APUVA!

Zomealarm ei ole päällä, vaikka ehkä siltä näyttää ;D

h„my - 06-09-12 18:06:40,73
ComboFix 06.09.11B - Running from: I:\Documents and Settings\h„my\Ty”p”yt„

Microsoft Windows XP [versio 5.1.2600]

((((((((((((((((((((((((((((((( Files Created from 2006-08-12 to 2006-09-12 ))))))))))))))))))))))))))))))))))


2006-09-12   14:50   57,384   --a------   I:\WINDOWS\system32\avsda.dll
2006-09-12   14:45   53,248   --a------   I:\WINDOWS\system32\Process.exe
2006-09-12   14:45   40,960   --a------   I:\WINDOWS\system32\swsc.exe
2006-09-12   14:45   288,417   --a------   I:\WINDOWS\system32\SrchSTS.exe
2006-09-12   14:45   135,168   --a------   I:\WINDOWS\system32\swreg.exe
2006-08-26   16:06   4   --a------   I:\WINDOWS\system32\mlcrs0ft.dll
2006-08-22   14:40   43,520   --a------   I:\WINDOWS\system32\DemoSaver.scr


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

[COLOR=RED][B]Rootkit driver pe386 is present. A rootkit scan is required[/B][/COLOR]

2006-09-12 17:52   --------   d--------   I:\Program Files\Hijackthis
2006-09-12 17:45   --------   d--------   I:\Program Files\Common Files\Agnitum Shared
2006-09-12 17:45   --------   d--------   I:\Program Files\Common Files
2006-09-12 17:45   --------   d--------   I:\Program Files\Agnitum
2006-09-12 16:53   --------   d--------   I:\Program Files\ewido anti-malware
2006-09-12 16:49   --------   d--------   I:\Program Files\Zone Labs
2006-09-12 16:20   --------   d--------   I:\Program Files\Elaborate Bytes
2006-09-12 14:50   --------   d--------   I:\Program Files\AntiVir PersonalEdition Classic
2006-09-12 14:23   --------   d--------   I:\Program Files\CloneDVD
2006-09-12 13:34   --------   d--------   I:\Program Files\SlySoft
2006-09-12 13:24   --------   d--------   I:\Program Files\DVD Shrink
2006-09-03 21:30   47360   --a------   I:\WINDOWS\system32\drivers\Pcouffin.sys
2006-09-01 10:34   --------   d--------   I:\Program Files\OfficeUpdate11
2006-09-01 10:31   --------   d--------   I:\Program Files\Microsoft Works
2006-09-01 10:31   --------   d--------   I:\Program Files\Common Files\Microsoft Shared
2006-09-01 10:25   --------   d--------   I:\Program Files\Microsoft.NET
2006-09-01 10:25   --------   d--------   I:\Program Files\Microsoft Office
2006-09-01 10:25   --------   d--------   I:\Program Files\Common Files\System
2006-08-29 14:17   --------   d--------   I:\Program Files\321Studios
2006-08-26 16:19   --------   d--------   I:\Program Files\A1 DVD Ripper
2006-08-26 16:16   --------   d--------   I:\Program Files\AviSynth 2.5
2006-08-26 16:10   --------   d--------   I:\Program Files\Super DVD Copy
2006-08-26 16:01   4   --a------   I:\WINDOWS\system32\micro.dll
2006-08-22 14:40   --------   d--------   I:\Program Files\Demoplay
2006-08-22 09:38   --------   d--------   I:\Program Files\QuickSFV
2006-08-21 10:55   --------   d--------   I:\Program Files\The All-Seeing Eye
2006-08-19 16:39   40   ---hs----   I:\Documents and Settings\h„my\Application Data\.zreglib
2006-08-16 10:46   --------   d--------   I:\Program Files\Network Associates
2006-08-11 15:38   --------   d--------   I:\Program Files\Webteh
2006-08-10 03:01   --------   d--------   I:\Program Files\Internet Explorer
2006-08-05 09:37   --------   d--------   I:\Program Files\Common Files\Ahead
2006-08-05 09:37   --------   d--------   I:\Program Files\Ahead
2006-08-05 09:32   223128   --a------   I:\WINDOWS\system32\drivers\vaxscsi.sys
2006-08-05 09:32   --------   d--------   I:\Program Files\Alcohol Soft
2006-08-05 09:29   96256   --a------   I:\WINDOWS\system32\drivers\sptd3469.sys
2006-08-05 09:29   642560   --a------   I:\WINDOWS\system32\drivers\sptd.sys
2006-07-31 11:34   --------   d--------   I:\Program Files\Morgan
2006-07-31 11:28   --------   d--------   I:\Program Files\XviD
2006-07-31 11:28   --------   d--------   I:\Program Files\DivX
2006-07-29 20:37   --------   d--------   I:\Program Files\Windows Media Player
2006-07-27 16:26   679424   --a------   I:\WINDOWS\system32\inetcomm.dll
2006-07-21 11:28   72704   --a------   I:\WINDOWS\system32\hlink.dll
2006-07-20 22:50   --------   d--------   I:\Documents and Settings\h„my\Application Data\Ahead
2006-07-19 07:40   --------   d--------   I:\Program Files\Common Files\Adobe
2006-07-19 07:40   --------   d--------   I:\Program Files\Adobe
2006-07-19 07:33   --------   d--------   I:\Documents and Settings\h„my\Application Data\Adobe
2006-07-19 02:14   520192   --a------   I:\WINDOWS\system32\DivXsm.exe
2006-07-19 02:13   3596288   --a------   I:\WINDOWS\system32\qt-dx331.dll
2006-07-19 02:13   200704   --a------   I:\WINDOWS\system32\ssldivx.dll
2006-07-19 02:13   1044480   --a------   I:\WINDOWS\system32\libdivx.dll
2006-07-19 02:09   90112   --a------   I:\WINDOWS\system32\dpl100.dll
2006-07-19 02:09   778240   --a------   I:\WINDOWS\system32\divx_xx0c.dll
2006-07-19 02:09   778240   --a------   I:\WINDOWS\system32\divx_xx07.dll
2006-07-19 02:09   761856   --a------   I:\WINDOWS\system32\divx_xx11.dll
2006-07-19 02:09   620180   --a------   I:\WINDOWS\system32\DivX.dll
2006-07-19 02:09   593920   --a------   I:\WINDOWS\system32\dpuGUI11.dll
2006-07-19 02:09   57344   --a------   I:\WINDOWS\system32\dpv11.dll
2006-07-19 02:09   53248   --a------   I:\WINDOWS\system32\dpuGUI10.dll
2006-07-19 02:09   344064   --a------   I:\WINDOWS\system32\dpus11.dll
2006-07-19 02:09   294912   --a------   I:\WINDOWS\system32\dpu11.dll
2006-07-19 02:09   294912   --a------   I:\WINDOWS\system32\dpu10.dll
2006-07-19 02:09   200704   --a------   I:\WINDOWS\system32\dtu100.dll
2006-07-19 02:09   12288   --a------   I:\WINDOWS\system32\DivXWMPExtType.dll
2006-07-19 02:09   118784   --a------   I:\WINDOWS\system32\DivXCodecUpdateChecker.exe


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="I:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="RUNDLL32.EXE I:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"
"NvMediaCenter"="RUNDLL32.EXE I:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"
"Gainward"="I:\\WINDOWS\\TBPanel.exe /A"
"NeroFilterCheck"="I:\\WINDOWS\\system32\\NeroCheck.exe"
"avgnt"="\"I:\\Program Files\\AntiVir PersonalEdition Classic\\avgnt.exe\" /min"
"Zone Labs Client"="I:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe"
"Outpost Firewall"="\"I:\\Program Files\\Agnitum\\Outpost Firewall 1.0\\outpost.exe\" /waitservice"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Nykyinen kotisivu"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,e6,00,00,00,00,00,00,00,9a,03,00,00,42,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=dword:40000004
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="I:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="I:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{54D9498B-CF93-414F-8984-8CE7FDE0D391}"="ewido shell guard"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"Wallpaper"=""

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"NoActiveDesktop"=dword:00000000
"ClassicShell"=dword:00000000
"ForceActiveDesktopOn"=dword:00000001

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
"msvcrt64.dll"="{2FA5673F-1177-46B7-A072-F3447392FB44}"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupfolder\I:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Microsoft Office.lnk]
"path"="I:\\Documents and Settings\\All Users\\Käynnistä-valikko\\Ohjelmat\\Käynnistys\\Microsoft Office.lnk"
"backup"="I:\\WINDOWS\\pss\\Microsoft Office.lnkCommon Startup"
"location"="Common Startup"
"command"="I:\\PROGRA~1\\MICROS~2\\Office10\\OSA.EXE -b -l"
"item"="Microsoft Office"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Cmaudio]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="RunDll32 cmicnfg"
"hkey"="HKLM"
"command"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\InCD]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="InCD"
"hkey"="HKLM"
"command"="I:\\Program Files\\Ahead\\InCD\\InCD.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="I:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\nwiz]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="nwiz"
"hkey"="HKLM"
"command"="nwiz.exe /install"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSCONFIG\Startupreg\Skype]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Skype"
"hkey"="HKCU"
"command"="\"I:\\Program Files\\Skype\\Phone\\Skype.exe\" /nosplash /minimized"
"inimapping"="0"


HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll


Completion time: Tue 12.09.2006 18:07:06.28
ComboFix.txt