W32/LowZones.ASU ilmeisesti messenger virus

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by aggre, Jun 1, 2008.

  1. aggre

    aggre Member

    Joined:
    Jun 1, 2008
    Messages:
    28
    Likes Received:
    0
    Trophy Points:
    11
    Juu siis ongelmana on, että Norman virus control ilmoittelee W32/LowZones.ASU viruksesta (ja muutamasta muustakin) aina vaan uudelleen. Kone hidastelee käynnistätteässä. Toivottavasti joku voisi hieman analysoida logia. Kiitos etukäteen!

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:47:54, on 1.6.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    F:\WINDOWS\System32\smss.exe
    F:\WINDOWS\system32\csrss.exe
    F:\WINDOWS\system32\winlogon.exe
    F:\WINDOWS\system32\services.exe
    F:\WINDOWS\system32\lsass.exe
    F:\Program Files\Norman\Npm\Bin\Elogsvc.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\System32\svchost.exe
    F:\Program Files\Norman\Npm\Bin\Zanda.exe
    F:\Program Files\Norman\npm\bin\nvoy.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\system32\LEXBCES.EXE
    F:\WINDOWS\system32\spoolsv.exe
    F:\WINDOWS\system32\CTsvcCDA.exe
    F:\WINDOWS\system32\nvsvc32.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\system32\wdfmgr.exe
    F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    F:\Program Files\Canon\CAL\CALMAIN.exe
    F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
    F:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    F:\Program Files\Norman\Nvc\bin\nvcoas.exe
    F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    F:\WINDOWS\System32\alg.exe
    F:\WINDOWS\System32\svchost.exe
    F:\WINDOWS\system32\wscntfy.exe
    F:\WINDOWS\Explorer.EXE
    F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
    F:\Program Files\QuickTime\qttask.exe
    F:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
    F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    F:\WINDOWS\system32\RunDLL32.exe
    F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe
    F:\Program Files\Norman\Npm\bin\ZLH.EXE
    F:\Util2\BitDefender\bdagent.exe
    F:\WINDOWS\system32\rundll32.exe
    F:\WINDOWS\system32\rundll32.exe
    F:\WINDOWS\system32\Rundll32.exe
    F:\WINDOWS\system32\lexpps.exe
    F:\WINDOWS\system32\ctfmon.exe
    F:\Program Files\Norman\Nvc\BIN\NIP.EXE
    F:\Program Files\Norman\Nvc\bin\cclaw.exe
    F:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    F:\Util2\BitDefender\vsserv.exe
    F:\Util2\SeaMonkey\seamonkey.exe
    F:\Program Files\HijackThis\HijackThis.exe
    F:\WINDOWS\system32\wbem\wmiprvse.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: Burn4Free Toolbar - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - F:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
    O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Lexmark X1100 Series] "F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Gainward] F:\WINDOWS\TBPanel.exe /A
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [Norman ZANDA] "F:\Program Files\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH
    O4 - HKLM\..\Run: [BDAgent] "F:\Util2\BitDefender\bdagent.exe"
    O4 - HKLM\..\Run: [cc967efb] rundll32.exe "F:\WINDOWS\system32\wkblrkfj.dll",b
    O4 - HKLM\..\Run: [000000af] rundll32.exe "F:\WINDOWS\system32\mtpkoxjf.dll",b
    O4 - HKLM\..\Run: [BM079ac215] Rundll32.exe "F:\WINDOWS\system32\coqiaqtn.dll",s
    O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "F:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Reader\reader_sl.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - F:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - F:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - F:\Program Files\Norman\Npm\Bin\Elogsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - F:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    O23 - Service: Norman NJeeves - Unknown owner - F:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    O23 - Service: Norman ZANDA - Norman ASA - F:\Program Files\Norman\Npm\Bin\Zanda.exe
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - F:\Program Files\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
    O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - F:\Program Files\Norman\npm\bin\nvoy.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: ServiceLayer - Nokia. - F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - F:\Util2\BitDefender\vsserv.exe
    O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

    --
    End of file - 7622 bytes
     
    aggre, Jun 1, 2008
    #1
  2. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    Kyllä tuolla jotain örkkimörkkejä näyttäisi olevan.

    Eli lataa koneellesi Malwarebytes Anti-Malware

    http://www.malwarebytes.org/mbam.php

    Päivitä ohjelma ja suorita täysi skannaus postaa mbam logi ja uusi hijackthis logi.

    Huom. kun mbam on skannannut ja löytänyt jotain paina poista valitut kohteet (tai joku semmonen nappi ei tule nyt millään mieleen minkä niminen oli) ja lähetä se logi mikä aukeaa poistojen jälkeen.
     
    yaht, Jun 1, 2008
    #2
  3. aggre

    aggre Member

    Joined:
    Jun 1, 2008
    Messages:
    28
    Likes Received:
    0
    Trophy Points:
    11
    Malwarebytes' Anti-Malware 1.14
    Tietokantaversio: 814

    6:36:02 3.6.2008
    mbam-log-6-3-2008 (06-36-01).txt

    Tarkistustyyppi: Täysi tarkistus (F:\|)
    Tarkistetut kohteet: 237254
    Kulunut aika: 2 hour(s), 29 minute(s), 58 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 2
    Saastuneita rekisteriavaimia: 16
    Saastuneita rekisteriarvoja: 4
    Saastuneita rekisterikohteita: 1
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 17

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    F:\WINDOWS\system32\flpkivhy.dll (Trojan.Vundo) -> Unloaded module successfully.
    F:\WINDOWS\system32\geBuSMgG.dll (Trojan.Vundo) -> Unloaded module successfully.

    Saastuneita rekisteriavaimia:
    HKEY_CLASSES_ROOT\CLSID\{689dd469-bde7-4343-9334-f87c2a818e38} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{689dd469-bde7-4343-9334-f87c2a818e38} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{06e12c36-760f-4d92-8509-5e5dbf12c423} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06e12c36-760f-4d92-8509-5e5dbf12c423} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{f0e738ca-4e59-446f-b34a-6bc26fb2c735} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f0e738ca-4e59-446f-b34a-6bc26fb2c735} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{2eeddfba-0615-48de-86ad-7d8b561feac4} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2eeddfba-0615-48de-86ad-7d8b561feac4} (Trojan.Vundo) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

    Saastuneita rekisteriarvoja:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{06e12c36-760f-4d92-8509-5e5dbf12c423} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{f0e738ca-4e59-446f-b34a-6bc26fb2c735} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cc967efb (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM079ac215 (Trojan.Agent) -> Quarantined and deleted successfully.

    Saastuneita rekisterikohteita:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: f:\windows\system32\gebusmgg -> Delete on reboot.

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    F:\WINDOWS\system32\flpkivhy.dll (Trojan.Vundo) -> Delete on reboot.
    F:\Documents and Settings\Iina\Local Settings\Temporary Internet Files\Content.IE5\GTYZSXUN\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
    F:\Documents and Settings\Noora1\Local Settings\Temporary Internet Files\Content.IE5\4OXTTLT7\kb767887[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
    F:\Documents and Settings\Noora1\Local Settings\Temporary Internet Files\Content.IE5\MSXZOIFW\css4[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
    F:\Documents and Settings\Noora1\Local Settings\Temporary Internet Files\Content.IE5\QRDGMO44\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
    F:\System Volume Information\_restore{4682C78B-01EC-4A3C-9FBE-75E175E99283}\RP720\A0159579.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    F:\System Volume Information\_restore{4682C78B-01EC-4A3C-9FBE-75E175E99283}\RP721\A0159614.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
    F:\System Volume Information\_restore{4682C78B-01EC-4A3C-9FBE-75E175E99283}\RP721\A0159695.com (Backdoor.Bot) -> Quarantined and deleted successfully.
    F:\System Volume Information\_restore{4682C78B-01EC-4A3C-9FBE-75E175E99283}\RP721\A0160782.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    F:\System Volume Information\_restore{4682C78B-01EC-4A3C-9FBE-75E175E99283}\RP722\A0166999.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    F:\Util\Mozilla---\regxpcom.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
    F:\WINDOWS\system32\efcccCTl.dll_old (Trojan.Vundo) -> Quarantined and deleted successfully.
    F:\WINDOWS\system32\hblipvxe.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    F:\WINDOWS\system32\mtpkoxjf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    F:\WINDOWS\system32\uvsptnin.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    F:\WINDOWS\system32\igiccuop.dll (Trojan.Agent) -> Delete on reboot.
    F:\WINDOWS\system32\geBuSMgG.dll (Trojan.Vundo) -> Delete on reboot.


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:47:05, on 3.6.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    F:\WINDOWS\System32\smss.exe
    F:\WINDOWS\system32\csrss.exe
    F:\WINDOWS\system32\winlogon.exe
    F:\WINDOWS\system32\services.exe
    F:\WINDOWS\system32\lsass.exe
    F:\Program Files\Norman\Npm\Bin\Elogsvc.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\System32\svchost.exe
    F:\Program Files\Norman\Npm\Bin\Zanda.exe
    F:\Program Files\Norman\npm\bin\nvoy.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\Explorer.EXE
    F:\WINDOWS\system32\LEXBCES.EXE
    F:\WINDOWS\system32\LEXPPS.EXE
    F:\WINDOWS\system32\spoolsv.exe
    F:\WINDOWS\system32\CTsvcCDA.exe
    F:\WINDOWS\system32\nvsvc32.exe
    F:\WINDOWS\system32\svchost.exe
    F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
    F:\WINDOWS\system32\wdfmgr.exe
    F:\Program Files\QuickTime\qttask.exe
    F:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
    F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    F:\WINDOWS\system32\RunDLL32.exe
    F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe
    F:\Program Files\Norman\Npm\bin\ZLH.EXE
    F:\Util2\BitDefender\bdagent.exe
    F:\WINDOWS\system32\ctfmon.exe
    F:\Program Files\Canon\CAL\CALMAIN.exe
    F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    F:\Program Files\Adobe\Reader\reader_sl.exe
    F:\Program Files\Norman\Nvc\BIN\NIP.EXE
    F:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    F:\Util2\BitDefender\vsserv.exe
    F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
    F:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    F:\Program Files\Norman\Nvc\bin\nvcoas.exe
    F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    F:\WINDOWS\system32\wscntfy.exe
    F:\Program Files\Norman\Nvc\bin\cclaw.exe
    F:\WINDOWS\System32\alg.exe
    F:\WINDOWS\System32\svchost.exe
    F:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
    F:\Util2\SeaMonkey\seamonkey.exe
    F:\Program Files\HijackThis\HijackThis.exe
    F:\WINDOWS\system32\wbem\wmiprvse.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - F:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: Burn4Free Toolbar Helper - {60BF5EE3-0105-4858-AD98-17C19F86B042} - F:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {A9791714-8C66-4EE6-9A2B-8925B23450DE} - F:\WINDOWS\system32\efcccCTl.dll (file missing)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: Burn4Free Toolbar - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - F:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
    O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Lexmark X1100 Series] "F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Gainward] F:\WINDOWS\TBPanel.exe /A
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [Norman ZANDA] "F:\Program Files\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH
    O4 - HKLM\..\Run: [BDAgent] "F:\Util2\BitDefender\bdagent.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "F:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Reader\reader_sl.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - F:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O20 - Winlogon Notify: rqRIaXRI - rqRIaXRI.dll (file missing)
    O20 - Winlogon Notify: wvUOefFv - wvUOefFv.dll (file missing)
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - F:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - F:\Program Files\Norman\Npm\Bin\Elogsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - F:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    O23 - Service: Norman NJeeves - Unknown owner - F:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    O23 - Service: Norman ZANDA - Norman ASA - F:\Program Files\Norman\Npm\Bin\Zanda.exe
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - F:\Program Files\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
    O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - F:\Program Files\Norman\npm\bin\nvoy.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: ServiceLayer - Nokia. - F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - F:\Util2\BitDefender\vsserv.exe
    O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

    --
    End of file - 8125 bytes
     
    aggre, Jun 2, 2008
    #3
  4. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    Fixaa seuraavat rivit hjt:llä

    O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O20 - Winlogon Notify: rqRIaXRI - rqRIaXRI.dll (file missing)
    O20 - Winlogon Notify: wvUOefFv - wvUOefFv.dll (file missing)

    Poista järjestelmän palautus käytöstä ja boottaa kone bootin jälkeen skannaa viellä malwrebytesillä ja postaa sen logi ja uusi hjt logi

    http://support.microsoft.com/kb/310405/fi

    (Muista päivittää malwarebytesi ennen skannausta)
     
    Last edited: Jun 3, 2008
    yaht, Jun 3, 2008
    #4
  5. aggre

    aggre Member

    Joined:
    Jun 1, 2008
    Messages:
    28
    Likes Received:
    0
    Trophy Points:
    11
    Malwarebytes' Anti-Malware 1.14
    Tietokantaversio: 818

    6:17:23 4.6.2008
    mbam-log-6-4-2008 (06-17-23).txt

    Tarkistustyyppi: Täysi tarkistus (F:\|)
    Tarkistetut kohteet: 228055
    Kulunut aika: 2 hour(s), 29 minute(s), 52 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 2

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    F:\WINDOWS\system32\flpkivhy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    F:\WINDOWS\system32\geBuSMgG.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:20:16, on 4.6.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    F:\WINDOWS\System32\smss.exe
    F:\WINDOWS\system32\csrss.exe
    F:\WINDOWS\system32\winlogon.exe
    F:\WINDOWS\system32\services.exe
    F:\WINDOWS\system32\lsass.exe
    F:\Program Files\Norman\Npm\Bin\Elogsvc.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\System32\svchost.exe
    F:\Program Files\Norman\Npm\Bin\Zanda.exe
    F:\Program Files\Norman\npm\bin\nvoy.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\system32\LEXBCES.EXE
    F:\WINDOWS\system32\spoolsv.exe
    F:\WINDOWS\system32\LEXPPS.EXE
    F:\WINDOWS\Explorer.EXE
    F:\WINDOWS\system32\CTsvcCDA.exe
    F:\WINDOWS\system32\nvsvc32.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\system32\wdfmgr.exe
    F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    F:\Program Files\Canon\CAL\CALMAIN.exe
    F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
    F:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
    F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    F:\WINDOWS\system32\RunDLL32.exe
    F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe
    F:\Program Files\Norman\Npm\bin\ZLH.EXE
    F:\Util2\BitDefender\bdagent.exe
    F:\WINDOWS\system32\ctfmon.exe
    F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    F:\Program Files\Norman\Nvc\BIN\NIP.EXE
    F:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
    F:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    F:\Program Files\Norman\Nvc\bin\nvcoas.exe
    F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    F:\WINDOWS\system32\wscntfy.exe
    F:\Program Files\Norman\Nvc\bin\cclaw.exe
    F:\WINDOWS\System32\alg.exe
    F:\WINDOWS\System32\svchost.exe
    F:\Util2\SeaMonkey\seamonkey.exe
    F:\Program Files\HijackThis\HijackThis.exe
    F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    F:\WINDOWS\system32\wbem\wmiprvse.exe
    F:\Util2\BitDefender\vsserv.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - F:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: Burn4Free Toolbar Helper - {60BF5EE3-0105-4858-AD98-17C19F86B042} - F:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {A9791714-8C66-4EE6-9A2B-8925B23450DE} - F:\WINDOWS\system32\efcccCTl.dll (file missing)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: Burn4Free Toolbar - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - F:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
    O4 - HKLM\..\Run: [Lexmark X1100 Series] "F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
    O4 - HKLM\..\Run: [Gainward] F:\WINDOWS\TBPanel.exe /A
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [Norman ZANDA] "F:\Program Files\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH
    O4 - HKLM\..\Run: [BDAgent] "F:\Util2\BitDefender\bdagent.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "F:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Reader\reader_sl.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - F:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - F:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - F:\Program Files\Norman\Npm\Bin\Elogsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - F:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    O23 - Service: Norman NJeeves - Unknown owner - F:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    O23 - Service: Norman ZANDA - Norman ASA - F:\Program Files\Norman\Npm\Bin\Zanda.exe
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - F:\Program Files\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
    O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - F:\Program Files\Norman\npm\bin\nvoy.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: ServiceLayer - Nokia. - F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - F:\Util2\BitDefender\vsserv.exe
    O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

    --
    End of file - 7658 bytes

    Norman huutelee muuten kolmesta tiedostosta jatkuvasti skannauksen aikana ja sen jälkeen:
    W32/Virtumonde
    W32/Inject
    W32/Vundo
     
    aggre, Jun 3, 2008
    #5
  6. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    1. Lataa Combofix.exe työpöydällesi jommastakummasta linkistä:
    Combofix.exe
    Combofix.exe

    Avaa Combofix.exe ja seuraa näyttöön tulevia ohjeita

    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
    Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne.


    Tyhjennä roskakori ja käynnistä koneesi uudelleen.

    Postita tänne seuraavat lokit:
    * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
    * (C:\ComboFix.txt) raportti
    *
     
    yaht, Jun 4, 2008
    #6
  7. aggre

    aggre Member

    Joined:
    Jun 1, 2008
    Messages:
    28
    Likes Received:
    0
    Trophy Points:
    11
    Otinkin combofixin login tuossa hetki sitten.

    ComboFix 08-05-29.1 - Ile 2008-06-04 6:47:00.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.175 [GMT 3:00]
    Running from: F:\Temp\ComboFix.exe
    * Created a new restore point
    * Resident AV is active


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    F:\Autorun.inf
    F:\WINDOWS\BM079ac215.xml
    F:\WINDOWS\pskt.ini
    F:\WINDOWS\system32\cojfkouj.ini
    F:\WINDOWS\system32\fjxokptm.ini
    F:\WINDOWS\system32\GgMSuBeg.ini
    F:\WINDOWS\system32\GgMSuBeg.ini2
    F:\WINDOWS\system32\igiccuop.dll
    F:\WINDOWS\system32\jfkrlbkw.ini
    F:\WINDOWS\system32\lTCcccfe.ini
    F:\WINDOWS\system32\lTCcccfe.ini2
    F:\WINDOWS\system32\MabryObj.dll
    F:\WINDOWS\system32\mcrh.tmp
    F:\WINDOWS\system32\prqjwmhg.ini
    F:\WINDOWS\system32\trpskbva.ini
    F:\WINDOWS\system32\xfxsduon.ini

    .
    ((((((((((((((((((((((((( Files Created from 2008-05-04 to 2008-06-04 )))))))))))))))))))))))))))))))
    .

    2008-06-02 13:10 . 2008-06-02 13:10 <DIR> d-------- F:\Documents and Settings\Iina\Application Data\Malwarebytes
    2008-06-02 09:00 . 2008-06-02 09:00 <DIR> d-------- F:\Documents and Settings\Ilari\Application Data\Malwarebytes
    2008-06-02 08:59 . 2008-06-03 06:34 <DIR> d-------- F:\Program Files\Malwarebytes' Anti-Malware
    2008-06-02 08:59 . 2008-06-02 08:59 <DIR> d-------- F:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-06-02 08:59 . 2008-05-30 01:06 34,296 --a------ F:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-06-02 08:59 . 2008-05-30 01:06 15,864 --a------ F:\WINDOWS\system32\drivers\mbam.sys
    2008-06-02 08:55 . 2008-06-02 08:55 1,756,760 --a------ F:\Temp\mbam-setup.exe
    2008-06-01 12:38 . 2008-06-01 12:39 1,948,397 --a------ F:\Temp\ComboFix.exe
    2008-06-01 12:30 . 2008-06-01 12:30 <DIR> d-------- F:\Temp\hijackthis_v2.0.2
    2008-06-01 12:12 . 2008-06-01 12:12 499,568 --a------ F:\Temp\hijackthis_v2.0.2.zip
    2008-05-31 22:00 . 2008-05-31 22:00 <DIR> d-------- F:\WINDOWS\system32\scripting
    2008-05-31 21:55 . 2008-05-31 21:55 <DIR> d-------- F:\WINDOWS\ServicePackFiles
    2008-05-31 21:55 . 2008-04-14 05:42 294,912 -----c--- F:\WINDOWS\system32\dllcache\dlimport.exe
    2008-05-31 21:49 . 2006-12-29 00:31 19,569 --a------ F:\WINDOWS\003053_.tmp
    2008-05-31 21:21 . 2008-05-31 21:28 331,805,736 --a------ F:\Temp\WindowsXP-KB936929-SP3-x86-ENU.exe
    2008-05-31 11:02 . 2008-05-31 11:02 268 --ah----- F:\sqmdata07.sqm
    2008-05-31 11:02 . 2008-05-31 11:02 244 --ah----- F:\sqmnoopt07.sqm
    2008-05-30 22:10 . 2008-05-30 22:10 268 --ah----- F:\sqmdata06.sqm
    2008-05-30 22:10 . 2008-05-30 22:10 244 --ah----- F:\sqmnoopt06.sqm
    2008-05-30 21:54 . 2008-05-30 21:54 <DIR> d-------- F:\Documents and Settings\Ilari\Application Data\Bitdefender
    2008-05-30 21:50 . 2008-05-30 21:50 244 --ah----- F:\sqmnoopt05.sqm
    2008-05-30 21:50 . 2008-05-30 21:50 232 --ah----- F:\sqmdata05.sqm
    2008-05-30 21:46 . 2008-05-30 21:46 <DIR> d-------- F:\Documents and Settings\Administrator.AIVANOMAKONEXP\tmp\Application Data\Bitdefender
    2008-05-30 21:11 . 2008-06-04 06:58 81,984 --a------ F:\WINDOWS\system32\bdod.bin
    2008-05-30 21:11 . 2008-05-30 21:11 244 --ah----- F:\sqmnoopt04.sqm
    2008-05-30 21:11 . 2008-05-30 21:11 232 --ah----- F:\sqmdata04.sqm
    2008-05-30 21:05 . 2008-05-30 21:06 <DIR> d-------- F:\Documents and Settings\All Users\Application Data\BitDefender
    2008-05-30 21:03 . 2008-05-30 21:06 <DIR> d-------- F:\Program Files\Common Files\Softwin
    2008-05-30 20:58 . 2008-05-30 20:58 244 --ah----- F:\sqmnoopt03.sqm
    2008-05-30 20:58 . 2008-05-30 20:58 232 --ah----- F:\sqmdata03.sqm
    2008-05-30 15:41 . 2008-05-30 11:29 22,103,392 --a------ F:\Temp\bitdefender_free_v10.exe
    2008-05-30 07:02 . 2008-05-30 07:02 93 --a------ F:\WINDOWS\wininit.ini
    2008-05-29 21:36 . 2008-05-29 21:34 691,545 --a------ F:\WINDOWS\unins000.exe
    2008-05-29 21:36 . 2008-05-29 21:36 2,557 --a------ F:\WINDOWS\unins000.dat
    2008-05-24 19:08 . 2008-05-26 20:11 <DIR> d-------- F:\Documents and Settings\Noora1\Application Data\uTorrent
    2008-05-24 16:35 . 2008-05-25 08:14 <DIR> d-------- F:\Program Files\uTorrent
    2008-05-24 16:35 . 2008-05-27 18:35 <DIR> d-------- F:\Documents and Settings\Iina\Application Data\uTorrent
    2008-05-06 06:29 . 2008-06-03 19:17 54,156 --ah----- F:\WINDOWS\QTFont.qfn
    2008-05-06 06:29 . 2008-05-06 06:29 1,409 --a------ F:\WINDOWS\QTFont.for
    2008-05-04 08:32 . 2008-05-04 08:32 <DIR> d-------- F:\Documents and Settings\Ilari\workspace

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-04 03:59 --------- d-----w F:\Program Files\Norman
    2008-06-03 17:50 --------- d-----w F:\Documents and Settings\Noora1\Application Data\Nokia
    2008-05-30 18:50 --------- d-----w F:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-05-28 10:43 --------- d-----w F:\Program Files\Torrent
    2008-05-28 10:41 --------- d-----w F:\Documents and Settings\Ilari\Application Data\uTorrent
    2008-05-25 11:08 9,216 --sha-w F:\Program Files\Thumbs.db
    2008-05-19 13:34 --------- d---a-w F:\Documents and Settings\All Users\Application Data\TEMP
    2008-05-19 05:23 --------- d-----w F:\Documents and Settings\Noora1\Application Data\dvdcss
    2008-04-30 18:39 --------- d-----w F:\Documents and Settings\Noora1\Application Data\Yahoo!
    2008-04-14 02:55 1,804 ----a-w F:\WINDOWS\system32\dcache.bin
    2008-04-14 02:46 329,728 ----a-w F:\WINDOWS\system32\netsetup.exe
    2008-04-14 02:43 92,424 ----a-w F:\WINDOWS\system32\rdpdd.dll
    2008-04-14 02:43 87,176 ----a-w F:\WINDOWS\system32\rdpwsx.dll
    2008-04-14 02:43 40,840 ----a-w F:\WINDOWS\system32\drivers\termdd.sys
    2008-04-14 02:43 21,896 ----a-w F:\WINDOWS\system32\drivers\tdtcp.sys
    2008-04-14 02:43 139,656 ----a-w F:\WINDOWS\system32\drivers\rdpwd.sys
    2008-04-14 02:43 12,168 ----a-w F:\WINDOWS\system32\tsddd.dll
    2008-04-14 02:43 12,040 ----a-w F:\WINDOWS\system32\drivers\tdpipe.sys
    2008-04-14 02:41 98,304 ----a-w F:\WINDOWS\system32\actxprxy.dll
    2008-04-14 02:40 53,279 ----a-w F:\WINDOWS\system32\odbcji32.dll
    2008-04-14 02:40 4,126 ----a-w F:\WINDOWS\system32\msdxmlc.dll
    2008-04-14 02:40 3,584 ----a-w F:\WINDOWS\system32\msafd.dll
    2008-04-13 22:00 1,845,632 ----a-w F:\WINDOWS\system32\win32k.sys
    2008-04-13 21:58 175,744 ----a-w F:\WINDOWS\system32\drivers\rdbss.sys
    2008-04-13 21:57 2,188,928 ----a-w F:\WINDOWS\system32\ntoskrnl.exe
    2008-04-13 21:51 162,816 ----a-w F:\WINDOWS\system32\drivers\netbt.sys
    2008-04-13 21:50 91,520 ----a-w F:\WINDOWS\system32\drivers\ndiswan.sys
    2008-04-13 21:50 361,344 ----a-w F:\WINDOWS\system32\drivers\tcpip.sys
    2008-04-13 21:50 182,656 ----a-w F:\WINDOWS\system32\drivers\ndis.sys
    2008-04-13 21:49 75,264 ----a-w F:\WINDOWS\system32\drivers\ipsec.sys
    2008-04-13 21:49 51,328 ----a-w F:\WINDOWS\system32\drivers\rasl2tp.sys
    2008-04-13 21:49 48,384 ----a-w F:\WINDOWS\system32\drivers\raspptp.sys
    2008-04-13 21:49 146,048 ----a-w F:\WINDOWS\system32\drivers\portcls.sys
    2008-04-13 21:49 138,112 ----a-w F:\WINDOWS\system32\drivers\afd.sys
    2008-04-13 21:48 52,480 ----a-w F:\WINDOWS\system32\drivers\i8042prt.sys
    2008-04-13 21:47 83,072 ----a-w F:\WINDOWS\system32\drivers\wdmaud.sys
    2008-04-13 21:47 456,576 ----a-w F:\WINDOWS\system32\drivers\mrxsmb.sys
    2008-04-13 21:47 105,344 ----a-w F:\WINDOWS\system32\drivers\mup.sys
    2008-04-13 21:46 49,536 ----a-w F:\WINDOWS\system32\drivers\classpnp.sys
    2008-04-13 21:46 141,056 ----a-w F:\WINDOWS\system32\drivers\ks.sys
    2008-04-13 21:45 64,512 ----a-w F:\WINDOWS\system32\drivers\serial.sys
    2008-04-13 21:45 60,800 ----a-w F:\WINDOWS\system32\drivers\sysaudio.sys
    2008-04-13 21:45 574,976 ----a-w F:\WINDOWS\system32\drivers\ntfs.sys
    2008-04-13 21:45 334,848 ----a-w F:\WINDOWS\system32\drivers\srv.sys
    2008-04-13 21:44 63,744 ----a-w F:\WINDOWS\system32\drivers\cdfs.sys
    2008-04-13 21:44 143,744 ----a-w F:\WINDOWS\system32\drivers\fastfat.sys
    2008-04-13 21:30 30,080 ----a-w F:\WINDOWS\system32\drivers\modem.sys
    2008-04-13 21:30 225,664 ----a-w F:\WINDOWS\system32\drivers\tcpip6.sys
    2008-04-13 21:30 19,072 ----a-w F:\WINDOWS\system32\drivers\tdi.sys
    2008-04-13 21:27 41,472 ----a-w F:\WINDOWS\system32\drivers\raspppoe.sys
    2008-04-13 21:27 40,576 ----a-w F:\WINDOWS\system32\drivers\ndproxy.sys
    2008-04-13 21:27 34,560 ----a-w F:\WINDOWS\system32\drivers\wanarp.sys
    2008-04-13 21:27 20,864 ----a-w F:\WINDOWS\system32\drivers\ipinip.sys
    2008-04-13 21:27 152,832 ----a-w F:\WINDOWS\system32\drivers\ipnat.sys
    2008-04-13 21:27 14,336 ----a-w F:\WINDOWS\system32\drivers\asyncmac.sys
    2008-04-13 21:27 10,112 ----a-w F:\WINDOWS\system32\drivers\ndistapi.sys
    2008-04-13 21:26 88,320 ----a-w F:\WINDOWS\system32\drivers\nwlnkipx.sys
    2008-04-13 21:26 69,120 ----a-w F:\WINDOWS\system32\drivers\psched.sys
    2008-04-13 21:26 35,072 ----a-w F:\WINDOWS\system32\drivers\msgpc.sys
    2008-04-13 21:26 34,688 ----a-w F:\WINDOWS\system32\drivers\netbios.sys
    2008-04-13 21:26 30,592 ----a-w F:\WINDOWS\system32\drivers\rndismp.sys
    2008-04-13 21:26 30,592 ------w F:\WINDOWS\system32\drivers\rndismpx.sys
    2008-04-13 21:26 14,592 ----a-w F:\WINDOWS\system32\drivers\ndisuio.sys
    2008-04-13 21:26 12,800 ----a-w F:\WINDOWS\system32\drivers\usb8023.sys
    2008-04-13 21:26 12,800 ------w F:\WINDOWS\system32\drivers\usb8023x.sys
    2008-04-13 21:26 12,288 ----a-w F:\WINDOWS\system32\drivers\tunmp.sys
    2008-04-13 21:25 202,624 ----a-w F:\WINDOWS\system32\drivers\rmcast.sys
    2008-04-13 21:24 11,264 ----a-w F:\WINDOWS\system32\drivers\irenum.sys
    2008-04-13 21:23 71,552 ----a-w F:\WINDOWS\system32\drivers\bridge.sys
    2008-04-13 21:23 40,320 ----a-w F:\WINDOWS\system32\drivers\nmnt.sys
    2008-04-13 21:23 36,608 ----a-w F:\WINDOWS\system32\drivers\ip6fw.sys
    2008-04-13 21:23 264,832 ----a-w F:\WINDOWS\system32\drivers\http.sys
    2008-04-13 21:21 61,824 ----a-w F:\WINDOWS\system32\drivers\nic1394.sys
    2008-04-13 21:21 60,800 ----a-w F:\WINDOWS\system32\drivers\arp1394.sys
    2008-04-13 21:21 59,904 ----a-w F:\WINDOWS\system32\drivers\atmarpc.sys
    2008-04-13 21:21 55,808 ----a-w F:\WINDOWS\system32\drivers\atmlane.sys
    2008-04-13 21:21 101,120 ------w F:\WINDOWS\system32\drivers\bthpan.sys
    2008-04-13 21:17 25,856 ----a-w F:\WINDOWS\system32\drivers\usbprint.sys
    2008-04-13 21:16 59,136 ------w F:\WINDOWS\system32\drivers\rfcomm.sys
    2008-04-13 21:16 37,888 ------w F:\WINDOWS\system32\drivers\bthmodem.sys
    2008-04-13 21:16 36,480 ------w F:\WINDOWS\system32\drivers\bthprint.sys
    2008-04-13 21:16 273,024 ------w F:\WINDOWS\system32\drivers\bthport.sys
    2008-04-13 21:16 25,600 ------w F:\WINDOWS\system32\drivers\hidbth.sys
    2008-04-13 21:16 25,344 ----a-w F:\WINDOWS\system32\drivers\sonydcam.sys
    2008-04-13 21:16 18,944 ------w F:\WINDOWS\system32\drivers\bthusb.sys
    2008-04-13 21:16 17,024 ------w F:\WINDOWS\system32\drivers\bthenum.sys
    2008-04-13 21:16 121,984 ------w F:\WINDOWS\system32\drivers\usbvideo.sys
    2008-04-13 21:14 81,664 ----a-w F:\WINDOWS\system32\drivers\videoprt.sys
    2008-04-13 21:14 799,744 ----a-w F:\WINDOWS\system32\drivers\dmboot.sys
    2008-04-13 21:14 20,992 ----a-w F:\WINDOWS\system32\drivers\vga.sys
    2008-04-13 21:14 153,344 ----a-w F:\WINDOWS\system32\drivers\dmio.sys
    2008-04-13 21:13 9,728 ------w F:\WINDOWS\system32\comsdupd.exe
    2008-04-13 21:13 14,208 ------w F:\WINDOWS\system32\drivers\wacompen.sys
    2008-04-13 21:13 12,800 ----a-w F:\WINDOWS\system32\spiisupd.exe
    2008-04-13 21:13 12,672 ------w F:\WINDOWS\system32\drivers\mutohpen.sys
    2008-04-13 21:11 52,352 ----a-w F:\WINDOWS\system32\drivers\volsnap.sys
    2008-04-13 21:11 42,112 ----a-w F:\WINDOWS\system32\drivers\imapi.sys
    2008-04-13 21:09 92,544 ----a-w F:\WINDOWS\system32\drivers\mqac.sys
    2008-04-13 21:09 7,552 ----a-w F:\WINDOWS\system32\drivers\mskssrv.sys
    2008-04-13 21:09 5,376 ----a-w F:\WINDOWS\system32\drivers\mspclock.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A9791714-8C66-4EE6-9A2B-8925B23450DE}]
    F:\WINDOWS\system32\efcccCTl.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="F:\WINDOWS\system32\ctfmon.exe" [2008-04-14 05:42 15360]
    "Yahoo! Pager"="F:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-08-30 18:43 4670704]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Lexmark X1100 Series"="F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-03-28 16:20 57344]
    "Gainward"="F:\WINDOWS\TBPanel.exe" [2002-11-26 10:52 2015232]
    "SunJavaUpdateSched"="F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
    "NvCplDaemon"="F:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22 7700480]
    "NvMediaCenter"="NvMCTray.dll" [2006-10-22 13:22 86016 F:\WINDOWS\system32\nvmctray.dll]
    "PCSuiteTrayApplication"="F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 14:20 227328]
    "Norman ZANDA"="F:\Program Files\Norman\Npm\bin\ZLH.exe" [2007-12-17 15:38 273520]
    "BDAgent"="F:\Util2\BitDefender\bdagent.exe" [2007-03-26 15:49 69632]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="F:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 05:42 15360]
    "Nokia.PCSync"="F:\Util2\Pc-Suite\Nokia PC Suite 6\PcSync2.exe" [2007-03-27 16:58 1744896]

    F:\Documents and Settings\Administrator.AIVANOMAKONEXP\Start Menu\Programs\Startup\
    Microsoft Find Fast.lnk - F:\Program Files\Microsoft Office\Office\FINDFAST.EXE [11/21/1996 1:00:00 AM 111376]
    Office Startup.lnk - F:\Program Files\Microsoft Office\Office\OSA.EXE [11/21/1996 1:00:00 AM 51984]

    F:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - F:\Program Files\Adobe\Reader\reader_sl.exe [9/23/2005 11:05:26 PM 29696]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=sockspy.dll

    [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Start Menu^Programs^Startup^Run Nintendo Wi-Fi USB Connector Registration Tool.lnk]
    path=F:\Documents and Settings\All Users\Start Menu\Programs\Startup\Run Nintendo Wi-Fi USB Connector Registration Tool.lnk
    backup=F:\WINDOWS\pss\Run Nintendo Wi-Fi USB Connector Registration Tool.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YouRipper]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "F:\\Pelit3\\TM Nations\\TrackMania Nations ESWC\\TmNationsESWC.exe"=
    "F:\\WINDOWS\\system32\\javaw.exe"=
    "F:\\WINDOWS\\system32\\LEXPPS.EXE"=
    "F:\\WINDOWS\\system32\\dpvsetup.exe"=
    "F:\\Util\\Corel\\Register\\NAVBrowser.exe"=
    "F:\\Program Files\\WiFiConnector\\NintendoWFCReg.exe"=
    "F:\\WINDOWS\\system32\\sessmgr.exe"=
    "F:\\Pelit3\\Sid Meier's Civilization IV Complete\\Civilization4.exe"=
    "F:\\Pelit3\\Sid Meier's Civilization IV Complete\\Beyond the Sword\\Civ4BeyondSword.exe"=
    "F:\\Pelit3\\Sid Meier's Civilization IV Complete\\Warlords\\Civ4Warlords.exe"=
    "F:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "F:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "F:\\Program Files\\Messenger\\msmsgs.exe"=
    "F:\\Program Files\\NetMeeting\\conf.exe"=
    "F:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
    "F:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "F:\\Program Files\\Torrent\\uTorrent.exe"=
    "F:\\Util\\AtomTime\\AboutTime.exe"=
    "F:\\Program Files\\Google\\Google Earth\\googleearth.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "%windir%\\system32\\sessmgr.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP"= 3389:TCP:*:Disabled:mad:xpsp2res.dll,-22009
    "80:TCP"= 80:TCP:*:Disabled:googleearth.exe

    R2 Ndiskio;Ndiskio;F:\Program Files\Norman\Nse\bin\NDISKIO.SYS [2007-01-02 10:55]
    R2 NVOY;Norman's Very Own supplY of resources;"F:\Program Files\Norman\npm\bin\nvoy.exe" [2008-01-22 16:04]
    R3 NvcMFlt;NvcMFlt;F:\WINDOWS\system32\DRIVERS\nvcw32mf.sys [2008-02-11 15:56]
    R3 nvcoas;Norman Virus Control on-access component;"F:\Program Files\Norman\Nvc\bin\nvcoas.exe" [2007-12-10 15:36]
    R3 NVCScheduler;Norman Virus Control Scheduler;"F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE" [2007-09-18 12:41]
    S3 ewdmaudn;ewdmaudn;F:\DOCUME~1\Noora1\LOCALS~1\Temp\ewdmaudn.sys []

    .
    Contents of the 'Scheduled Tasks' folder
    "2008-05-30 18:49:20 F:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job"
    - F:\Util2\Spybot - Search & Destroy\Spybot - Search & Destroy\SpybotSD.exe
    "2006-04-12 16:15:23 F:\WINDOWS\Tasks\Users.job"
    - F:\WINDOWS\system32\ntbackup.execbackup
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-04 07:00:57
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    F:\Program Files\Norman\npm\Bin\elogsvc.exe
    F:\Program Files\Norman\npm\Bin\Zanda.exe
    F:\WINDOWS\system32\LEXBCES.EXE
    F:\WINDOWS\system32\LEXPPS.EXE
    F:\WINDOWS\system32\CTSVCCDA.EXE
    F:\WINDOWS\system32\nvsvc32.exe
    F:\WINDOWS\system32\wdfmgr.exe
    F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    F:\Program Files\Canon\CAL\CALMAIN.exe
    F:\Util2\BitDefender\vsserv.exe
    F:\Program Files\Norman\npm\Bin\Njeeves.exe
    F:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
    F:\WINDOWS\system32\rundll32.exe
    F:\Program Files\Norman\Nvc\Bin\Nip.exe
    F:\Program Files\Norman\Nvc\Bin\CClaw.exe
    F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    F:\PROGRA~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
    F:\WINDOWS\system32\imapi.exe
    .
    **************************************************************************
    .
    Completion time: 2008-06-04 7:09:58 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-06-04 04:09:38

    Pre-Run: 6,033,469,440 bytes free
    Post-Run: 8,223,510,528 bytes free

    283 --- E O F --- 2008-05-17 06:16:23

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:03:20, on 4.6.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    F:\WINDOWS\System32\smss.exe
    F:\WINDOWS\system32\csrss.exe
    F:\WINDOWS\system32\winlogon.exe
    F:\WINDOWS\system32\services.exe
    F:\WINDOWS\system32\lsass.exe
    F:\Program Files\Norman\Npm\Bin\Elogsvc.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\System32\svchost.exe
    F:\Program Files\Norman\Npm\Bin\Zanda.exe
    F:\Program Files\Norman\npm\bin\nvoy.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\system32\LEXBCES.EXE
    F:\WINDOWS\system32\spoolsv.exe
    F:\WINDOWS\system32\LEXPPS.EXE
    F:\WINDOWS\system32\CTsvcCDA.exe
    F:\WINDOWS\system32\nvsvc32.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\system32\wdfmgr.exe
    F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    F:\Program Files\Canon\CAL\CALMAIN.exe
    F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
    F:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    F:\WINDOWS\System32\alg.exe
    F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
    F:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
    F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    F:\WINDOWS\system32\RunDLL32.exe
    F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe
    F:\Program Files\Norman\Npm\bin\ZLH.EXE
    F:\Util2\BitDefender\bdagent.exe
    F:\WINDOWS\system32\ctfmon.exe
    F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    F:\WINDOWS\System32\svchost.exe
    F:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    F:\Program Files\Norman\Nvc\BIN\NIP.EXE
    F:\Program Files\Norman\Nvc\bin\nvcoas.exe
    F:\Program Files\Norman\Nvc\bin\cclaw.exe
    F:\Program Files\Spyware Doctor\SDTrayApp.exe
    F:\WINDOWS\explorer.exe
    F:\Util2\SeaMonkey\seamonkey.exe
    F:\Program Files\Spyware Doctor\svcntaux.exe
    F:\Program Files\Spyware Doctor\swdsvc.exe
    F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    F:\Util2\BitDefender\vsserv.exe
    F:\Program Files\HijackThis\HijackThis.exe
    F:\WINDOWS\system32\wbem\wmiprvse.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - F:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: Burn4Free Toolbar Helper - {60BF5EE3-0105-4858-AD98-17C19F86B042} - F:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {A9791714-8C66-4EE6-9A2B-8925B23450DE} - F:\WINDOWS\system32\efcccCTl.dll (file missing)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: Burn4Free Toolbar - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - F:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
    O4 - HKLM\..\Run: [Lexmark X1100 Series] "F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
    O4 - HKLM\..\Run: [Gainward] F:\WINDOWS\TBPanel.exe /A
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [Norman ZANDA] "F:\Program Files\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH
    O4 - HKLM\..\Run: [BDAgent] "F:\Util2\BitDefender\bdagent.exe"
    O4 - HKLM\..\Run: [SDTray] "F:\Program Files\Spyware Doctor\SDTrayApp.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "F:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Reader\reader_sl.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - F:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - F:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - F:\Program Files\Norman\Npm\Bin\Elogsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - F:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    O23 - Service: Norman NJeeves - Unknown owner - F:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    O23 - Service: Norman ZANDA - Norman ASA - F:\Program Files\Norman\Npm\Bin\Zanda.exe
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - F:\Program Files\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
    O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - F:\Program Files\Norman\npm\bin\nvoy.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - F:\Program Files\Spyware Doctor\svcntaux.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - F:\Program Files\Spyware Doctor\swdsvc.exe
    O23 - Service: ServiceLayer - Nokia. - F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - F:\Util2\BitDefender\vsserv.exe
    O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

    --
    End of file - 8069 bytes
     
    aggre, Jun 4, 2008
    #7
  8. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    Fixaa seuraavat rivit Hijacthis:llä


    O2 - BHO: (no name) - {A9791714-8C66-4EE6-9A2B-8925B23450DE} - F:\WINDOWS\system32\efcccCTl.dll (file missing)






    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    * Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    * Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes' Anti-Malware ja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Finish.
    * Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    * Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    * Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    * Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    * Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös
    täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    * Lähetä lokin sisältö seuraavassa viestissäsi + uusi hjt-loki.
     
    yaht, Jun 4, 2008
    #8
  9. aggre

    aggre Member

    Joined:
    Jun 1, 2008
    Messages:
    28
    Likes Received:
    0
    Trophy Points:
    11
    Malwarebytes' Anti-Malware 1.14
    Tietokantaversio: 824

    7:21:15 5.6.2008
    mbam-log-6-5-2008 (07-21-15).txt

    Tarkistustyyppi: Täysi tarkistus (F:\|)
    Tarkistetut kohteet: 205222
    Kulunut aika: 1 hour(s), 59 minute(s), 12 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:23:48, on 5.6.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    F:\WINDOWS\System32\smss.exe
    F:\WINDOWS\system32\csrss.exe
    F:\WINDOWS\system32\winlogon.exe
    F:\WINDOWS\system32\services.exe
    F:\WINDOWS\system32\lsass.exe
    F:\Program Files\Norman\Npm\Bin\Elogsvc.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\System32\svchost.exe
    F:\Program Files\Norman\Npm\Bin\Zanda.exe
    F:\Program Files\Norman\npm\bin\nvoy.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\system32\LEXBCES.EXE
    F:\WINDOWS\system32\spoolsv.exe
    F:\WINDOWS\system32\CTsvcCDA.exe
    F:\WINDOWS\system32\nvsvc32.exe
    F:\WINDOWS\system32\svchost.exe
    F:\WINDOWS\system32\wdfmgr.exe
    F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
    F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    F:\Program Files\Canon\CAL\CALMAIN.exe
    F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
    F:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    F:\WINDOWS\System32\alg.exe
    F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    F:\WINDOWS\System32\svchost.exe
    F:\Program Files\Norman\Nvc\bin\nvcoas.exe
    F:\WINDOWS\Explorer.EXE
    F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
    F:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
    F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    F:\WINDOWS\system32\RunDLL32.exe
    F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe
    F:\Program Files\Norman\Npm\bin\ZLH.EXE
    F:\Util2\BitDefender\bdagent.exe
    F:\WINDOWS\system32\lexpps.exe
    F:\WINDOWS\system32\ctfmon.exe
    F:\Program Files\Norman\Nvc\BIN\NIP.EXE
    F:\Program Files\Norman\Nvc\bin\cclaw.exe
    F:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    F:\Util2\BitDefender\vsserv.exe
    F:\Util2\SeaMonkey\seamonkey.exe
    F:\WINDOWS\system32\wbem\wmiprvse.exe
    F:\Program Files\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - F:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: Burn4Free Toolbar Helper - {60BF5EE3-0105-4858-AD98-17C19F86B042} - F:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: Burn4Free Toolbar - {55FAF0F2-44D4-425F-B5F5-6B275B621EAB} - F:\Program Files\Burn4Free Toolbar\v3.2.0.0\Burn4Free_Toolbar.dll
    O4 - HKLM\..\Run: [Lexmark X1100 Series] "F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
    O4 - HKLM\..\Run: [Gainward] F:\WINDOWS\TBPanel.exe /A
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\Util2\Pc-Suite\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [Norman ZANDA] "F:\Program Files\Norman\Npm\bin\ZLH.EXE" /LOAD /SPLASH
    O4 - HKLM\..\Run: [BDAgent] "F:\Util2\BitDefender\bdagent.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] "F:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Reader\reader_sl.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - F:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - F:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - F:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - F:\Program Files\Norman\Npm\Bin\Elogsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - F:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - F:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
    O23 - Service: Norman NJeeves - Unknown owner - F:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    O23 - Service: Norman ZANDA - Norman ASA - F:\Program Files\Norman\Npm\Bin\Zanda.exe
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - F:\Program Files\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - F:\Program Files\Norman\Npm\bin\NVCSCHED.EXE
    O23 - Service: Norman's Very Own supplY of resources (NVOY) - Norman ASA - F:\Program Files\Norman\npm\bin\nvoy.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - F:\Program Files\Spyware Doctor\svcntaux.exe
    O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - F:\Program Files\Spyware Doctor\swdsvc.exe
    O23 - Service: ServiceLayer - Nokia. - F:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - F:\Util2\BitDefender\vsserv.exe
    O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - F:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

    --
    End of file - 7743 bytes
     
    aggre, Jun 5, 2008
    #9
  10. yaht

    yaht Regular member

    Joined:
    Dec 6, 2005
    Messages:
    2,261
    Likes Received:
    0
    Trophy Points:
    46
    Miltäs kone nyt tuntuu?
     
    yaht, Jun 5, 2008
    #10
  11. aggre

    aggre Member

    Joined:
    Jun 1, 2008
    Messages:
    28
    Likes Received:
    0
    Trophy Points:
    11
    Hidastelu on kadonnut, eikä norman ole vähään aikaan varoittanut mistään pöpöistä. Elikkäs taisi tämä olla tässä. Tarkistan koneen vielä kerran. Kiitos paljon avusta!

    Hep, spyware doctor löysi kaksi haittaohjelmaa: Trojan-PWS transpyn ja Trojan.Generic. Sain ensimmäisen noista poistettua ja luulen, että saan toisenkin pois.
     
    Last edited: Jun 5, 2008
    aggre, Jun 5, 2008
    #11

Share This Page