sys 2008-12-24 15:34 . 2001-08-17 22:02 9,600 --a------ c:\windows\system32\drivers\hidusb.sys 2008-12-24 15:34 . 2001-08-17 22:02 9,600 --a--c--- c:\windows\system32\dllcache\hidusb.sys 2008-12-23 21:50 . 2008-12-23 21:50 <KANSIO> d-------- c:\program files\blocksum 2008-12-23 21:42 . 2008-12-23 21:43 <KANSIO> d-------- c:\windows\system32\Adobe 2008-12-23 21:36 . 2008-12-23 21:36 <KANSIO> d-------- c:\windows\.jagex_cache_32 2008-12-23 21:36 . 2008-12-24 21:09 31 --a------ c:\documents and settings\Jere\jagex_runescape_preferences.dat 2008-12-23 21:35 . 2008-12-23 21:35 <KANSIO> d-------- c:\windows\Sun 2008-12-23 21:34 . 2008-12-23 21:33 410,984 --a------ c:\windows\system32\deploytk.dll 2008-12-23 21:34 . 2008-12-23 21:33 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-12-23 21:33 . 2008-12-23 21:33 <KANSIO> d-------- c:\program files\Java 2008-12-12 15:20 . 2007-11-22 13:38 <KANSIO> d--h----- c:\documents and settings\Jere\Verkkoymp„rist” 2008-12-12 15:20 . 2008-12-24 16:54 <KANSIO> d-------- c:\documents and settings\Jere\Ty”p”yt„ 2008-12-12 15:20 . 2007-11-22 13:38 <KANSIO> d--h----- c:\documents and settings\Jere\Tulostinymp„rist” 2008-12-12 15:20 . 2008-12-23 21:54 <KANSIO> dr------- c:\documents and settings\Jere\Suosikit 2008-12-12 15:20 . 2008-12-23 21:46 <KANSIO> dr------- c:\documents and settings\Jere\Omat tiedostot 2008-12-12 15:20 . 2007-11-22 11:51 <KANSIO> d--h----- c:\documents and settings\Jere\Mallit 2008-12-12 15:20 . 2007-11-22 13:38 <KANSIO> dr------- c:\documents and settings\Jere\K„ynnist„-valikko 2008-12-12 15:20 . 2008-12-24 17:26 <KANSIO> d-------- c:\documents and settings\Jere 2008-12-12 07:56 . 2008-12-25 16:25 <KANSIO> d-------- c:\windows\system32\drivers\Avg 2008-12-12 07:56 . 2008-12-12 07:56 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys 2008-12-12 07:56 . 2008-12-12 07:56 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys 2008-12-12 07:56 . 2008-12-12 07:56 10,520 --a------ c:\windows\system32\avgrsstx.dll 2008-12-12 07:55 . 2008-12-12 07:55 <KANSIO> d-------- c:\program files\AVG 2008-12-12 07:55 . 2008-12-12 07:55 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\avg8 2008-12-12 07:36 . 2008-12-26 12:24 2,310,176 --ahs---- c:\windows\system32\drivers\fidbox.dat 2008-12-12 07:36 . 2008-12-26 11:47 27,404 --ahs---- c:\windows\system32\drivers\fidbox.idx 2008-12-12 07:34 . 2008-12-12 07:34 <KANSIO> d-------- c:\program files\ZoneAlarmSB 2008-12-12 07:32 . 2008-12-12 07:32 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\MailFrontier 2008-12-12 07:32 . 2008-07-09 09:05 75,248 --a------ c:\windows\zllsputility.exe 2008-12-12 07:32 . 2004-04-27 04:40 11,264 --a------ c:\windows\system32\SpOrder.dll 2008-12-12 07:32 . 2008-12-12 07:34 4,212 ---h----- c:\windows\system32\zllictbl.dat 2008-12-12 07:31 . 2008-12-12 07:32 <KANSIO> d-------- c:\windows\system32\ZoneLabs 2008-12-12 07:31 . 2008-12-12 07:31 <KANSIO> d-------- c:\program files\Zone Labs 2008-12-12 07:31 . 2008-07-09 09:05 1,086,952 --a------ c:\windows\system32\zpeng24.dll 2008-12-12 07:31 . 2008-12-26 12:18 352,918 --a------ c:\windows\system32\vsconfig.xml 2008-12-12 07:29 . 2008-12-26 12:21 <KANSIO> d-------- c:\windows\Internet Logs 2008-12-12 07:28 . 2008-10-16 22:18 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll 2008-12-12 07:28 . 2007-04-17 11:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat 2008-12-12 07:28 . 2007-03-08 07:10 1,011,712 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui 2008-12-12 07:28 . 2008-10-16 22:18 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll 2008-12-12 07:28 . 2008-10-16 22:18 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll 2008-12-12 07:28 . 2008-10-16 22:18 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll 2008-12-12 07:28 . 2008-10-16 22:18 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll 2008-12-12 07:28 . 2008-10-16 22:18 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll 2008-12-12 07:28 . 2008-10-16 15:11 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe . (((((((((((((((((((((((((((((((((((( Find3M-raportti )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-23 19:24 372,480 ----a-w c:\windows\system32\drivers\CBG54.SYS 2008-12-23 19:24 372,480 ----a-w C:\CBG54.sys 2008-12-12 04:56 --------- d-----w c:\program files\F-Secure 2008-11-12 12:35 --------- d-----w c:\documents and settings\All Users\Application Data\F-Secure 2008-11-12 12:05 --------- d-----w c:\program files\CONEXANT 2008-10-23 13:00 283,648 ----a-w c:\windows\system32\gdi32.dll 2008-10-16 12:13 202,776 ----a-w c:\windows\system32\wuweb.dll 2008-10-16 12:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll 2008-10-16 12:12 561,688 ----a-w c:\windows\system32\wuapi.dll 2008-10-16 12:12 323,608 ----a-w c:\windows\system32\wucltui.dll 2008-10-16 12:09 92,696 ----a-w c:\windows\system32\cdm.dll 2008-10-16 12:09 51,224 ----a-w c:\windows\system32\wuauclt.exe 2008-10-16 12:09 43,544 ----a-w c:\windows\system32\wups2.dll 2008-10-16 12:08 34,328 ----a-w c:\windows\system32\wups.dll 2008-10-16 12:07 208,744 ----a-w c:\windows\system32\muweb.dll 2008-10-16 10:38 659,456 ----a-w c:\windows\system32\wininet.dll 2008-10-03 10:17 247,326 ----a-w c:\windows\system32\strmdll.dll . ((((((((((((((((((((((((((((( snapshot@2008-12-26_12.14.51.35 ))))))))))))))))))))))))))))))))))))))))) . - 2008-12-26 09:53:14 40,152 ----a-w c:\windows\system32\perfc009.dat + 2008-12-26 10:22:32 40,152 ----a-w c:\windows\system32\perfc009.dat - 2008-12-26 09:53:14 48,356 ----a-w c:\windows\system32\perfc00B.dat + 2008-12-26 10:22:32 48,356 ----a-w c:\windows\system32\perfc00B.dat - 2008-12-26 09:53:14 311,172 ----a-w c:\windows\system32\perfh009.dat + 2008-12-26 10:22:32 311,172 ----a-w c:\windows\system32\perfh009.dat - 2008-12-26 09:53:14 283,744 ----a-w c:\windows\system32\perfh00B.dat + 2008-12-26 10:22:32 283,744 ----a-w c:\windows\system32\perfh00B.dat . (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet ))))))))))))))))))))))))))))))))))))))))))))) . . *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-12-24 1261336] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-09-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Adobe Reader Speed Launch.lnk] path=c:\documents and settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys\Adobe Reader Speed Launch.lnk backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA] --a------ 2003-06-25 15:30 335872 c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-12-23 21:33 136600 c:\program files\Java\jre6\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIModeChange] --a------ 2001-09-04 15:24 28672 c:\windows\system32\Ati2mdxx.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CARPService] --a------ 2003-05-21 15:35 4608 c:\windows\system32\carpserv.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "ose"=3 (0x3) "MDM"=2 (0x2) "JavaQuickStarterService"=2 (0x2) "Ati HotKey Poller"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= . . ------- Täydentävä tarkistus ------- . uStart Page = hxxp://www.google.fi/ TCP: {82E59643-5C81-4001-B623-B6F30970E20B} = 194.211.206.4 FF - ProfilePath - . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-26 12:23:49 Windows 5.1.2600 Service Pack 2 NTFS tarkistaa piilotettuja prosesseja ... tarkistaa piilotettuja käynnistysarvoja ... tarkistaa piilotettuja tiedostoja ... tarkistus on valmis piilotetut tiedostot: 0 ************************************************************************** . --------------------- Prosesseihin ladatut DLLt --------------------- - - - - - - - > 'winlogon.exe'(520) c:\windows\system32\avgrsstx.dll - - - - - - - > 'lsass.exe'(584) c:\windows\system32\avgrsstx.dll . Valmistumisajankohta: 2008-12-26 12:25:36 ComboFix-quarantined-files.txt 2008-12-26 10:25:32 ComboFix2.txt 2008-12-26 10:15:40 Ennen ajoa: 54ÿ791ÿ589ÿ888 tavua vapaana Ajon jõlkeen: 54,765,314,048 tavua vapaana 164 --- E O F --- 2008-12-25 10:32:12 hijackthis--> ajan heti ku pääsen takas vikasietotilaan.. olipas tääkin hieno lahja t.kat
hijack loki tässä: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:59:15, on 26.12.2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Safe mode Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=http://root.xxx.fi/intranet O15 - Trusted Zone: http://*.xxx.fi (HKLM) O15 - Trusted Zone: http://xxx.xxx.fi (HKLM) O15 - Trusted Zone: http://*.xxx.fi (HKLM) O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1230133455497 O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JS...1/&filename=jinstall-6u11-windows-i586-jc.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = xx.fi O17 - HKLM\Software\..\Telephony: DomainName = xx.fi O17 - HKLM\System\CCS\Services\Tcpip\..\{82E59643-5C81-4001-B623-B6F30970E20B}: NameServer = xxx.xxx.xxx.4 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = xx.fi O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = xxx.fi O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = xxx.fi O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 4261 bytes t.kat
hei, ehtiskö joku joulukiireitään vilaisee näitä lokeja?? tässä malware loki, jossa ei mitään olutkaan... Malwarebytes' Anti-Malware 1.31 Tietokantaversio: 1550 Windows 5.1.2600 Service Pack 2 26.12.2008 13:53:41 mbam-log-2008-12-26 (13-53-41).txt Tarkistustyyppi: Täysi tarkistus (C:\|) Tarkistetut kohteet: 70006 Kulunut aika: 34 minute(s), 12 second(s) Saastuneita muistiprosesseja: 0 Saastuneita muistimoduuleja: 0 Saastuneita rekisteriavaimia: 0 Saastuneita rekisteriarvoja: 0 Saastuneita rekisterikohteita: 0 Saastuneita hakemistoja: 0 Saastuneita tiedostoja: 0 Saastuneita muistiprosesseja: (Haitallisia kohteita ei löydetty) Saastuneita muistimoduuleja: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriavaimia: (Haitallisia kohteita ei löydetty) Saastuneita rekisteriarvoja: (Haitallisia kohteita ei löydetty) Saastuneita rekisterikohteita: (Haitallisia kohteita ei löydetty) Saastuneita hakemistoja: (Haitallisia kohteita ei löydetty) Saastuneita tiedostoja: (Haitallisia kohteita ei löydetty) t.kat
