Viruksia poistettu, mutta toimii heikolla hapella

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Jarhu, Feb 21, 2009.

  1. Jarhu

    Jarhu Member

    Joined:
    Feb 21, 2009
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    Apua tarvis kun ei itse osaa. Toisilla käyttäjillä vain taustakuva näkyvillä, mutta tehtävienhallinta toimii. Tällä mitä käytän ilmoittaa "Järjestelmänvalvojaon on poistanut Tehtävien hallinnan käytöstä.". Samoin työpöydän taustakuva lukkiutunut ja Active desktop:ia ei voi palauttaa. Alla loki. Muutenkin toimii niin ja näin eli välillä ei lähdekone käynistyyn tai toimii hitaasti.


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 14:41:32, on 21.2.2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16791)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Memeo\AutoBackup\MemeoService.exe
    c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
    C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
    C:\Program Files\DNA Nettiturva\Anti-Virus\fsgk32st.exe
    C:\Program Files\DNA Nettiturva\Common\FSMA32.EXE
    C:\Program Files\DNA Nettiturva\Anti-Virus\FSGK32.EXE
    c:\APPS\HIDSERVICE\HIDSERVICE.exe
    C:\WINDOWS\system32\o2flash.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\DNA Nettiturva\Common\FSMB32.EXE
    C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
    c:\APPS\Powercinema\Kernel\TV\CLSched.exe
    C:\Program Files\DNA Nettiturva\Common\FCH32.EXE
    C:\Program Files\DNA Nettiturva\Common\FAMEH32.EXE
    C:\Program Files\DNA Nettiturva\Anti-Virus\fsqh.exe
    C:\Program Files\DNA Nettiturva\FSPC\fspc.exe
    C:\Program Files\DNA Nettiturva\FSAUA\program\fsaua.exe
    C:\Program Files\DNA Nettiturva\Anti-Virus\fssm32.exe
    C:\Program Files\DNA Nettiturva\FWES\Program\fsdfwd.exe
    C:\Program Files\DNA Nettiturva\FSAUA\program\fsus.exe
    C:\Program Files\DNA Nettiturva\Anti-Virus\fsav32.exe
    C:\WINDOWS\system32\userinit.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\WINDOWS\system32\WLan.exe
    C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
    C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
    C:\Apps\Powercinema\PCMService.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE
    C:\WINDOWS\VM_STI.EXE
    C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    C:\Program Files\DNA Nettiturva\Common\FSM32.EXE
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\DNA Nettiturva\FSGUI\fsguidll.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Logitech\Harmony Remote\HarmonyClient.exe
    C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
    C:\Program Files\Microsoft Office\Office\OSA.EXE
    C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe
    C:\Program Files\Microsoft Office\Office\WINWORD.EXE
    C:\WINDOWS\explorer.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\Program Files\DNA Nettiturva\FSGUI\scanwizard.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://format.packardbell.com/cgi-bin/redirect/?country=FI&range=AD&phase=6&key=SEARCH
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fin.htm
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\twex.exe,
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [High Definition Audio -ominaisuussivun pikakuvake] HDAShCut.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [WLAN] C:\WINDOWS\system32\WLan.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
    O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
    O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
    O4 - HKLM\..\Run: [EPSON Stylus DX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE /P26 "EPSON Stylus DX4800 Series" /O6 "USB001" /M "Stylus DX4800"
    O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC 200NC PC Camera
    O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [tvjbmonitor] C:\Program Files\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [Windows UDP's Control Service] wswc.exe
    O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\DNA Nettiturva\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\DNA Nettiturva\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Logitech Harmony Remote V5.lnk = C:\Program Files\Logitech\Harmony Remote\HarmonyClient.exe
    O4 - Global Startup: Microsoft Office Pikahaku.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
    O4 - Global Startup: Officen käynnistys.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
    O4 - Global Startup: TrayMin200.exe.lnk = ?
    O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?8b03b5bfb16948329e0894740b5c924e
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?8b03b5bfb16948329e0894740b5c924e
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\DNA Nettiturva\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\DNA Nettiturva\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\DNA Nettiturva\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fin.htm
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O23 - Service: F-Secure 2006 OEM (BackWeb Plug-in - 1245240) - Unknown owner - C:\PROGRA~1\F-SECU~1\backweb\1245240\Program\SERVIC~1.EXE (file missing)
    O23 - Service: Memeo AutoBackup (BMUService) - Memeo - C:\Program Files\Memeo\AutoBackup\MemeoService.exe
    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\DNA Nettiturva\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\DNA Nettiturva\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\DNA Nettiturva\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\DNA Nettiturva\Common\FSMA32.EXE
    O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\DNA Nettiturva\ORSP Client\fsorsp.exe
    O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

    --
    End of file - 13170 bytes
     
    Jarhu, Feb 21, 2009
    #1
  2. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina Fix checked

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Windows UDP's Control Service] wswc.exe
    O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe


    ==============

    1.Lataa Combofix.exe työpöydällesi yhdestä linkistä:
    Combofix1
    Combofix2

    Älä asenna palautus consolia
    2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

    ==============

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi




     
    Hujo, Feb 21, 2009
    #2
  3. Jarhu

    Jarhu Member

    Joined:
    Feb 21, 2009
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    Nyt näyttäisi tällä käyttäjällä pelittävän, mutta yhdellä käyttäjällä nyt se ongelma mikä tällä oli alussa eli "Järjestelmänvalvoja on on poistanut Tehtävien hallinnan käytöstä.". Samoin työpöydän taustakuva lukkiutunut.

    Tässä Combon logi:

    ComboFix 09-02-19.01 - Marik 2009-02-21 18:47:50.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1035.18.1014.396 [GMT 2:00]
    Sijainti: c:\documents and settings\Marik\Ty”p”yt„\ComboFix.exe
    AV: DNA Nettiturva 8.00 *On-access scanning enabled* (Updated)
    AV: Norton Internet Security *On-access scanning disabled* (Outdated)
    FW: DNA Nettiturva 8.00 *enabled*
    FW: Norton Internet Security *disabled*
    * Uusi palautuspiste luotu
    * Resident AV is active

    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\docume~1\Marik\LOCALS~1\Temp\tmp2.tmp
    c:\documents and settings\All Users\Application Data\CrucialSoft Ltd
    c:\documents and settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\20090213212815421.log
    c:\documents and settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG\20090212234730781.log
    c:\documents and settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG\20090213072727296.log
    c:\documents and settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG\20090213164915937.log
    c:\documents and settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG\20090213190906671.log
    c:\documents and settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG\20090213193645140.log
    c:\documents and settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe
    c:\windows\system32\drivers\seneka.sys
    c:\windows\system32\drivers\senekamvxsjnlm.sys
    c:\windows\system32\init32.exe
    c:\windows\system32\ntdll64.exe
    c:\windows\system32\senekaddtumyfy.dat
    c:\windows\system32\senekaitfnlsml.dat
    c:\windows\system32\twain32
    c:\windows\system32\twain32\local.ds
    c:\windows\system32\twain32\user.ds
    c:\windows\system32\twain32\user.ds.lll
    c:\windows\system32\UACwewboevb.dat
    c:\windows\system32\uniq.tll
    c:\windows\system32\warning.gif
    c:\windows\system32\win32hlp.cnf

    Saastunut kopio tiedostosta c:\windows\system32\userinit.exe löytyi ja poistettiin
    Puhdas kopio palautettiin paikasta - c:\qoobox\Quarantine\C\WINDOWS\system32\userinit.exe.vir

    .
    ((((((((((((((((((((((((((((((((((((((( Ajurit/Palvelut )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Service_seneka
    -------\Service_UACd.sys


    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-01-21 to 2009-02-21 )))))))))))))))))

    Ja tässä Malmwaren logi:

    Malwarebytes' Anti-Malware 1.34
    Tietokantaversio: 1785
    Windows 5.1.2600 Service Pack 3

    21.2.2009 20:38:55
    mbam-log-2009-02-21 (20-38-55).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|)
    Tarkistetut kohteet: 223654
    Kulunut aika: 1 hour(s), 11 minute(s), 53 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 8

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    C:\Documents and Settings\Jari\Local Settings\Temp\Install_Messenger.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{214986C9-2D86-4D74-8DFD-F9201943C32C}\RP669\A0323260.0xe (Trojan.SpamBot) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{214986C9-2D86-4D74-8DFD-F9201943C32C}\RP671\A0324310.0ll (Trojan.TDSS) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{214986C9-2D86-4D74-8DFD-F9201943C32C}\RP671\A0324311.0ll (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\UACwicgrskl.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.
    C:\WINDOWS\$NtServicePackUninstall$\wextract.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\uacinit.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\UACtfumowqp.log (Trojan.Agent) -> Quarantined and deleted successfully.
     
    Jarhu, Feb 21, 2009
    #3
  4. Hujo

    Hujo Guest

    jäipä tuo combofix loki lyhyeksi.

    ==========

    Lataa JavaRa ja pura se työpöydällesi.

    ***Sulje kaikki päällä olevat Internet Explorerin ikkunat ennen jatkamista!***

    * Tuplaklikkaa JavaRa.exeä käynnistääksesi ohjelma.
    * Valitse English pudotusvalikosta valitaksesi kieleksi englannin ja klikkaa Select.
    * Klikkaa Remove Older Versions poistaaksesi vanhat Java-versiot koneeltasi.
    * Klikkaa Yes kun pyydetään. Kun JavaRa on valmis, se ilmoittaa, että lokitiedosto on luotu. Klikkaa OK.
    * Lokitiedosto avautuu. Lähetä sen sisältö seuraavassa viestissäsi.
    4. Asenna uusin Java päivitys seuraavasta linkistä..

    Lataa täältä uusi java

    Rullaa alas kohteeseen Java Runtime Environment (JRE) 6 Update 12
    Paina Download
    Laita Platform -kohtaan Windows
    Ruksaa I agree to the Java SE Runtime Environment 6 License Agreement ja paina Continue
    Paina Windows Offline Installationin alapuolella jre-6u4-windows-i586-p.exe

    Tallenna tiedosto vaikka työpöydälle ja asenna se.

    5. Käynnistä kone uudelleen asennuksen jälkeen.
    6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).
    7. General-välilehdellä klikkaa Settings. Vedä liukusäädintä (Disk Space) pienemmälle.

    (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
    Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).

    8. Klikkaa Delete Files -nappia. Varmista että kaikki kaksi valintaa ovat rastitettuja:
    * Applications and Applets
    * Trace and Log Files

    Ja paina OK -nappia
    Huomaa: Tämä poistaa kaikki ladatut sovellukset ja appletit VÄLIMUISTISTA.

    9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.
    10. Välilehti Update: ota ruksi pois kohdasta Check for Updates automatically
    Valitse Never check
    11. Klikkaa Apply ja OK jättääksesi Java asetusikkunasi.

    ==============

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.
     
    Last edited by a moderator: Feb 21, 2009
    Hujo, Feb 21, 2009
    #4
  5. Jarhu

    Jarhu Member

    Joined:
    Feb 21, 2009
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    Vielä ei muutoksia käyttäjillä. Tässä logit:

    JavaRa 1.13 Removal Log.

    Report follows after line.

    ------------------------------------

    The JavaRa removal process was started on Sun Feb 22 00:18:26 2009

    Found and removed: C:\Windows\System32\jpicpl32.cpl

    Found and removed: Software\JavaSoft\Java2D\1.5.0_04

    Found and removed: Software\JavaSoft\Java2D\1.5.0_11

    Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}

    Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D510004

    Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510004

    Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D510004

    Found and removed: SOFTWARE\Classes\JavaPlugin.150_04

    Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.5.0.0

    Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.5.0_04

    Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5

    Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0_04

    Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D510004

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510004

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150040}

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.5.0_04

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.5.0_04\

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core1.zip

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core2.zip

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDlls\C:\Program Files\Common Files\Java\Update\Base Images\jre1.5.0.b64\core3.zip

    ------------------------------------

    Finished reporting.





    SDFix: Version 1.240
    Run by Jyri on su 22.02.2009 at 00:57

    Microsoft Windows XP [versio 5.1.2600]
    Running From: C:\Documents and Settings\Jyri\Ty”p”yt„\SDFix\SDFix

    Checking Services :


    Restoring Default Security Values
    Restoring Default Hosts File

    Rebooting


    Checking Files :

    No Trojan Files Found






    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-02-22 01:09:39
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    scanning hidden registry entries ...

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0


    Remaining Services :




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\APPS\\skype\\phone\\Skype.exe"="C:\\APPS\\skype\\phone\\Skype.exe:*:Enabled:Skype"
    "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
    "C:\\Program Files\\Logitech\\Harmony Remote\\HarmonyClient.exe"="C:\\Program Files\\Logitech\\Harmony Remote\\HarmonyClient.exe:*:Enabled:Logitech Harmony Remote Software V5"
    "C:\\Program Files\\Logitech\\Harmony Remote\\PatchHelper.exe"="C:\\Program Files\\Logitech\\Harmony Remote\\PatchHelper.exe:*:Enabled:Remote Control Software Patch Helper"
    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
    "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\F-Secure Internet Security\\backweb\\1245240\\Program\\fspex.exe"="C:\\Program Files\\F-Secure Internet Security\\backweb\\1245240\\Program\\fspex.exe:*:Enabled:F-Secure 2006 OEM"
    "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
    "C:\\Program Files\\Logitech\\Harmony Remote\\HarmonyClient.exe"="C:\\Program Files\\Logitech\\Harmony Remote\\HarmonyClient.exe:*:Enabled:Logitech Harmony Remote Software V5"
    "C:\\Program Files\\Logitech\\Harmony Remote\\HarmonyClient"="C:\\Program Files\\Logitech\\Harmony Remote\\HarmonyClient:*:Enabled:Logitech Harmony Remote Software V5"
    "C:\\Program Files\\Logitech\\Harmony Remote\\PatchHelper.exe"="C:\\Program Files\\Logitech\\Harmony Remote\\PatchHelper.exe:*:Enabled:Remote Control Software Patch Helper"
    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
    "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

    Remaining Files :



    Files with Hidden Attributes :

    Sat 20 May 2006 210 A.SHR --- "C:\BOOT.BAK"
    Wed 16 Jan 2008 6,219,320 A..H. --- "C:\Program Files\Picasa2\setup.exe"
    Mon 26 Jan 2009 1,740,632 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
    Mon 26 Jan 2009 5,365,592 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
    Mon 26 Jan 2009 2,144,088 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
    Tue 5 Dec 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
    Tue 13 May 2008 129,536 ...H. --- "C:\Documents and Settings\Jyri\Omat tiedostot\~WRL0140.tmp"
    Tue 13 May 2008 698,880 ...H. --- "C:\Documents and Settings\Jyri\Omat tiedostot\~WRL0280.tmp"
    Tue 13 May 2008 698,368 ...H. --- "C:\Documents and Settings\Jyri\Omat tiedostot\~WRL0691.tmp"
    Tue 13 May 2008 129,536 ...H. --- "C:\Documents and Settings\Jyri\Omat tiedostot\~WRL1049.tmp"
    Tue 13 May 2008 698,880 ...H. --- "C:\Documents and Settings\Jyri\Omat tiedostot\~WRL2015.tmp"
    Tue 13 May 2008 130,560 ...H. --- "C:\Documents and Settings\Jyri\Omat tiedostot\~WRL2020.tmp"
    Tue 13 May 2008 698,880 ...H. --- "C:\Documents and Settings\Jyri\Omat tiedostot\~WRL3715.tmp"
    Mon 30 Jun 2008 21,504 ...H. --- "C:\Documents and Settings\Marik\Omat tiedostot\~WRL0001.tmp"
    Tue 1 Jul 2008 21,504 ...H. --- "C:\Documents and Settings\Marik\Omat tiedostot\~WRL0003.tmp"
    Tue 1 Jul 2008 22,016 ...H. --- "C:\Documents and Settings\Marik\Omat tiedostot\~WRL1442.tmp"
    Tue 1 Jul 2008 21,504 ...H. --- "C:\Documents and Settings\Marik\Omat tiedostot\~WRL1719.tmp"
    Tue 1 Jul 2008 22,016 ...H. --- "C:\Documents and Settings\Marik\Omat tiedostot\~WRL2335.tmp"
    Thu 16 Sep 1999 334,848 A..H. --- "C:\Program Files\eGames\Oxide Special Edition\WCDEMO.EXE"
    Fri 1 Aug 2008 646 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti2.tmp"
    Sat 13 Oct 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
    Sun 15 Jan 2006 199,168 A..H. --- "C:\Documents and Settings\Marik\Omat tiedostot\marikan kouluty”\~WRL0002.tmp"
    Tue 17 Jan 2006 199,680 A..H. --- "C:\Documents and Settings\Marik\Omat tiedostot\marikan kouluty”\~WRL0876.tmp"
    Tue 17 Jan 2006 199,680 A..H. --- "C:\Documents and Settings\Marik\Omat tiedostot\marikan kouluty”\~WRL1788.tmp"
    Tue 17 Jan 2006 200,192 A..H. --- "C:\Documents and Settings\Marik\Omat tiedostot\marikan kouluty”\~WRL1940.tmp"
    Tue 17 Jan 2006 200,192 A..H. --- "C:\Documents and Settings\Marik\Omat tiedostot\marikan kouluty”\~WRL1984.tmp"
    Sun 11 Mar 2007 9,718 A..H. --- "C:\Program Files\Microsoft Office\Office\Pikavalintapalkki\Off1F.tmp"
    Sun 27 Jan 2008 262,144 A..H. --- "C:\System Volume Information\_restore{214986C9-2D86-4D74-8DFD-F9201943C32C}\RP662\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-1826257617-1010960120-4190168004-1006.bak"
    Sun 27 Jan 2008 262,144 A..H. --- "C:\System Volume Information\_restore{214986C9-2D86-4D74-8DFD-F9201943C32C}\RP663\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-1826257617-1010960120-4190168004-1006.bak"
    Sun 27 Jan 2008 262,144 A..H. --- "C:\System Volume Information\_restore{214986C9-2D86-4D74-8DFD-F9201943C32C}\RP664\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-1826257617-1010960120-4190168004-1006.bak"
    Sun 27 Jan 2008 262,144 A..H. --- "C:\System Volume Information\_restore{214986C9-2D86-4D74-8DFD-F9201943C32C}\RP665\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-1826257617-1010960120-4190168004-1006.bak"
    Sun 27 Jan 2008 262,144 A..H. --- "C:\System Volume Information\_restore{214986C9-2D86-4D74-8DFD-F9201943C32C}\RP666\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-1826257617-1010960120-4190168004-1006.bak"
    Sun 27 Jan 2008 262,144 A..H. --- "C:\System Volume Information\_restore{214986C9-2D86-4D74-8DFD-F9201943C32C}\RP667\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-1826257617-1010960120-4190168004-1006.bak"
    Sun 27 Jan 2008 262,144 A..H. --- "C:\System Volume Information\_restore{214986C9-2D86-4D74-8DFD-F9201943C32C}\RP668\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-1826257617-1010960120-4190168004-1006.bak"
    Sun 27 Jan 2008 262,144 A..H. --- "C:\System Volume Information\_restore{214986C9-2D86-4D74-8DFD-F9201943C32C}\RP672\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-1826257617-1010960120-4190168004-1006.bak"
    Sun 27 Jan 2008 262,144 A..H. --- "C:\System Volume Information\_restore{214986C9-2D86-4D74-8DFD-F9201943C32C}\RP673\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-1826257617-1010960120-4190168004-1006.bak"
    Sun 27 Jan 2008 262,144 A..H. --- "C:\System Volume Information\_restore{214986C9-2D86-4D74-8DFD-F9201943C32C}\RP674\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-1826257617-1010960120-4190168004-1006.bak"
    Sun 27 Jan 2008 262,144 A..H. --- "C:\System Volume Information\_restore{214986C9-2D86-4D74-8DFD-F9201943C32C}\RP675\snapshot\_REGISTRY_USER_USRCLASS_S-1-5-21-1826257617-1010960120-4190168004-1006.bak"
    Sat 8 Nov 2008 2,126 ..SH. --- "C:\Documents and Settings\Marik\Local Settings\Application Data\NewSoft\PageManager\7.11.00E\Setting\PM65.BAK"

    Finished!




    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 1:15:46, on 22.2.2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16791)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Memeo\AutoBackup\MemeoService.exe
    c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
    C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
    C:\Program Files\DNA Nettiturva\Anti-Virus\fsgk32st.exe
    C:\Program Files\DNA Nettiturva\Common\FSMA32.EXE
    c:\APPS\HIDSERVICE\HIDSERVICE.exe
    C:\Program Files\DNA Nettiturva\Anti-Virus\FSGK32.EXE
    C:\Program Files\DNA Nettiturva\Common\FSMB32.EXE
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\o2flash.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
    c:\APPS\Powercinema\Kernel\TV\CLSched.exe
    C:\Program Files\DNA Nettiturva\Common\FCH32.EXE
    C:\Program Files\DNA Nettiturva\Common\FAMEH32.EXE
    C:\Program Files\DNA Nettiturva\Anti-Virus\fsqh.exe
    C:\Program Files\DNA Nettiturva\FSPC\fspc.exe
    C:\Program Files\DNA Nettiturva\FSAUA\program\fsaua.exe
    C:\Program Files\DNA Nettiturva\Anti-Virus\fssm32.exe
    C:\Program Files\DNA Nettiturva\FWES\Program\fsdfwd.exe
    C:\Program Files\DNA Nettiturva\FSAUA\program\fsus.exe
    C:\Program Files\DNA Nettiturva\Anti-Virus\fsav32.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\igfxtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\WINDOWS\system32\WLan.exe
    C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
    C:\Apps\Powercinema\PCMService.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE
    C:\WINDOWS\VM_STI.EXE
    C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    C:\Program Files\DNA Nettiturva\Common\FSM32.EXE
    C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\Program Files\DNA Nettiturva\FSGUI\fsguidll.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
    C:\Program Files\Logitech\Harmony Remote\HarmonyClient.exe
    C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
    C:\Program Files\Microsoft Office\Office\OSA.EXE
    C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://format.packardbell.com/cgi-bin/redirect/?country=FI&range=AD&phase=6&key=SEARCH
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file://C:\APPS\IE\offline\fin.htm
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = file://C:\APPS\IE\offline\fin.htm
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [High Definition Audio -ominaisuussivun pikakuvake] HDAShCut.exe
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [WLAN] C:\WINDOWS\system32\WLan.exe
    O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
    O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
    O4 - HKLM\..\Run: [EPSON Stylus DX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE /P26 "EPSON Stylus DX4800 Series" /O6 "USB001" /M "Stylus DX4800"
    O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Philips SPC 200NC PC Camera
    O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [tvjbmonitor] C:\Program Files\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe
    O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\DNA Nettiturva\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\DNA Nettiturva\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
    O4 - Global Startup: Logitech Harmony Remote V5.lnk = C:\Program Files\Logitech\Harmony Remote\HarmonyClient.exe
    O4 - Global Startup: Microsoft Office Pikahaku.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
    O4 - Global Startup: Officen käynnistys.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
    O4 - Global Startup: TrayMin200.exe.lnk = ?
    O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?6036304cacb048cdbae000af17e47af1
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?6036304cacb048cdbae000af17e47af1
    O9 - Extra button: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\DNA Nettiturva\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\DNA Nettiturva\FSPC\fspcmsie.dll
    O9 - Extra 'Tools' menuitem: Lapsilukko... - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\DNA Nettiturva\FSPC\fspcmsie.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fin.htm
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O23 - Service: F-Secure 2006 OEM (BackWeb Plug-in - 1245240) - Unknown owner - C:\PROGRA~1\F-SECU~1\backweb\1245240\Program\SERVIC~1.EXE (file missing)
    O23 - Service: Memeo AutoBackup (BMUService) - Memeo - C:\Program Files\Memeo\AutoBackup\MemeoService.exe
    O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
    O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\DNA Nettiturva\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\DNA Nettiturva\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\DNA Nettiturva\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\DNA Nettiturva\Common\FSMA32.EXE
    O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\DNA Nettiturva\ORSP Client\fsorsp.exe
    O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

    --
    End of file - 12757 bytes





     
    Jarhu, Feb 21, 2009
    #5
  6. Hujo

    Hujo Guest

    minkäs laisessa hapessa on kone nyt
     
    Hujo, Feb 21, 2009
    #6
  7. Jarhu

    Jarhu Member

    Joined:
    Feb 21, 2009
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    Ongelma ei poistunut eli yhdellä käyttäjällä "Järjestelmänvalvoja on on poistanut Tehtävien hallinnan käytöstä.". Samoin työpöydän taustakuva lukkiutunut. Muuten näyttää pelittävän niin hyvin kuin tarpeen eli kiitoksia jo tähän mennessä saaduista neuvoista. Yritin poistaa kyseistä käyttäjää jossa ongelmia, mutta ilmoitti, että käyttäjällä on ohjelma päällä.
     
    Jarhu, Feb 22, 2009
    #7
  8. Hujo

    Hujo Guest

    ajas tuo combofix uudelleen

    Loki jäi vajaaksi
     
    Hujo, Feb 22, 2009
    #8
  9. Jarhu

    Jarhu Member

    Joined:
    Feb 21, 2009
    Messages:
    5
    Likes Received:
    0
    Trophy Points:
    11
    Poistin sen ongelmallisen käyttäjän, kun tytöllä näytti muutenkin olevan jo 2 käyttäjää. Alla Combofix:n logi.

    Kiitos kaikista neuvoista ;)


    ComboFix 09-02-21.01 - Marik 2009-02-22 19:28:21.3 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1035.18.1014.471 [GMT 2:00]
    Sijainti: c:\documents and settings\Marik\Työpöytä\ComboFix.exe
    AV: DNA Nettiturva 8.00 *On-access scanning disabled* (Updated)
    AV: Norton Internet Security *On-access scanning disabled* (Outdated)
    FW: DNA Nettiturva 8.00 *enabled*
    FW: Norton Internet Security *disabled*
    * Uusi palautuspiste luotu
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-01-22 to 2009-02-22 )))))))))))))))))
    .

    2009-02-22 17:41 . 2009-02-22 17:41 <KANSIO> d-------- c:\documents and settings\Jyri\Application Data\Nokia Multimedia Player
    2009-02-22 13:25 . 2009-02-22 13:26 <KANSIO> d-------- c:\documents and settings\Nick Jonasx333333333\Contacts
    2009-02-22 00:56 . 2009-02-22 00:56 579,072 --a------ c:\windows\system32\dllcache\user32.dll
    2009-02-22 00:51 . 2009-02-22 00:52 <KANSIO> d-------- c:\windows\ERUNT
    2009-02-22 00:25 . 2009-02-22 00:25 410,984 --a------ c:\windows\system32\deploytk.dll
    2009-02-22 00:25 . 2009-02-22 00:25 73,728 --a------ c:\windows\system32\javacpl.cpl
    2009-02-21 22:01 . 2009-02-21 22:01 <KANSIO> d-------- c:\documents and settings\J„rjestelm„nvalvoja
    2009-02-21 19:09 . 2009-02-21 19:09 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
    2009-02-21 19:09 . 2009-02-21 19:09 <KANSIO> d-------- c:\documents and settings\Marik\Application Data\Malwarebytes
    2009-02-21 19:09 . 2009-02-21 19:09 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-02-21 19:09 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
    2009-02-21 19:09 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
    2009-02-21 14:39 . 2009-02-21 14:39 <KANSIO> d-------- c:\program files\Trend Micro
    2009-02-21 13:43 . 2009-02-21 13:43 <KANSIO> d-------- c:\documents and settings\Marik\Application Data\Nokia Multimedia Player
    2009-02-17 20:49 . 2009-02-17 20:49 93 --a------ c:\windows\wininit.ini
    2009-02-13 22:24 . 2009-02-13 22:24 <KANSIO> d-------- c:\program files\WinPcap
    2009-02-13 22:23 . 2009-02-13 22:23 33,408 --a------ c:\windows\system32\drivers\fsbts.sys
    2009-02-13 19:14 . 2008-09-23 15:35 79,904 --a------ c:\windows\system32\drivers\fsdfw.sys
    2009-02-13 19:13 . 2009-02-21 12:45 <KANSIO> d-------- c:\program files\DNA Nettiturva
    2009-02-12 19:44 . 2009-02-12 19:44 <KANSIO> d-------- c:\program files\Spybot - Search & Destroy
    2009-02-12 19:44 . 2009-02-12 21:47 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-02-12 10:28 . 2009-02-12 10:28 118 --a------ c:\windows\system32\MRT.INI
    2009-02-07 19:30 . 2009-02-07 19:30 114 --a------ C:\mtsb.bat
    2009-02-07 19:08 . 2009-02-07 19:08 114 --a------ C:\fitm.bat
    2009-02-07 19:05 . 2009-02-07 19:05 116 --a------ C:\oujflm.bat
    2009-02-07 19:05 . 2009-02-07 19:05 114 --a------ C:\riej.bat
    2009-02-07 18:00 . 2009-02-07 18:00 117 --a------ C:\fbfzcco.bat
    2009-02-06 18:30 . 2009-02-06 18:30 <KANSIO> d-------- c:\documents and settings\Nick Jonasx333333333\Application Data\Share-to-Web-latauskansio
    2009-02-06 18:30 . 2009-02-06 18:30 <KANSIO> d-------- c:\documents and settings\Nick Jonasx333333333\Application Data\PC Suite
    2009-02-06 18:29 . 2006-08-02 02:57 <KANSIO> d-------- c:\documents and settings\Nick Jonasx333333333\WINDOWS
    2009-02-06 18:29 . 2006-08-02 02:57 <KANSIO> d--h----- c:\documents and settings\Nick Jonasx333333333\Verkkoympäristö
    2009-02-06 18:29 . 2009-02-22 13:27 <KANSIO> dr------- c:\documents and settings\Nick Jonasx333333333\Työpöytä
    2009-02-06 18:29 . 2006-08-02 02:57 <KANSIO> d--h----- c:\documents and settings\Nick Jonasx333333333\Tulostinympäristö
    2009-02-06 18:29 . 2009-02-06 18:30 <KANSIO> dr------- c:\documents and settings\Nick Jonasx333333333\Suosikit
    2009-02-06 18:29 . 2009-02-06 18:30 <KANSIO> dr------- c:\documents and settings\Nick Jonasx333333333\Omat tiedostot
    2009-02-06 18:29 . 2006-08-02 03:00 <KANSIO> d--h----- c:\documents and settings\Nick Jonasx333333333\Mallit
    2009-02-06 18:29 . 2006-08-02 03:00 <KANSIO> dr------- c:\documents and settings\Nick Jonasx333333333\Käynnistä-valikko
    2009-02-06 18:29 . 2006-08-02 02:57 <KANSIO> d-------- c:\documents and settings\Nick Jonasx333333333\Application Data\Symantec
    2009-02-06 18:29 . 2009-02-22 13:25 <KANSIO> d-------- c:\documents and settings\Nick Jonasx333333333
    2009-02-01 19:24 . 2009-02-01 19:24 <KANSIO> d-------- c:\documents and settings\Jyri\Phone Browser

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-02-22 11:37 --------- d-----w c:\program files\Google
    2009-02-22 11:29 --------- d-----w c:\documents and settings\Jyri\Application Data\AdobeUM
    2009-02-21 22:25 --------- d-----w c:\program files\Java
    2009-02-13 21:00 --------- d-----w c:\program files\Creative
    2009-02-13 17:13 --------- d-----w c:\documents and settings\All Users\Application Data\F-Secure
    2009-02-13 17:12 --------- d-----w c:\documents and settings\All Users\Application Data\fssg
    2009-02-13 17:03 --------- d-----w c:\documents and settings\All Users\Application Data\avg8
    2009-02-07 09:12 --------- d--h--w c:\program files\InstallShield Installation Information
    2009-01-16 19:16 3,594,752 ----a-w c:\windows\system32\dllcache\mshtml.dll
    2008-12-20 22:47 826,368 ----a-w c:\windows\system32\wininet.dll
    2008-12-20 22:47 826,368 ----a-w c:\windows\system32\dllcache\wininet.dll
    2008-12-20 22:47 671,232 ----a-w c:\windows\system32\dllcache\mstime.dll
    2008-12-20 22:47 477,696 ----a-w c:\windows\system32\dllcache\mshtmled.dll
    2008-12-20 22:47 44,544 ----a-w c:\windows\system32\dllcache\pngfilt.dll
    2008-12-20 22:47 233,472 ------w c:\windows\system32\dllcache\webcheck.dll
    2008-12-20 22:47 193,024 ----a-w c:\windows\system32\dllcache\msrating.dll
    2008-12-20 22:47 105,984 ------w c:\windows\system32\dllcache\url.dll
    2008-12-20 22:47 102,912 ------w c:\windows\system32\dllcache\occache.dll
    2008-12-20 22:47 1,160,192 ----a-w c:\windows\system32\dllcache\urlmon.dll
    2008-12-19 09:11 70,656 ------w c:\windows\system32\dllcache\ie4uinit.exe
    2008-12-19 09:10 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe
    2008-12-19 05:25 634,024 ------w c:\windows\system32\dllcache\iexplore.exe
    2008-12-19 05:23 161,792 ------w c:\windows\system32\dllcache\ieakui.dll
    2008-12-13 11:55 43,520 ----a-w c:\windows\system32\CmdLineExt03.dll
    2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
    2008-08-28 12:11 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Sivuhistoria\History.IE5\MSHist012008082820080829\index.dat
    .

    ((((((((((((((((((((((((((((( SnapShot@2009-02-21_19.01.08.68 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-02-21 22:51:22 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE
    + 2009-02-21 22:52:56 3,248,128 ----a-w c:\windows\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
    + 2009-02-21 22:52:56 163,840 ----a-w c:\windows\ERUNT\SDFIX\Users\00000002\UsrClass.dat
    + 2009-02-21 22:51:22 163,328 ----a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE
    + 2009-02-21 22:52:28 3,248,128 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
    + 2009-02-21 22:52:28 163,840 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
    - 2005-06-02 23:24:06 49,248 ----a-w c:\windows\system32\java.exe
    + 2009-02-21 22:25:22 144,792 ----a-w c:\windows\system32\java.exe
    - 2005-06-02 23:24:14 49,250 ----a-w c:\windows\system32\javaw.exe
    + 2009-02-21 22:25:23 144,792 ----a-w c:\windows\system32\javaw.exe
    - 2005-06-03 00:52:56 127,078 ----a-w c:\windows\system32\javaws.exe
    + 2009-02-21 22:25:23 148,888 ----a-w c:\windows\system32\javaws.exe
    + 2008-10-05 03:16:26 235,936 ----a-r c:\windows\system32\Macromed\Flash\FlashUtil10a.exe
    + 2009-02-22 11:37:04 89,102 ----a-w c:\windows\system32\Macromed\Flash\uninstall_activeX.exe
    + 2009-02-22 17:07:22 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_c0.dat
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    "LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-19 67128]
    "msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2009-02-22 171448]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-03-10 98394]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-03-10 688218]
    "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-11-28 98304]
    "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-11-28 77824]
    "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-11-28 118784]
    "WLAN"="c:\windows\system32\WLan.exe" [2005-11-25 221184]
    "Ulead AutoDetector v2"="c:\program files\Common Files\Ulead Systems\AutoDetector\monitor.exe" [2004-11-26 90112]
    "PCMService"="c:\apps\Powercinema\PCMService.exe" [2005-05-11 127118]
    "EPSON Stylus DX4800 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE" [2005-02-02 98304]
    "BigDogPath"="c:\windows\VM_STI.EXE" [2004-06-09 40960]
    "CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2005-05-19 57344]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]
    "PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 227328]
    "WinampAgent"="c:\program files\Winamp\winampa.exe" [2007-12-20 37376]
    "tvjbmonitor"="c:\program files\MMEDIA\TV Jukebox 3.0\tvjbMonitor.exe" [2006-12-26 53248]
    "Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 69632]
    "F-Secure Manager"="c:\program files\DNA Nettiturva\Common\FSM32.EXE" [2008-09-23 182936]
    "F-Secure TNB"="c:\program files\DNA Nettiturva\FSGUI\TNBUtil.exe" [2008-09-23 957024]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-22 148888]
    "High Definition Audio -ominaisuussivun pikakuvake"="HDAShCut.exe" [2005-01-07 c:\windows\system32\HdAShCut.exe]
    "RTHDCPL"="RTHDCPL.EXE" [2005-12-19 c:\windows\RTHDCPL.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
    "Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 1744896]

    c:\documents and settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-02-19 67128]
    Logitech Harmony Remote V5.lnk - c:\program files\Logitech\Harmony Remote\HarmonyClient.exe [2006-02-22 94295]
    Microsoft Office Pikahaku.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-09-22 111376]
    Officen k„ynnistys.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1997-09-22 51984]
    TrayMin200.exe.lnk - c:\program files\Philips\SPC 200NC PC Camera\TrayMin200.exe [2006-09-28 278528]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
    "NoSetActiveDesktop"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.dvacm"= c:\progra~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
    "msacm.ulmp3acm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm
    "msacm.mpegacm"= c:\progra~1\COMMON~1\ULEADS~1\MPEG\mpegacm.acm

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\APPS\\skype\\phone\\Skype.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\Logitech\\Harmony Remote\\HarmonyClient.exe"=
    "c:\\Program Files\\Logitech\\Harmony Remote\\PatchHelper.exe"=
    "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\MSN Messenger\\livecall.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "1700:TCP"= 1700:TCP:MioNet Remote Drive Access
    "1641:TCP"= 1641:TCP:MioNet Remote Drive Verification

    R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [2009-02-13 33408]
    R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [2009-02-13 79904]
    R0 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2006-02-27 34880]
    R0 O2SDRDR;O2SDRDR;c:\windows\system32\drivers\o2sd.sys [2006-02-20 29056]
    R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\DNA Nettiturva\HIPS\drivers\fshs.sys [2009-02-13 66720]
    R1 kioport;kioport Library Driver;c:\windows\system32\drivers\kioport.sys [2006-05-20 3968]
    R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-15 34064]
    R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\DNA Nettiturva\Anti-Virus\minifilter\fsgk.sys [2009-02-13 84096]
    R3 FSORSPClient;F-Secure ORSP Client;c:\program files\DNA Nettiturva\ORSP Client\fsorsp.exe [2009-02-13 55904]
    R3 kbd;Keyboard;c:\windows\system32\drivers\kbd.sys [2005-09-30 21504]
    R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);c:\windows\system32\drivers\RMSPPPOE.SYS [2002-10-02 31504]
    S2 BackWeb Plug-in - 1245240;F-Secure 2006 OEM;c:\progra~1\F-SECU~1\backweb\1245240\Program\SERVIC~1.EXE --> c:\progra~1\F-SECU~1\backweb\1245240\Program\SERVIC~1.EXE [?]
    S3 CIR;Hid Device;c:\windows\system32\drivers\CIR.sys [2005-09-30 5120]
    S3 EC168BDA;EC168BDA service;c:\windows\system32\drivers\EC168BDA.sys [2007-10-17 107904]
    S4 F-Secure Filter;F-Secure File System Filter;c:\program files\DNA Nettiturva\Anti-Virus\win2k\fsfilter.sys [2009-02-13 39776]
    S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\DNA Nettiturva\Anti-Virus\win2k\fsrec.sys [2009-02-13 25184]
    .
    'Ajoitetut tehtävät'-kansion sisältö

    2009-02-20 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]

    2009-02-22 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
    - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]

    2009-02-22 c:\windows\Tasks\Laajennettu takuu.job
    - c:\apps\SMP\PBCARNOT.EXE [2005-11-09 12:55]

    2009-02-22 c:\windows\Tasks\Master CD_DVD Creator.job
    - c:\apps\SMP\MCDCHECK.EXE [2005-11-08 14:26]
    .
    .
    ------- Täydentävä tarkistus -------
    .
    uStart Page = hxxp://www.google.fi/
    IE: &Estä tämä kohoikkuna - c:\program files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
    IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
    IE: Open in new background tab - c:\program files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?8b03b5bfb16948329e0894740b5c924e
    IE: Open in new foreground tab - c:\program files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?8b03b5bfb16948329e0894740b5c924e
    Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-02-22 19:32:59
    Windows 5.1.2600 Service Pack 3 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************
    .
    --------------------- LUKITUT REKISTERIAVAIMET ---------------------

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\�•€|ÿÿÿÿ"•€|þ»Ów*]
    "b049C053C7D38EE4AB9A00CB3B5D2472"="C?\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\PUBPLACE.HTT"
    .
    --------------------- Prosesseihin ladatut DLLt ---------------------

    - - - - - - - > 'winlogon.exe'(1000)
    c:\program files\DNA Nettiturva\FWES\Program\fsdc32.dll

    - - - - - - - > 'lsass.exe'(1056)
    c:\program files\DNA Nettiturva\FWES\Program\fsdc32.dll

    - - - - - - - > 'csrss.exe'(976)
    c:\program files\DNA Nettiturva\FWES\Program\fsdc32.dll
    .
    Valmistumisajankohta: 2009-02-22 19:34:58
    ComboFix-quarantined-files.txt 2009-02-22 17:34:55
    ComboFix2.txt 2009-02-21 20:01:49
    ComboFix3.txt 2009-02-21 17:01:58

    Ennen ajoa: 27 482 652 672 tavua vapaana
    Ajon jälkeen: 27,607,166,976 tavua vapaana

    232 --- E O F --- 2009-02-13 01:01:21
     
    Jarhu, Feb 22, 2009
    #9
  10. Hujo

    Hujo Guest

    Nyt tuon alla olevan lainauksen sisällön Kopioit / liität Tyhjään muistioon
    käynnistä nappi >apuohjelmat > muistio

    Tallenna nimellä

    Kohde: Työpöytä

    Tiedostonnimi: CFScript.txt

    Tallennusmuoto: Kaikki tiedostot

    Sitten raahaa CFScript ComboFix.exeen kuten alla.

    [​IMG]

    combofix työstää tulee sininen taulu paina numeroa 1 ja enter

    Laita tuleva loki tänne.

    Sammutat ja käynnistät koneen
     
    Hujo, Feb 22, 2009
    #10

Share This Page