mitä löytyy

ComboFix 08-02-14.2 - Admin 2008-02-17 2:53:25.20 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.1545 [GMT 2:00]
Running from: C:\Documents and Settings\Admin\Työpöytä\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-01-17 to 2008-02-17 )))))))))))))))))
.

2008-02-17 02:48 . 2006-03-02 14:00   390,656   --a------   C:\kmd.exe
2008-02-13 03:12 . 2008-02-13 03:12      d--------   C:\Documents and Settings\Admin\DoctorWeb
2008-02-09 14:32 . 2008-02-09 14:33      d--------   C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-08 17:55 . 2008-02-13 23:11      d--------   C:\Program Files\SpywareBlaster
2008-02-08 12:15 . 2008-02-08 12:15      d--------   C:\Documents and Settings\Admin\Application Data\TuneUp Software
2008-02-08 08:28 . 2008-02-08 08:28      d--------   C:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-02 01:09 . 2008-02-02 01:09      d--------   C:\Documents and Settings\All Users\Application Data\Emotum
2008-02-01 20:59 . 2008-02-14 11:20   1,593,120   --ahs----   C:\WINDOWS\system32\drivers\fidbox.dat
2008-02-01 20:59 . 2008-02-14 11:20   23,456   --ahs----   C:\WINDOWS\system32\drivers\fidbox.idx
2008-02-01 20:59 . 2008-02-14 11:20   17,696   --ahs----   C:\WINDOWS\system32\drivers\fidbox2.dat
2008-02-01 20:59 . 2008-02-14 11:20   2,732   --ahs----   C:\WINDOWS\system32\drivers\fidbox2.idx
2008-02-01 19:07 . 2008-02-02 01:32      d--------   C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-01 04:46 . 2008-02-01 04:46      d--------   C:\Documents and Settings\All Users\Application Data\Prevx
2008-02-01 04:46 . 2008-02-01 04:46      d--------   C:\Documents and Settings\Admin\Application Data\PrevxCSI
2008-01-29 09:23 . 2008-01-29 09:23      d--------   C:\Program Files\Lavalys
2008-01-28 17:50 . 2008-01-28 17:50      d--------   C:\Program Files\Pawsoft
2008-01-27 22:11 . 2008-01-31 04:20      d--------   C:\Program Files\Bet24
2008-01-27 21:45 . 2008-01-27 21:45      d--------   C:\Documents and Settings\Admin\OngameNetwork
2008-01-25 02:37 . 2008-01-25 02:37   4,096   --a------   C:\WINDOWS\d3dx.dat
2008-01-25 02:36 . 2008-01-25 02:36      d--------   C:\Program Files\Infogrames
2008-01-24 21:29 . 2008-01-24 21:29      d--------   C:\Documents and Settings\Admin\usernotes
2008-01-24 17:43 . 2008-01-24 17:43      d--------   C:\Program Files\B2BPOKER
2008-01-24 02:20 . 2008-01-24 02:20      d--------   C:\Program Files\Red Storm Entertainment
2008-01-23 20:37 . 2008-01-25 02:27      d--------   C:\Program Files\EA GAMES
2008-01-23 15:47 . 2008-01-23 15:58      d--------   C:\Downloads
2008-01-22 00:55 . 2008-02-17 00:09      d--------   C:\Documents and Settings\Admin\Application Data\skypePM
2008-01-22 00:55 . 2008-01-22 00:55   32   --a------   C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-01-22 00:53 . 2008-01-22 00:53      d--------   C:\Program Files\Skype
2008-01-22 00:53 . 2008-01-22 00:53      d--------   C:\Program Files\Common Files\Skype
2008-01-22 00:53 . 2008-01-22 00:53      d--------   C:\Documents and Settings\All Users\Application Data\Skype
2008-01-22 00:53 . 2008-02-12 06:59      d--------   C:\Documents and Settings\Admin\Application Data\Skype
2008-01-21 20:57 . 2008-01-21 20:57      d--------   C:\WINDOWS\Sun
2008-01-21 16:05 . 2008-01-21 16:05      d--------   C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-01-21 15:42 . 2008-01-21 15:42      d--------   C:\Program Files\Common Files\Adobe Systems Shared
2008-01-20 20:09 . 2008-01-21 10:03   22,328   --a------   C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-01-20 20:09 . 2008-01-20 20:09   22,328   --a------   C:\Documents and Settings\Admin\Application Data\PnkBstrK.sys
2008-01-20 20:08 . 2008-01-21 10:03   103,736   --a------   C:\WINDOWS\system32\PnkBstrB.exe
2008-01-20 20:08 . 2008-01-20 23:16   66,872   --a------   C:\WINDOWS\system32\PnkBstrA.exe
2008-01-20 20:08 . 2008-01-20 20:08   319   --a------   C:\WINDOWS\game.ini
2008-01-20 19:57 . 2008-01-20 19:57      d--hs----   C:\WINDOWS\ftpcache
2008-01-19 23:14 . 2007-12-14 01:59   69,632   --a------   C:\WINDOWS\system32\javacpl.cpl
2008-01-19 23:13 . 2008-01-19 23:14      d--------   C:\Program Files\Java
2008-01-19 23:12 . 2008-01-19 23:12      d--------   C:\Program Files\Common Files\Java
2008-01-18 22:38 . 2008-01-18 22:38      d--------   C:\Program Files\Windows Live Toolbar
2008-01-18 17:44 . 2008-01-18 17:44      d--------   C:\Program Files\Common Files\Sonic Shared
2008-01-18 17:44 . 2008-01-18 17:44      d--------   C:\Documents and Settings\All Users\Application Data\Sonic
2008-01-18 17:42 . 2008-01-18 17:42      d--------   C:\WINDOWS\system32\URTTemp
2008-01-18 17:21 . 2008-01-18 17:21      d--------   C:\WINDOWS\ERUNT
2008-01-17 21:32 . 2001-08-17 20:11   30,282   --a------   C:\WINDOWS\system32\drivers\pcntn5hl.sys
2008-01-17 21:32 . 2001-08-17 20:11   30,282   --a--c---   C:\WINDOWS\system32\dllcache\pcntn5hl.sys

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-08 10:27   ---------   d-----w   C:\Program Files\Windows Media Connect 2
2008-02-07 04:08   ---------   d--h--w   C:\Program Files\InstallShield Installation Information
2008-01-21 18:07   ---------   d-----w   C:\Program Files\Common Files\Adobe
2008-01-18 20:36   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-01-18 15:43   ---------   d-----w   C:\Program Files\Common Files\HP
2008-01-13 11:46   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\CyberLink
2008-01-12 14:40   ---------   d-----w   C:\Documents and Settings\Admin\Application Data\Image Zone Express
2008-01-12 08:42   ---------   d-----w   C:\Documents and Settings\Admin\Application Data\HP
2008-01-08 14:21   ---------   d-----w   C:\Documents and Settings\Admin\Application Data\Nokia
2008-01-08 14:11   ---------   d-----w   C:\Documents and Settings\Admin\Application Data\Nokia Multimedia Player
2008-01-08 14:06   ---------   d-----w   C:\Program Files\Nokia
2008-01-08 14:05   ---------   d-----w   C:\Program Files\Common Files\PCSuite
2008-01-08 14:05   ---------   d-----w   C:\Program Files\Common Files\Nokia
2008-01-08 13:23   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Downloaded Installations
2008-01-08 09:11   ---------   d-----w   C:\Documents and Settings\Admin\Application Data\Datalayer
2008-01-08 08:47   ---------   d-----w   C:\Program Files\PC Connectivity Solution
2008-01-08 07:43   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\PC Suite
2008-01-08 07:41   ---------   d-----w   C:\Program Files\DIFX
2008-01-08 07:39   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\Installations
2008-01-08 07:21   ---------   d-----w   C:\Program Files\Common Files\Ahead
2008-01-08 07:21   ---------   d-----w   C:\Program Files\Ahead
2008-01-08 07:20   ---------   d-----w   C:\Program Files\CyberLink DVD Solution
2008-01-08 07:19   ---------   d-----w   C:\Program Files\CyberLink
2008-01-08 06:54   ---------   d-----w   C:\Documents and Settings\Admin\Application Data\PC Suite
2008-01-08 06:43   ---------   d-----w   C:\Program Files\Logitech
2008-01-08 06:43   ---------   d-----w   C:\Program Files\Common Files\Logitech
2008-01-08 06:36   ---------   d-----w   C:\Program Files\directx
2008-01-08 06:32   ---------   d-----w   C:\Program Files\Common Files\InstallShield
2008-01-08 06:28   ---------   d-----w   C:\Program Files\MSXML 4.0
2008-01-08 06:28   ---------   d-----w   C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-01-08 05:58   ---------   d-----w   C:\Program Files\CCleaner
2008-01-08 05:27   ---------   dcsh--w   C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-08 05:27   ---------   d-----w   C:\Program Files\Windows Live
2008-01-08 04:58   ---------   d-----w   C:\Program Files\HP
2008-01-08 04:58   ---------   d-----w   C:\Documents and Settings\All Users\Application Data\HP
2008-01-08 04:56   ---------   d-----w   C:\Program Files\Hewlett-Packard
2008-01-08 04:56   ---------   d-----w   C:\Program Files\Common Files\Hewlett-Packard
2008-01-08 04:03   ---------   d-----w   C:\Program Files\AMD
2008-01-08 04:00   ---------   d-----w   C:\Program Files\Analog Devices
2008-01-08 03:59   ---------   d-----w   C:\Program Files\NVIDIA Corporation
2008-01-08 03:22   ---------   d-----w   C:\Program Files\Alwil Software
2008-01-08 03:11   ---------   d-----w   C:\Program Files\microsoft frontpage
2007-12-18 09:51   179,584   ----a-w   C:\WINDOWS\system32\drivers\mrxdav.sys
2007-12-07 02:14   824,832   ----a-w   C:\WINDOWS\system32\wininet.dll
2007-12-04 18:41   550,912   ----a-w   C:\WINDOWS\system32\oleaut32.dll
2007-12-04 13:04   837,496   ----a-w   C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54   95,608   ----a-w   C:\WINDOWS\system32\AvastSS.scr
2005-05-11 21:36   12,288   ----a-w   C:\WINDOWS\Fonts\RandFont.dll
2004-10-01 13:00   40,960   ----a-w   C:\Program Files\Uninstall_CDS.exe
.

(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-12-12 15:20 21686568]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 15:00 79224]
"nTrayFw"="C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe" [2006-02-17 10:40 270336]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-03-09 15:29 7561216]
"SoundMax"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2005-09-07 15:35 716800]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 03:11 925696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 14:00 15360]

C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
HP Image Zone -pikak„ynnistys.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-05-12 00:49:24 73728]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^HP Digital Imaging Monitor.lnk]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Käynnistä-valikko^Ohjelmat^Käynnistys^Microsoft Office.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2006-03-02 14:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--------- 2004-10-27 15:21 61952 C:\WINDOWS\system32\HdAShCut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2005-05-11 23:12 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--------- 2006-03-14 04:06 1397760 C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair]
--a------ 2003-08-29 14:17 188416 C:\Program Files\Logitech\Video\ISStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray]
--a------ 2003-08-29 14:20 77824 C:\Program Files\Logitech\Video\LogiTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
---hs---- 2004-10-13 18:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-10-18 11:34 5724184 C:\Program Files\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2006-03-09 15:29 7561216 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2006-03-09 15:29 86016 C:\WINDOWS\system32\NvMcTray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2006-03-09 15:29 1519616 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2005-12-13 08:49 217088 C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
--a------ 2005-11-30 16:56 1306624 C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 2004-11-02 20:24 32768 C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-12-14 03:42 144784 C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe

R3 PID_0920;Logitech QuickCam Express(PID_0920);C:\WINDOWS\system32\DRIVERS\LV532AV.SYS [2003-09-16 05:41]
S3 PCnetHL;AMD PCnet-Home Adapter Driver;C:\WINDOWS\system32\DRIVERS\pcntn5hl.sys [2001-08-17 20:11]

.
'Ajoitetut tehtävät'-kansion sisältö
"2008-02-15 15:15:00 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
"2008-02-17 00:35:00 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-17 02:53:54
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-17 2:54:06
.
2008-02-12 21:49:22   --- E O F ---

http://img180.imageshack.us/my.php?image=tehtvienhallintacx8.png