Rekisteröidy

Ilmoitukset

Ladataan…

    Näytä kaikki

    Viirus

    Fsecure ei pysty poistaan virusta tässä on logi tiedosto
    Logfile of HijackThis v1.99.1
    Scan saved at 12:43:05, on 31.7.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\System32\wbem\wmiapsrv.exe
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    C:\Documents and Settings\Taratest\Omat tiedostot\HijackThis.exe
    C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32Info.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.taratest.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {259F616C-A300-44F5-B04A-ED001A26C85C} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
    O4 - HKLM\..\Run: [pdfFactory Dispatcher v2] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe" /source=HKLM
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O11 - Options group: [INTERNATIONAL] International*
    O14 - IERESET.INF: START_PAGE_URL=http://www.fujitsu-siemens.com
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {33AD35A7-0B0D-4A98-B6D1-B759FAE40B0D} (BCFileX Control) - http://www.buildercom.net/WebComponents/BCFileX.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {B91AEDBE-93DF-4017-8BB3-F1C300C0EC51} - http://www.whiteseis.com/DownloadFiles/SDA2005/setup.exe
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: pm - {A479F961-CC9E-11D0-A220-000000000000} - C:\Program Files\Common Files\Repro Desk\PmProtocol.dll
    O20 - AppInit_DLLs: C:\WINDOWS\System32\mshk.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
    O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - Unknown owner - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe (file missing)
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
    4350
    Äänestä

    Muut lukivat myös

    Vastaukset 4

    Vanhimmat

    • ComboFix 07-07-30.2 - "Taratest" 2007-08-01 7:34:37.1 [GMT 3:00] - NTFS
      Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.Tosi


      ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


      C:\Program Files\pcodec
      C:\Program Files\windows adstatus


      ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


      -------\nm


      ((((((((((((((((((((((((( Files Created from 2007-07-01 to 2007-08-01 )))))))))))))))))))))))))))))))


      2007-08-01 07:33   51,200   --a------   C:\WINDOWS\nircmd.exe
      2007-07-31 15:10   60,416   --a------   C:\WINDOWS\ST4UNST.EXE
      2007-07-31 15:10      d--------   C:\Program Files\Projektio
      2007-07-31 13:54      d--------   C:\Program Files\Prevx2
      2007-07-31 13:54      d--------   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Prevx
      2007-07-31 13:53   77,312   --a------   C:\WINDOWS\ua2.dll
      2007-07-31 12:08   28,672   --a------   C:\WINDOWS\system32\drivers\CO_Mon.sys
      2007-07-31 09:09      d--------   C:\Program Files\Yahoo!
      2007-07-31 09:08      d--------   C:\Program Files\CCleaner
      2007-07-30 15:44   786,432   --ah-----   C:\DOCUME~1\Vieras\NTUSER.DAT
      2007-07-30 15:44      dr-------   C:\DOCUME~1\Vieras\Suosikit
      2007-07-30 15:44      dr-------   C:\DOCUME~1\Vieras\Omat tiedostot
      2007-07-30 15:44      dr-------   C:\DOCUME~1\Vieras\K„ynnist„-valikko
      2007-07-30 15:44      d--h-----   C:\DOCUME~1\Vieras\Verkkoymp„rist”
      2007-07-30 15:44      d--h-----   C:\DOCUME~1\Vieras\Tulostinymp„rist”
      2007-07-30 15:44      d--h-----   C:\DOCUME~1\Vieras\Mallit
      2007-07-30 15:44      d--------   C:\DOCUME~1\Vieras\Ty”p”yt„
      2007-07-30 15:44      d--------   C:\DOCUME~1\Vieras\APPLIC~1\InterTrust
      2007-07-27 15:36      d--------   C:\DOCUME~1\Taratest\DoctorWeb
      2007-07-26 15:25      d--------   C:\DOCUME~1\Taratest\APPLIC~1\F-Secure
      2007-07-26 15:11   50,080   --a------   C:\WINDOWS\system32\drivers\fsdfw.sys
      2007-07-26 15:11   29,568   --a------   C:\WINDOWS\system32\drivers\fsndis5.sys
      2007-07-26 15:11      d--------   C:\DOCUME~1\ALLUSE~1\APPLIC~1\F-Secure
      2007-07-26 15:10      d--------   C:\Program Files\F-Secure
      2007-07-26 15:09      d--------   C:\DOCUME~1\ALLUSE~1\APPLIC~1\fssg
      2007-07-24 08:29      d--------   C:\Program Files\RegCleaner
      2007-07-09 07:21      d--------   C:\WINDOWS\SxsCaPendDel


      (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

      2007-08-01 07:21   ---------   d--------   C:\Program Files\Mozilla Thunderbird
      2007-07-31 10:24   ---------   d--------   C:\Program Files\AutoCAD R14
      2007-07-31 07:56   ---------   d--------   C:\DOCUME~1\Taratest\APPLIC~1\OpenOffice.org2
      2007-07-26 15:11   76758   --a--c---   C:\WINDOWS\system32\perfc00B.dat
      2007-07-26 15:11   379458   --a--c---   C:\WINDOWS\system32\perfh00B.dat
      2007-07-26 15:02   ---------   d--------   C:\Program Files\Common Files\Symantec Shared
      2007-07-26 14:55   ---------   d--------   C:\Program Files\ACAD2000
      2007-07-24 08:47   ---------   d--------   C:\DOCUME~1\Taratest\APPLIC~1\Lavasoft
      2007-05-16 18:14   683520   --a------   C:\WINDOWS\system32\inetcomm.dll
      2004-07-20 12:00:51   56   -csh--r   C:\WINDOWS\system32\C61A596605.sys
      2004-07-20 12:00:51   10,022   -csha-w   C:\WINDOWS\system32\KGyGaAvL.sys


      ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


      *Note* empty entries & legit default entries are not shown

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [2002-02-04 23:32]
      "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
      "F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2007-07-26 15:10]
      "F-Secure TNB"="C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" [2007-07-26 15:10]

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "FreeRAM XP"="C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" [2006-03-23 00:13]
      "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
      "appinit_dlls"=C:\WINDOWS\System32\mshk.dll

      R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys
      R1 F-Secure HIPS;F-Secure HIPS;\??\C:\Program Files\F-Secure\HIPS\fshs.sys
      R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\AN983.sys
      R3 epatap2k;SCM Parallel Port ATAPI Driver;C:\WINDOWS\system32\DRIVERS\epatap2k.sys
      R3 F-Secure Gatekeeper;F-Secure Gatekeeper;\??\C:\Program Files\F-Secure\Anti-Virus\minifilter\fsgk.sys
      S2 Automattinen LiveUpdate-ajastustoiminto;Automattinen LiveUpdate-ajastustoiminto;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe"
      S3 CO_Mon;CO_Mon;\??\C:\WINDOWS\system32\Drivers\CO_Mon.sys
      S3 E100B;Intel(R) PRO Adapter Driver;C:\WINDOWS\system32\DRIVERS\e100b325.sys
      S3 epcfw2k;SCM Parallel Port CF Driver;C:\WINDOWS\system32\DRIVERS\epcfw2k.sys
      S3 S3chipid;S3chipid;\??\C:\WINDOWS\TEMP\_ISTMP0.DIR\S3chipid.sys
      S4 adpu320;adpu320;C:\WINDOWS\system32\DRIVERS\adpu320.sys
      S4 agpCPQ;Compaq AGP Bus Filter;C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
      S4 F-Secure Filter;F-Secure File System Filter;\??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys
      S4 F-Secure Recognizer;F-Secure File System Recognizer;\??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys


      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
      AutoRun\command- E:\setup.exe


      **************************************************************************

      catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2007-08-01 07:42:09
      Windows 5.1.2600 Service Pack 2 NTFS

      scanning hidden processes ...

      scanning hidden registry entries ...

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x00ffc\xd3w\2]
      "b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"

      scanning hidden files ...

      scan completed successfully
      hidden files: 0

      **************************************************************************

      Completion time: 2007-08-01 7:45:41 - machine was rebooted
      C:\ComboFix-quarantined-files.txt ... 2007-08-01 07:43

         --- E O F ---

      Äänestä

    • lokia kirjoitti:

      ComboFix 07-07-30.2 - "Taratest" 2007-08-01 7:34:37.1 [GMT 3:00] - NTFS
      Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.Tosi


      ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


      C:\Program Files\pcodec
      C:\Program Files\windows adstatus


      ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


      -------\nm


      ((((((((((((((((((((((((( Files Created from 2007-07-01 to 2007-08-01 )))))))))))))))))))))))))))))))


      2007-08-01 07:33   51,200   --a------   C:\WINDOWS\nircmd.exe
      2007-07-31 15:10   60,416   --a------   C:\WINDOWS\ST4UNST.EXE
      2007-07-31 15:10      d--------   C:\Program Files\Projektio
      2007-07-31 13:54      d--------   C:\Program Files\Prevx2
      2007-07-31 13:54      d--------   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Prevx
      2007-07-31 13:53   77,312   --a------   C:\WINDOWS\ua2.dll
      2007-07-31 12:08   28,672   --a------   C:\WINDOWS\system32\drivers\CO_Mon.sys
      2007-07-31 09:09      d--------   C:\Program Files\Yahoo!
      2007-07-31 09:08      d--------   C:\Program Files\CCleaner
      2007-07-30 15:44   786,432   --ah-----   C:\DOCUME~1\Vieras\NTUSER.DAT
      2007-07-30 15:44      dr-------   C:\DOCUME~1\Vieras\Suosikit
      2007-07-30 15:44      dr-------   C:\DOCUME~1\Vieras\Omat tiedostot
      2007-07-30 15:44      dr-------   C:\DOCUME~1\Vieras\K„ynnist„-valikko
      2007-07-30 15:44      d--h-----   C:\DOCUME~1\Vieras\Verkkoymp„rist”
      2007-07-30 15:44      d--h-----   C:\DOCUME~1\Vieras\Tulostinymp„rist”
      2007-07-30 15:44      d--h-----   C:\DOCUME~1\Vieras\Mallit
      2007-07-30 15:44      d--------   C:\DOCUME~1\Vieras\Ty”p”yt„
      2007-07-30 15:44      d--------   C:\DOCUME~1\Vieras\APPLIC~1\InterTrust
      2007-07-27 15:36      d--------   C:\DOCUME~1\Taratest\DoctorWeb
      2007-07-26 15:25      d--------   C:\DOCUME~1\Taratest\APPLIC~1\F-Secure
      2007-07-26 15:11   50,080   --a------   C:\WINDOWS\system32\drivers\fsdfw.sys
      2007-07-26 15:11   29,568   --a------   C:\WINDOWS\system32\drivers\fsndis5.sys
      2007-07-26 15:11      d--------   C:\DOCUME~1\ALLUSE~1\APPLIC~1\F-Secure
      2007-07-26 15:10      d--------   C:\Program Files\F-Secure
      2007-07-26 15:09      d--------   C:\DOCUME~1\ALLUSE~1\APPLIC~1\fssg
      2007-07-24 08:29      d--------   C:\Program Files\RegCleaner
      2007-07-09 07:21      d--------   C:\WINDOWS\SxsCaPendDel


      (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

      2007-08-01 07:21   ---------   d--------   C:\Program Files\Mozilla Thunderbird
      2007-07-31 10:24   ---------   d--------   C:\Program Files\AutoCAD R14
      2007-07-31 07:56   ---------   d--------   C:\DOCUME~1\Taratest\APPLIC~1\OpenOffice.org2
      2007-07-26 15:11   76758   --a--c---   C:\WINDOWS\system32\perfc00B.dat
      2007-07-26 15:11   379458   --a--c---   C:\WINDOWS\system32\perfh00B.dat
      2007-07-26 15:02   ---------   d--------   C:\Program Files\Common Files\Symantec Shared
      2007-07-26 14:55   ---------   d--------   C:\Program Files\ACAD2000
      2007-07-24 08:47   ---------   d--------   C:\DOCUME~1\Taratest\APPLIC~1\Lavasoft
      2007-05-16 18:14   683520   --a------   C:\WINDOWS\system32\inetcomm.dll
      2004-07-20 12:00:51   56   -csh--r   C:\WINDOWS\system32\C61A596605.sys
      2004-07-20 12:00:51   10,022   -csha-w   C:\WINDOWS\system32\KGyGaAvL.sys


      ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


      *Note* empty entries & legit default entries are not shown

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "REGSHAVE"="C:\Program Files\REGSHAVE\REGSHAVE.exe" [2002-02-04 23:32]
      "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
      "F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2007-07-26 15:10]
      "F-Secure TNB"="C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" [2007-07-26 15:10]

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "FreeRAM XP"="C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" [2006-03-23 00:13]
      "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12]

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
      "appinit_dlls"=C:\WINDOWS\System32\mshk.dll

      R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys
      R1 F-Secure HIPS;F-Secure HIPS;\??\C:\Program Files\F-Secure\HIPS\fshs.sys
      R3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\AN983.sys
      R3 epatap2k;SCM Parallel Port ATAPI Driver;C:\WINDOWS\system32\DRIVERS\epatap2k.sys
      R3 F-Secure Gatekeeper;F-Secure Gatekeeper;\??\C:\Program Files\F-Secure\Anti-Virus\minifilter\fsgk.sys
      S2 Automattinen LiveUpdate-ajastustoiminto;Automattinen LiveUpdate-ajastustoiminto;"C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe"
      S3 CO_Mon;CO_Mon;\??\C:\WINDOWS\system32\Drivers\CO_Mon.sys
      S3 E100B;Intel(R) PRO Adapter Driver;C:\WINDOWS\system32\DRIVERS\e100b325.sys
      S3 epcfw2k;SCM Parallel Port CF Driver;C:\WINDOWS\system32\DRIVERS\epcfw2k.sys
      S3 S3chipid;S3chipid;\??\C:\WINDOWS\TEMP\_ISTMP0.DIR\S3chipid.sys
      S4 adpu320;adpu320;C:\WINDOWS\system32\DRIVERS\adpu320.sys
      S4 agpCPQ;Compaq AGP Bus Filter;C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
      S4 F-Secure Filter;F-Secure File System Filter;\??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys
      S4 F-Secure Recognizer;F-Secure File System Recognizer;\??\C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys


      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
      AutoRun\command- E:\setup.exe


      **************************************************************************

      catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2007-08-01 07:42:09
      Windows 5.1.2600 Service Pack 2 NTFS

      scanning hidden processes ...

      scanning hidden registry entries ...

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\\x00ffc\xd3w\2]
      "b049C053C7D38EE4AB9A00CB3B5D2472"="C?\Program Files\Common Files\Microsoft Shared\Web Folders\PUBPLACE.HTT"

      scanning hidden files ...

      scan completed successfully
      hidden files: 0

      **************************************************************************

      Completion time: 2007-08-01 7:45:41 - machine was rebooted
      C:\ComboFix-quarantined-files.txt ... 2007-08-01 07:43

         --- E O F ---

      Escan
      Ohjeet tuolla sivulla.
      http://koti.mbnet.fi/pattaya1/escanmwav.htm
      lataa tuosta
      http://www.spywareinfo.dk/download/mwav.exe
      päivitä tuosta
      http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
      laita täpit merkkauksien mukaan
      http://koti.mbnet.fi/pattaya1/eScan6.jpg

      scannaa

      jos ala luukkuun tulee jotain niin kopioi se näin:
      Käytä komentoa Ctrl A.
      Kopioi rivit komennolla Ctrl C.
      Liitä rivit komennolla Ctrl V.

      Laita virus log tänne.

      Äänestä

    Ei löytynyt mitään eScanilla

    Äänestä

    Odottaa vastausta

    Näihin keskusteluihin ei ole vielä vastattu. Ole ensimmäinen.

    Luetuimmat keskustelut

    Kommentoi aloitusta

    kkkkkkk kirjoitti:

    Fsecure ei pysty poistaan virusta tässä on logi tiedosto
    Logfile of HijackThis v1.99.1
    Scan saved at 12:43:05, on 31.7.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\System32\wbem\wmiapsrv.exe
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\Program Files\F-Secure\FSGUI\fsguidll.exe
    C:\Documents and Settings\Taratest\Omat tiedostot\HijackThis.exe
    C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32Info.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fi/0SEFIFI/SAOS01
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.taratest.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {259F616C-A300-44F5-B04A-ED001A26C85C} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
    O4 - HKLM\..\Run: [pdfFactory Dispatcher v2] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe" /source=HKLM
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O10 - Unknown file in Winsock LSP: c:\program files\f-secure\fsps\program\fslsp.dll
    O11 - Options group: [INTERNATIONAL] International*
    O14 - IERESET.INF: START_PAGE_URL=http://www.fujitsu-siemens.com
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=48835
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {33AD35A7-0B0D-4A98-B6D1-B759FAE40B0D} (BCFileX Control) - http://www.buildercom.net/WebComponents/BCFileX.cab
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {B91AEDBE-93DF-4017-8BB3-F1C300C0EC51} - http://www.whiteseis.com/DownloadFiles/SDA2005/setup.exe
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: pm - {A479F961-CC9E-11D0-A220-000000000000} - C:\Program Files\Common Files\Repro Desk\PmProtocol.dll
    O20 - AppInit_DLLs: C:\WINDOWS\System32\mshk.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: Automattinen LiveUpdate-ajastustoiminto - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure\FSAUA\program\fsaua.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exe
    O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - Unknown owner - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe (file missing)
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)

    Anonyymi
    5000

    Ilmoita asiaton sisältö

    • Sisältää materiaalia, joka on loukkaavaa, herjaavaa, rasistista, uhkailevaa tai ahdistelevaa.

    • Materiaali sisältää nimiä, yhteystietoja tai muita henkilökohtaisia tietoja. Julkisuuden henkilöistä, julkisissa viroissa toimivista ihmisistä sekä yritysten vastuuhenkilöistä saa keskustella työhön liittyen. Myös yksityiselämään liittyvistä asioista voi keskustella siltä osin, kuin niistä on julkisesti kerrottu.

    • Sisältää lapsille haitallista tai heiltä kiellettyä materiaalia. Seksuaalinen sisältö on sallittua aiheeseen tarkoitetuilla palstoilla, joiden ikäraja on 18 vuotta.

    • Lainvastaista sisältöä voi olla mm. yksityiselämää loukkaavan tiedon levitys, kiihottaminen kansanryhmää vastaan, laiton uhkaaminen, alaikäisiin liittyvä seksuaalinen sisältö/grooming, petokset, identiteettivarkaudet, kunnianloukkaukset ja tekijänoikeusrikkomukset.

    • Sisältö ei liity palstan tai keskusteluketjun aiheeseen.

    • Viesti ei ole suomea tai ruotsia (pl. International Forums), se sisältää mainontaa, se sisältää tekijänoikeuksin suojattua materiaalia, se on massapostitus tai jokin muu syy.

    Jaa keskustelu