Sain meseviruksen pari päivää sitten koneelle. F-Secure ei saa sitä poistettua, koska se kopioi itsensä aina uudestaan. Sen mukana tuli sitten lisää viruksia eikä kone oikein pelaa enää kunnolla. Mä en tiedä tietokoneista yhtään mitään, joten jos jotkut tosi yksinkertaiset ohjeet vois laittaa.
Oisko sitten viruksen syytä, etten pääse amerikkalaisille palvelimille ollenkaan. Esim. hotmail, google, facebook jne. lataa vaan. Eli linkkejä on sitten turha antaa, kun en luultavasti pääse sivuille lukemaan niitä.
Oisko virus kaapannu selaimen, koska aukeaa välillä itsekseen mainossivuja, vaikka en edes olisi koneella.
Ja tällä hetkellä F-Serure herjaa: Haitallista koodia on löytynyt tiedostosta C:/windows/system32/gebutkji.dll Tartunta: Trojan:w32/vundo.q Toiminto: tiedosto on nimetty uudelleen. Ok:n painaminen ei auta mitään, ilmoitus hyppää heti takaisin.
Jos vaikka laitan sen lokin vai mikä sen on ja joku katsoo siitä? Mistä sen saa? En tosiaan pääse oikein lukemaan ohjeita mistään.
Oisko sitten viruksen syytä, etten pääse amerikkalaisille palvelimille ollenkaan. Esim. hotmail, google, facebook jne. lataa vaan. Eli linkkejä on sitten turha antaa, kun en luultavasti pääse sivuille lukemaan niitä.
Oisko virus kaapannu selaimen, koska aukeaa välillä itsekseen mainossivuja, vaikka en edes olisi koneella.
Ja tällä hetkellä F-Serure herjaa: Haitallista koodia on löytynyt tiedostosta C:/windows/system32/gebutkji.dll Tartunta: Trojan:w32/vundo.q Toiminto: tiedosto on nimetty uudelleen. Ok:n painaminen ei auta mitään, ilmoitus hyppää heti takaisin.
Jos vaikka laitan sen lokin vai mikä sen on ja joku katsoo siitä? Mistä sen saa? En tosiaan pääse oikein lukemaan ohjeita mistään.
Vastaukset 28
Vanhimmat
Yritin sitä lokia saada Combofixillä, mutta uudelleen käynnistyksen jälkeen joku installer alkoi ladata BPSSR:ää eikä löytänyt ja se tyssäs siihen. Selain ei käynnistyny ennen kuin käynnisti koneen vielä kerran uudelleen. Mut sit pääsi taas nettiin normaalisti! F-Secure valittaa kuitenkin edelleen viruksista...
Nyt kun käynnistin koneen taas uudestaan, työpöydälle oli ilmestynyt Internet Explorer -kuvake. Kannattaiskohan vaan asentaa windows uudestaan?
Tässä loki. Ois kiva saada tietää, että aikooko joku auttaa tän kanssa etten turhaan odottele apua.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:29, on 2008-05-30
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\WINDOWS\system32\dslagent.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\WLAN\802.11 Wireless LAN\WWlanMonitor.exe
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\WgaTray.exe
C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WLAN Monitor Utility.lnk = ?
O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{C611FF0D-013E-478B-BF9E-EB6A47B21F7B}: NameServer = 195.74.0.47,195.74.0.55
O20 - Winlogon Notify: geBuTkji - geBuTkji.dll (file missing)
O20 - Winlogon Notify: ssqRJaaa - ssqRJaaa.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
--
End of file - 8589 bytes
Mene Ohjauspaneliin ==>> Java
==> Update vlilehti ja alhaalta Update Now nappista päivitys.
Lataa Malwarebytes' Anti-Malware työpöydällesi.
http://www.besttechie.net/tools/mbam-setup.exe
Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes' Anti-Malware ja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Finish.
Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
Lähetä lokin sisältö seuraavassa viestissäsi.
Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.
http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
Käynnistä koneesi vikasietotilaan ja valitse tavallinen käyttäjätilisi: Käynnistä tietokone
Kun kuulet koneen piippaavan, paina F8, kuitenkin ennen Windowsin logon esiintuloa
Seuraavaksi pitäisi ilmestyä valikko
Valitse valikosta vikasietotila.
Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix.exe) työpöydälle. Tuplakilikkaa työpöydälle ilmestynyttä sdfix.exe tiedostoa. Tiedosto purkaantuu ja asentaa itsensä siihen levyasemaan, minne on käyttöjärjestelmä on asennettu ja juureen ilmestyy kansio SDFix, ESIM C:\SDFix
- Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
-Paina Y käynnistääksesi skriptin.
- Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
-Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
- Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
- Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
- Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
- Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi.
Lataa tuolta http://www.ccleaner.com/download/builds.aspx
CCleaner , ÄLÄ aseenna Yahoo toolbaria!
laita asetukset näin:
Valinnat --> Lisäasetukset --> Ota ruksi pois kohdasta Poista vain yli 48 tuntia vanhat tilapäistiedostot.
aja Puhdistaja > tutki nappi > aja ccleaner nappi oikea alakulma
aja Virheet > etsi rekisteri virheitä nappi > Korjaa rekisteri virheet. nappi
laita logit Malwarebytesistä, SDFixistä ja lopuksi uusi HJT logi
Minulla on tietsikka ollut vähän aikaa. Eikä ole sellaista kaveriakaan, joka osaisi
ja ymmärtäisi tätä paljoakaan.
Minulle tuli sama "troijalaine" virus meseviestin kautta.
Menin hölmöyksissäni avaamaan sen.
Sain aika pian pysäytettyä kaiken, ja F-secure havaitsi heti viruksen.
Kuvake antoi valita poiston. Tein sen, ja se poistui.
Mutta.
Käynnistin koneen uudelleen.
Nyt aikomukseni oli viedä eräälle
keskustelupalstalle kirjoitus, jonka kopioin
Muokkaa kopioi periaatteella.
Yritin liittää kopioimaani kirjoitusta sinne, niin siihen tulikin se sama minulle
tullut mesen viesti.
Miten se on voinut pitää itsensä siellä Muokkaa kopioi kansiossa, ja sitten tulla
sieltä esille?
???
Mitähän tässä nyt tulisi tehdä?
Onkohan koneeni saastunut?
Voi kun viisaat pian vastaisitte.
PS. En ymmärtänyt tuosta erään selostuksesta lähes mitään. Olen niin ulkona vielä.
F-Secure kyllä edelleen valittaa viruksesta...
[b]SDFix: Version 1.189 [/b]
Run by Ani on la 07.06.2008 at 20:32
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\DOCUME~1\Ani\Desktop\SDFix
[b]Checking Services [/b]:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting
[b]Checking Files [/b]:
No Trojan Files Found
Removing Temp Files
[b]ADS Check [/b]:
[b]Final Check [/b]:
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-07 20:38:52
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services & system hive ...
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s0"=dword:a7355262
"s1"=dword:7c76ee0d
"s2"=dword:4f87807a
"h0"=dword:00000001
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:35,cd,4c,db,0e,2d,0e,5d,6e,e9,83,d7,3f,dd,7a,c5,26,78,53,8a,25,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,b9,f9,fb,5f,c6,06,82,ac,c9,a9,ab,37,47,0f,17,96,8f,..
"khjeh"=hex:46,45,6b,ae,f7,20,72,99,95,4f,86,14,83,6d,39,8f,1a,99,06,05,fb,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:57,cc,8d,7f,24,79,0b,72,49,ab,cf,dd,8d,ca,08,fd,17,af,3c,4e,64,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:35,cd,4c,db,0e,2d,0e,5d,6e,e9,83,d7,3f,dd,7a,c5,26,78,53,8a,25,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,b9,f9,fb,5f,c6,06,82,ac,c9,a9,ab,37,47,0f,17,96,8f,..
"khjeh"=hex:46,45,6b,ae,f7,20,72,99,95,4f,86,14,83,6d,39,8f,1a,99,06,05,fb,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:57,cc,8d,7f,24,79,0b,72,49,ab,cf,dd,8d,ca,08,fd,17,af,3c,4e,64,..
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
[b]Remaining Services [/b]:
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Microsoft Games\\Age of Empires III - The WarChiefs Trial\\age3x.exe"="C:\\Program Files\\Microsoft Games\\Age of Empires III - The WarChiefs Trial\\age3x.exe:*:Enabled:Age of Empires III - The WarChiefs Trial"
"C:\\Program Files\\Microsoft Games\\Zoo Tycoon 2 Endangered Species Trial Version\\zt.exe"="C:\\Program Files\\Microsoft Games\\Zoo Tycoon 2 Endangered Species Trial Version\\zt.exe:*:Enabled:Zoo Tycoon 2 Endangered Species Trial Version Executable"
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"="C:\\Program Files\\SmartFTP Client\\SmartFTP.exe:*:Enabled:SmartFTP Client 2.5"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"="C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe:*:Enabled:F-Secure Automatic Update"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"="C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe:*:Enabled:F-Secure Automatic Update"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
[b]Remaining Files [/b]:
[b]Files with Hidden Attributes [/b]:
Fri 30 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0089cd1ec7c03d0a52caa6b6ea801507\BIT9.tmp"
Thu 13 Mar 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ab59ac72525ea90a47679441587835c9\BITA.tmp"
Thu 8 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fd0264849c01086f3c6b505dc02dbd44\BIT3.tmp"
Thu 18 Oct 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fe95c915e785c18bf9cc0792fb5a73df\BIT2.tmp"
Sat 24 May 2008 857 ...HR --- "C:\Documents and Settings\Ani\Application Data\SecuROM\UserData\securom_v7_01.bak"
Wed 4 Oct 2006 3,072,000 A..H. --- "C:\Documents and Settings\Ani\Application Data\U3\temp\Launchpad Removal.exe"
[b]Finished![/b]
Malwarebytes' Anti-Malware 1.14
Tietokantaversio: 802
22:47:21 7.6.2008
mbam-log-6-7-2008 (22-47-21).txt
Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
Tarkistetut kohteet: 122126
Kulunut aika: 1 hour(s), 14 minute(s), 35 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:17:56, on 7.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\WINDOWS\system32\dslagent.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\WLAN\802.11 Wireless LAN\WWlanMonitor.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [DSLAGENTEXE] dslagent.exe USB
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WLAN Monitor Utility.lnk = ?
O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{C611FF0D-013E-478B-BF9E-EB6A47B21F7B}: NameServer = 195.74.0.47,195.74.0.55
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: geBuTkji - geBuTkji.dll (file missing)
O20 - Winlogon Notify: ssqRJaaa - ssqRJaaa.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
--
End of file - 9213 bytes
scannaa tuolla hjt:llä merkkaa paina Fix checked
O20 - Winlogon Notify: geBuTkji - geBuTkji.dll (file missing)
O20 - Winlogon Notify: ssqRJaaa - ssqRJaaa.dll (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
Sitten sieltä löytyy
Nortonin jämä
Kopioi / liitä seuraava teksti alapuolella tyhjään muistioFiluun
Varmista että tiedoston tyyppi on ”all Files” ja tallenna se Poisto.bat. nimisenä
työpöydällesi.
@echo off
sc stop CLTNetCnService
sc delete CLTNetCnService
Tupla-klikkaa Poisto.bat. filua työpöydälläsi , ikkuna avautuu ja Sulkeutuu tämä on normaalia.
Poista vikasiedossa kansio
C:\Program Files\Common Files\>> Symantec Shared
F-Secure löytää mm. tällaisen viruksen (tämä on yksi monista): EICAR_Test_File.
Kun ComboFix yrittää luoda lokia, joku BPSSP haluaa käynnistyä, mutta sitä ei löydy koneelta. Sitten se herjas jotain erroria, ja että muisti ei riitä. Viimein sai lokin luotua, mutta sitten F-Secure kaatui eikä selain toiminut ja Explorer-kuvake oli ilmestynyt työpöydälle. Tällasta...
ComboFix 08-05-29.1 - Ani 2008-06-08 14:29:46.5 - NTFSx86
Running from: C:\Documents and Settings\Ani\Desktop\ComboFix.exe
* Resident AV is active
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2008-05-08 to 2008-06-08 )))))))))))))))))))))))))))))))
.
2008-06-07 20:28 . 2008-06-07 20:28 d-------- C:\WINDOWS\ERUNT
2008-06-07 18:55 . 2008-06-07 18:55 d-------- C:\Program Files\SUPERAntiSpyware
2008-06-07 18:55 . 2008-06-07 18:55 d-------- C:\Documents and Settings\Ani\Application Data\SUPERAntiSpyware.com
2008-06-07 18:55 . 2008-06-07 18:55 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-06-07 18:54 . 2008-06-07 18:54 d-------- C:\Program Files\Sun
2008-06-07 18:54 . 2008-06-07 18:54 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-07 18:50 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-06-07 18:38 . 2008-06-07 18:38 d-------- C:\Program Files\CCleaner
2008-06-05 18:46 . 2008-06-08 07:52 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-05 18:46 . 2008-06-05 18:46 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-30 20:02 . 2008-05-30 20:02 d-------- C:\Documents and Settings\Ani\Application Data\Malwarebytes
2008-05-30 20:01 . 2008-05-30 20:03 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-30 20:01 . 2008-05-30 20:01 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-30 20:01 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-30 20:01 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-29 21:58 . 2008-05-29 21:58 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-05-29 21:55 . 2007-08-13 19:52 66,048 --a------ C:\WINDOWS\ieResetIcons.exe
2008-05-29 21:40 . 2008-05-29 21:40 d-------- C:\Program Files\Trend Micro
2008-05-29 01:02 . 2008-05-29 01:02 57,344 --a------ C:\WINDOWS\system32\EFCDUKIB.0LL
2008-05-29 00:14 . 2008-05-29 00:14 57,344 --a------ C:\WINDOWS\system32\JKKLBSRP.0LL
2008-05-28 22:14 . 2008-05-29 21:56 d-------- C:\Documents and Settings\Ani\Application Data\F-Secure
2008-05-28 22:13 . 2008-05-28 22:13 57,344 --------- C:\WINDOWS\system32\YAYAASLJ.0LL
2008-05-28 22:06 . 2005-06-21 18:32 70,224 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
2008-05-28 22:06 . 2005-06-21 18:31 33,744 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys
2008-05-28 22:05 . 2008-05-28 22:05 d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
2008-05-28 22:05 . 2008-05-28 22:05 118,842 -r------- C:\WINDOWS\bwUnin-6.3.2.116-7681197L.exe
2008-05-28 22:02 . 2008-05-28 22:02 d-------- C:\Documents and Settings\Ani\Application Data\Yahoo!
2008-05-28 22:00 . 2008-05-28 22:00 57,344 --a------ C:\WINDOWS\system32\GEBUTKJI.0LL
2008-05-28 21:53 . 2008-05-28 22:05 d-------- C:\Program Files\F-Secure
2008-05-28 19:48 . 2008-05-28 19:49 57,344 --a------ C:\WINDOWS\system32\XXYWUSTU.0LL
2008-05-28 19:26 . 2008-05-28 19:43 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-28 18:49 . 2008-05-29 21:28 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-27 22:07 . 2008-05-27 22:06 56,832 -r-hs---- C:\WINDOWS\winudspm.0xe
2008-05-21 15:45 . 2008-05-21 15:45 d-------- C:\Program Files\D-Link
2008-05-21 15:45 . 2001-10-16 13:34 279,040 --a------ C:\WINDOWS\system32\gsi.cpl
2008-05-21 15:45 . 2001-09-28 07:04 242,946 --a------ C:\WINDOWS\system32\drivers\glausb.sys
2008-05-21 15:45 . 2001-10-16 13:35 75,776 --a------ C:\WINDOWS\system32\gsicon.exe
2008-05-21 15:45 . 2001-09-28 07:07 26,987 --a------ C:\WINDOWS\system32\drivers\gafwload.sys
2008-05-21 15:45 . 2001-10-02 04:43 25,088 --a------ C:\WINDOWS\system32\CoInst.dll
2008-05-21 15:45 . 2001-10-02 04:42 24,576 --a------ C:\WINDOWS\system32\delaySpawn.exe
2008-05-21 15:45 . 2001-10-02 04:42 16,384 --a------ C:\WINDOWS\system32\dslagent.exe
2008-05-21 15:44 . 2001-10-16 13:49 102,400 --a------ C:\WINDOWS\system32\instDll.dll
2008-05-21 15:44 . 2001-10-02 04:42 98,304 --a------ C:\WINDOWS\system32\gspnDll.dll
2008-05-21 15:44 . 2001-10-16 13:04 12,303 --------- C:\WINDOWS\wwdslcfg.ini
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 10:15 --------- d-----w C:\Program Files\DC++
2008-06-07 15:50 --------- d-----w C:\Program Files\Java
2008-05-30 18:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-30 18:23 --------- d-----w C:\Program Files\Windows Live
2008-05-29 21:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-05-29 18:28 --------- d-----w C:\Program Files\Lavasoft
2008-05-28 19:03 --------- d-----w C:\Program Files\Yahoo!
2008-05-28 15:50 --------- d-----w C:\Documents and Settings\Ani\Application Data\Lavasoft
2008-05-27 20:57 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-05-27 20:43 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-21 12:45 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-29 17:57 --------- d-----w C:\Documents and Settings\Ani\Application Data\Apple Computer
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-01-31 19:43 14,290 ----a-w C:\Program Files\settings.dat
2007-10-20 16:27 32,248 ----a-w C:\Documents and Settings\Ani\Application Data\GDIPFONTCACHEV1.DAT
.
((((((((((((((((((((((((((((( snapshot_2008-06-07_10.30.04.79 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-05 03:45:26 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-08 11:21:49 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-07 06:25:02 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-06-07 17:29:07 5,386,240 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-06-07 17:29:07 245,760 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-06-07 06:25:02 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-06-07 17:28:56 5,386,240 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-06-07 17:28:56 245,760 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-06-07 15:55:27 18,944 ----a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
+ 2008-06-07 15:55:27 65,024 ----a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
- 2006-10-11 23:35:14 49,248 ----a-w C:\WINDOWS\system32\java.exe
+ 2008-02-21 22:23:35 135,168 ----a-w C:\WINDOWS\system32\java.exe
- 2006-10-11 23:35:24 53,346 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2008-02-21 22:23:39 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
- 2006-10-12 01:10:56 127,078 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2008-02-21 23:33:32 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 17:21 1449984]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:07 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-06-20 21:42 77824 C:\WINDOWS\SOUNDMAN.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-10 04:06 7311360]
"nwiz"="nwiz.exe" [2005-12-10 04:06 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-12-10 04:06 86016]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 17:57 133016]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 13:36 229376]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-01-07 03:36 81920]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]
"DSLAGENTEXE"="dslagent.exe" [2001-10-02 04:42 16384 C:\WINDOWS\system32\dslagent.exe]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2005-06-03 01:37 122929]
"F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 04:07 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-11-14 19:46:49 113664]
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-06-07 18:05:38 553021]
F-Secure Automatic Update.lnk - C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe [2008-05-28 22:05:43 32807]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 13:01:04 83360]
WLAN Monitor Utility.lnk - C:\Program Files\WLAN\802.11 Wireless LAN\WWlanMonitor.exe [2007-05-12 22:05:12 475136]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 10:13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= C:\Program Files\ffdshow\ffdshow.ax
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone -pikakäynnistys.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone -pikakäynnistys.lnk
backup=C:\WINDOWS\pss\HP Image Zone -pikakäynnistys.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^DOCUME~1^ALLUSE~1^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\DOCUME~1\ALLUSE~1\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray]
--a------ 2002-11-05 04:00 184320 C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DaemonTools_WhenUSaveNow_Installer]
C:\Program Files\DaemonTools_WhenUSaveNow_Installer\DaemonTools_WhenUSaveNow_Installer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2004-05-12 16:18 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2004-02-12 14:38 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 2200 Series]
--------- 2004-02-13 16:10 57344 C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 12:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2006-10-12 04:10 49263 C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSave]
C:\Program Files\Save\Save.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2006-10-25 08:37 35328 C:\Program Files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires III - The WarChiefs Trial\\age3x.exe"=
"C:\\Program Files\\Microsoft Games\\Zoo Tycoon 2 Endangered Species Trial Version\\zt.exe"=
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-06-21 18:32]
R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2008-05-28 22:05]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 18:14]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-02-16 18:49]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2004-12-17 12:34]
R2 ScFBPNT2;CanoScan FBP2 Port Driver;C:\WINDOWS\system32\drivers\ScFBPNT2.SYS [2000-02-08 10:30]
R3 PCnetHL;AMD PCnet-Home Adapter Driver;C:\WINDOWS\system32\DRIVERS\pcntn5hl.sys [2001-08-17 15:11]
R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);C:\WINDOWS\system32\DRIVERS\RMSPPPOE.SYS [2002-10-03 11:09]
S2 gafwload;D-Link DSL-200 USB ADSL Loader;C:\WINDOWS\system32\DRIVERS\gafwload.sys [2001-09-28 07:07]
S3 glausb;D-Link DSL-200 USB ADSL Modem(LAN);C:\WINDOWS\system32\DRIVERS\glausb.sys [2001-09-28 07:04]
S3 StickCap;Digital TV DVB-T USB Stick adapter service;C:\WINDOWS\system32\Drivers\stickcap.sys []
S3 stickload;Digital TV stick firmware loader service;C:\WINDOWS\system32\DRIVERS\stickload.sys []
S3 USBFVNETR;WLAN 11Mbps USB ADAPTER-G;C:\WINDOWS\system32\DRIVERS\vnetusbr.sys [2003-04-17 11:20]
S3 V0010bVd;Creative WebCam Vista #2;C:\WINDOWS\system32\DRIVERS\V0010bVd.sys [2003-04-21 10:19]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa89565a-84a9-11dc-997d-0008a165eef9}]
\Shell\AutoRun\command - M:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
"2008-06-02 19:42:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 14:33:16
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-08 14:40:05
ComboFix-quarantined-files.txt 2008-06-08 11:40:00
ComboFix2.txt 2008-06-08 11:13:00
ComboFix3.txt 2008-06-07 07:37:57
Pre-Run: 5,903,417,344 bytes free
Post-Run: 5,890,473,984 bytes free
215 --- E O F --- 2008-06-02 00:02:40
näyttää olevan
Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
[quote]
File::
C:\WINDOWS\system32\EFCDUKIB.0LL
C:\WINDOWS\system32\JKKLBSRP.0LL
C:\WINDOWS\system32\GEBUTKJI.0LL
C:\WINDOWS\system32\XXYWUSTU.0LL
C:\WINDOWS\winudspm.0xe
Folder::
C:\Program Files\DaemonTools_WhenUSaveNow_Installer\DaemonTools_WhenUSaveNow_Installer.exe
C:\Program Files\Save
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DaemonTools_WhenUSaveNow_Installer]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSave]
[/quote]
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
[img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
********
sammuta ja käynnistä kone
ja scannaa uusi combofix
Kun se yrittää tulostaa sitä logia niin kone kaatuu. Tulee se BPSSP Windows installeriin ja ettei muisti riitä. Ja sitten tällainen:
Runtime Error!
Program: C:\Windows\System32\msiexe.exe
This application has requested the Runtime to terminate it in an unusual way...
käyttöjärjestelmä
tää suomi24.fi
vörkki niin pääsi vanhat viestit katsomaan
scannaas kone alla olevalla
Escan
Ohjeet tuolla sivulla.
http://koti.mbnet.fi/pattaya1/escanmwav.htm
lataa tuosta
http://www.spywareinfo.dk/download/mwav.exe
päivitä tuosta
http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
laita täpit merkkauksien mukaan
http://koti.mbnet.fi/pattaya1/eScan6.jpg
scannaa
jos ala luukkuun tulee jotain niin kopioi se näin:
Käytä komentoa Ctrl A.
Kopioi rivit komennolla Ctrl C.
Liitä rivit komennolla Ctrl V.
Laita virus log tänne.
Saihan se viimein sen lokin tehtyä. Vaikka ctrl+alt+delete ei kyllä toiminut, ei myöskään selain ennen kuin käynnisti koneen uudestaan..
ComboFix 08-05-29.1 - Ani 2008-06-08 18:28:28.8 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.55 [GMT 3:00]
Running from: C:\Documents and Settings\Ani\Desktop\ComboFix.exe
* Resident AV is active
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2008-05-08 to 2008-06-08 )))))))))))))))))))))))))))))))
.
2008-06-07 20:28 . 2008-06-07 20:28 d-------- C:\WINDOWS\ERUNT
2008-06-07 18:55 . 2008-06-07 18:55 d-------- C:\Program Files\SUPERAntiSpyware
2008-06-07 18:55 . 2008-06-07 18:55 d-------- C:\Documents and Settings\Ani\Application Data\SUPERAntiSpyware.com
2008-06-07 18:55 . 2008-06-07 18:55 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-06-07 18:54 . 2008-06-07 18:54 d-------- C:\Program Files\Sun
2008-06-07 18:54 . 2008-06-07 18:54 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-07 18:50 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-06-07 18:38 . 2008-06-07 18:38 d-------- C:\Program Files\CCleaner
2008-06-05 18:46 . 2008-06-08 07:52 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-05 18:46 . 2008-06-05 18:46 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-30 20:02 . 2008-05-30 20:02 d-------- C:\Documents and Settings\Ani\Application Data\Malwarebytes
2008-05-30 20:01 . 2008-05-30 20:03 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-30 20:01 . 2008-05-30 20:01 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-30 20:01 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-30 20:01 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-29 21:58 . 2008-05-29 21:58 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-05-29 21:55 . 2007-08-13 19:52 66,048 --a------ C:\WINDOWS\ieResetIcons.exe
2008-05-29 21:40 . 2008-05-29 21:40 d-------- C:\Program Files\Trend Micro
2008-05-29 01:02 . 2008-05-29 01:02 57,344 --a------ C:\WINDOWS\system32\EFCDUKIB.0LL
2008-05-29 00:14 . 2008-05-29 00:14 57,344 --a------ C:\WINDOWS\system32\JKKLBSRP.0LL
2008-05-28 22:14 . 2008-05-29 21:56 d-------- C:\Documents and Settings\Ani\Application Data\F-Secure
2008-05-28 22:13 . 2008-05-28 22:13 57,344 --------- C:\WINDOWS\system32\YAYAASLJ.0LL
2008-05-28 22:06 . 2005-06-21 18:32 70,224 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
2008-05-28 22:06 . 2005-06-21 18:31 33,744 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys
2008-05-28 22:05 . 2008-05-28 22:05 d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
2008-05-28 22:05 . 2008-05-28 22:05 118,842 -r------- C:\WINDOWS\bwUnin-6.3.2.116-7681197L.exe
2008-05-28 22:02 . 2008-05-28 22:02 d-------- C:\Documents and Settings\Ani\Application Data\Yahoo!
2008-05-28 22:00 . 2008-05-28 22:00 57,344 --a------ C:\WINDOWS\system32\GEBUTKJI.0LL
2008-05-28 21:53 . 2008-05-28 22:05 d-------- C:\Program Files\F-Secure
2008-05-28 19:48 . 2008-05-28 19:49 57,344 --a------ C:\WINDOWS\system32\XXYWUSTU.0LL
2008-05-28 19:26 . 2008-05-28 19:43 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-28 18:49 . 2008-05-29 21:28 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-27 22:07 . 2008-05-27 22:06 56,832 -r-hs---- C:\WINDOWS\winudspm.0xe
2008-05-21 15:45 . 2008-05-21 15:45 d-------- C:\Program Files\D-Link
2008-05-21 15:45 . 2001-10-16 13:34 279,040 --a------ C:\WINDOWS\system32\gsi.cpl
2008-05-21 15:45 . 2001-09-28 07:04 242,946 --a------ C:\WINDOWS\system32\drivers\glausb.sys
2008-05-21 15:45 . 2001-10-16 13:35 75,776 --a------ C:\WINDOWS\system32\gsicon.exe
2008-05-21 15:45 . 2001-09-28 07:07 26,987 --a------ C:\WINDOWS\system32\drivers\gafwload.sys
2008-05-21 15:45 . 2001-10-02 04:43 25,088 --a------ C:\WINDOWS\system32\CoInst.dll
2008-05-21 15:45 . 2001-10-02 04:42 24,576 --a------ C:\WINDOWS\system32\delaySpawn.exe
2008-05-21 15:45 . 2001-10-02 04:42 16,384 --a------ C:\WINDOWS\system32\dslagent.exe
2008-05-21 15:44 . 2001-10-16 13:49 102,400 --a------ C:\WINDOWS\system32\instDll.dll
2008-05-21 15:44 . 2001-10-02 04:42 98,304 --a------ C:\WINDOWS\system32\gspnDll.dll
2008-05-21 15:44 . 2001-10-16 13:04 12,303 --------- C:\WINDOWS\wwdslcfg.ini
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 10:15 --------- d-----w C:\Program Files\DC++
2008-06-07 15:50 --------- d-----w C:\Program Files\Java
2008-05-30 18:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-30 18:23 --------- d-----w C:\Program Files\Windows Live
2008-05-29 21:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-05-29 18:28 --------- d-----w C:\Program Files\Lavasoft
2008-05-28 19:03 --------- d-----w C:\Program Files\Yahoo!
2008-05-28 15:50 --------- d-----w C:\Documents and Settings\Ani\Application Data\Lavasoft
2008-05-27 20:57 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-05-27 20:43 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-21 12:45 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-29 17:57 --------- d-----w C:\Documents and Settings\Ani\Application Data\Apple Computer
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-01-31 19:43 14,290 ----a-w C:\Program Files\settings.dat
2007-10-20 16:27 32,248 ----a-w C:\Documents and Settings\Ani\Application Data\GDIPFONTCACHEV1.DAT
.
((((((((((((((((((((((((((((( snapshot_2008-06-07_10.30.04.79 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-05 03:45:26 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-08 15:25:35 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-07 06:25:02 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-06-07 17:29:07 5,386,240 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-06-07 17:29:07 245,760 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-06-07 06:25:02 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-06-07 17:28:56 5,386,240 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-06-07 17:28:56 245,760 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-06-07 15:55:27 18,944 ----a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
+ 2008-06-07 15:55:27 65,024 ----a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
- 2006-10-11 23:35:14 49,248 ----a-w C:\WINDOWS\system32\java.exe
+ 2008-02-21 22:23:35 135,168 ----a-w C:\WINDOWS\system32\java.exe
- 2006-10-11 23:35:24 53,346 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2008-02-21 22:23:39 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
- 2006-10-12 01:10:56 127,078 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2008-02-21 23:33:32 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 17:21 1449984]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:07 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-06-20 21:42 77824 C:\WINDOWS\SOUNDMAN.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-10 04:06 7311360]
"nwiz"="nwiz.exe" [2005-12-10 04:06 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-12-10 04:06 86016]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 17:57 133016]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 13:36 229376]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-01-07 03:36 81920]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]
"DSLAGENTEXE"="dslagent.exe" [2001-10-02 04:42 16384 C:\WINDOWS\system32\dslagent.exe]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2005-06-03 01:37 122929]
"F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 04:07 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-11-14 19:46:49 113664]
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-06-07 18:05:38 553021]
F-Secure Automatic Update.lnk - C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe [2008-05-28 22:05:43 32807]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 13:01:04 83360]
WLAN Monitor Utility.lnk - C:\Program Files\WLAN\802.11 Wireless LAN\WWlanMonitor.exe [2007-05-12 22:05:12 475136]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 10:13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= C:\Program Files\ffdshow\ffdshow.ax
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone -pikakäynnistys.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone -pikakäynnistys.lnk
backup=C:\WINDOWS\pss\HP Image Zone -pikakäynnistys.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^DOCUME~1^ALLUSE~1^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\DOCUME~1\ALLUSE~1\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray]
--a------ 2002-11-05 04:00 184320 C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2004-05-12 16:18 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2004-02-12 14:38 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 2200 Series]
--------- 2004-02-13 16:10 57344 C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 12:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2006-10-12 04:10 49263 C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2006-10-25 08:37 35328 C:\Program Files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires III - The WarChiefs Trial\\age3x.exe"=
"C:\\Program Files\\Microsoft Games\\Zoo Tycoon 2 Endangered Species Trial Version\\zt.exe"=
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-06-21 18:32]
R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2008-05-28 22:05]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 18:14]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-02-16 18:49]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2004-12-17 12:34]
R2 ScFBPNT2;CanoScan FBP2 Port Driver;C:\WINDOWS\system32\drivers\ScFBPNT2.SYS [2000-02-08 10:30]
R3 PCnetHL;AMD PCnet-Home Adapter Driver;C:\WINDOWS\system32\DRIVERS\pcntn5hl.sys [2001-08-17 15:11]
R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);C:\WINDOWS\system32\DRIVERS\RMSPPPOE.SYS [2002-10-03 11:09]
S2 gafwload;D-Link DSL-200 USB ADSL Loader;C:\WINDOWS\system32\DRIVERS\gafwload.sys [2001-09-28 07:07]
S3 glausb;D-Link DSL-200 USB ADSL Modem(LAN);C:\WINDOWS\system32\DRIVERS\glausb.sys [2001-09-28 07:04]
S3 StickCap;Digital TV DVB-T USB Stick adapter service;C:\WINDOWS\system32\Drivers\stickcap.sys []
S3 stickload;Digital TV stick firmware loader service;C:\WINDOWS\system32\DRIVERS\stickload.sys []
S3 USBFVNETR;WLAN 11Mbps USB ADAPTER-G;C:\WINDOWS\system32\DRIVERS\vnetusbr.sys [2003-04-17 11:20]
S3 V0010bVd;Creative WebCam Vista #2;C:\WINDOWS\system32\DRIVERS\V0010bVd.sys [2003-04-21 10:19]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa89565a-84a9-11dc-997d-0008a165eef9}]
\Shell\AutoRun\command - M:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
"2008-06-02 19:42:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 18:32:45
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-08 19:01:28
ComboFix-quarantined-files.txt 2008-06-08 16:01:17
ComboFix2.txt 2008-06-08 11:40:06
ComboFix3.txt 2008-06-08 11:13:00
ComboFix4.txt 2008-06-07 07:37:57
Pre-Run: 5,845,569,536 bytes free
Post-Run: 5,028,347,904 bytes free
213 --- E O F --- 2008-06-02 00:02:40
käsittely tällä kertaa
Poista lisää poista sovelutuksesta
==> SUPERAntiSpyware SUPERAntiSpyware
Jotain selaimen kaappauksesta se valitti. Missä se combofix.txt-tiedosto löytyy? Tässä kuitenkin se loki.
ComboFix 08-05-29.1 - Ani 2008-06-08 20:06:57.9 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.42 [GMT 3:00]
Running from: C:\Documents and Settings\Ani\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Ani\Desktop\CFScript.txt
* Created a new restore point
* Resident AV is active
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
FILE ::
C:\WINDOWS\system32\EFCDUKIB.0LL
C:\WINDOWS\system32\JKKLBSRP.0LL
C:\WINDOWS\system32\YAYAASLJ.0LL
C:\WINDOWS\winudspm.0xe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\EFCDUKIB.0LL
C:\WINDOWS\system32\JKKLBSRP.0LL
C:\WINDOWS\system32\YAYAASLJ.0LL
C:\WINDOWS\winudspm.0xe
.
((((((((((((((((((((((((( Files Created from 2008-05-08 to 2008-06-08 )))))))))))))))))))))))))))))))
.
2008-06-07 20:28 . 2008-06-07 20:28 d-------- C:\WINDOWS\ERUNT
2008-06-07 18:55 . 2008-06-08 19:58 d-------- C:\Documents and Settings\Ani\Application Data\SUPERAntiSpyware.com
2008-06-07 18:55 . 2008-06-07 18:55 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-06-07 18:54 . 2008-06-07 18:54 d-------- C:\Program Files\Sun
2008-06-07 18:50 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-06-07 18:38 . 2008-06-07 18:38 d-------- C:\Program Files\CCleaner
2008-06-05 18:46 . 2008-06-08 07:52 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-05 18:46 . 2008-06-05 18:46 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-30 20:02 . 2008-05-30 20:02 d-------- C:\Documents and Settings\Ani\Application Data\Malwarebytes
2008-05-30 20:01 . 2008-05-30 20:03 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-30 20:01 . 2008-05-30 20:01 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-30 20:01 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-30 20:01 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-29 21:58 . 2008-05-29 21:58 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-05-29 21:55 . 2007-08-13 19:52 66,048 --a------ C:\WINDOWS\ieResetIcons.exe
2008-05-29 21:40 . 2008-05-29 21:40 d-------- C:\Program Files\Trend Micro
2008-05-28 22:14 . 2008-05-29 21:56 d-------- C:\Documents and Settings\Ani\Application Data\F-Secure
2008-05-28 22:06 . 2005-06-21 18:32 70,224 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
2008-05-28 22:06 . 2005-06-21 18:31 33,744 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys
2008-05-28 22:05 . 2008-05-28 22:05 d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
2008-05-28 22:05 . 2008-05-28 22:05 118,842 -r------- C:\WINDOWS\bwUnin-6.3.2.116-7681197L.exe
2008-05-28 22:02 . 2008-05-28 22:02 d-------- C:\Documents and Settings\Ani\Application Data\Yahoo!
2008-05-28 22:00 . 2008-05-28 22:00 57,344 --a------ C:\WINDOWS\system32\GEBUTKJI.0LL
2008-05-28 21:53 . 2008-05-28 22:05 d-------- C:\Program Files\F-Secure
2008-05-28 19:48 . 2008-05-28 19:49 57,344 --a------ C:\WINDOWS\system32\XXYWUSTU.0LL
2008-05-28 19:26 . 2008-05-28 19:43 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-28 18:49 . 2008-05-29 21:28 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-21 15:45 . 2008-05-21 15:45 d-------- C:\Program Files\D-Link
2008-05-21 15:45 . 2001-10-16 13:34 279,040 --a------ C:\WINDOWS\system32\gsi.cpl
2008-05-21 15:45 . 2001-09-28 07:04 242,946 --a------ C:\WINDOWS\system32\drivers\glausb.sys
2008-05-21 15:45 . 2001-10-16 13:35 75,776 --a------ C:\WINDOWS\system32\gsicon.exe
2008-05-21 15:45 . 2001-09-28 07:07 26,987 --a------ C:\WINDOWS\system32\drivers\gafwload.sys
2008-05-21 15:45 . 2001-10-02 04:43 25,088 --a------ C:\WINDOWS\system32\CoInst.dll
2008-05-21 15:45 . 2001-10-02 04:42 24,576 --a------ C:\WINDOWS\system32\delaySpawn.exe
2008-05-21 15:45 . 2001-10-02 04:42 16,384 --a------ C:\WINDOWS\system32\dslagent.exe
2008-05-21 15:44 . 2001-10-16 13:49 102,400 --a------ C:\WINDOWS\system32\instDll.dll
2008-05-21 15:44 . 2001-10-02 04:42 98,304 --a------ C:\WINDOWS\system32\gspnDll.dll
2008-05-21 15:44 . 2001-10-16 13:04 12,303 --------- C:\WINDOWS\wwdslcfg.ini
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 10:15 --------- d-----w C:\Program Files\DC++
2008-06-07 15:50 --------- d-----w C:\Program Files\Java
2008-05-30 18:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-30 18:23 --------- d-----w C:\Program Files\Windows Live
2008-05-29 21:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-05-29 18:28 --------- d-----w C:\Program Files\Lavasoft
2008-05-28 19:03 --------- d-----w C:\Program Files\Yahoo!
2008-05-28 15:50 --------- d-----w C:\Documents and Settings\Ani\Application Data\Lavasoft
2008-05-27 20:57 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-05-27 20:43 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-21 12:45 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-29 17:57 --------- d-----w C:\Documents and Settings\Ani\Application Data\Apple Computer
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-01-31 19:43 14,290 ----a-w C:\Program Files\settings.dat
2007-10-20 16:27 32,248 ----a-w C:\Documents and Settings\Ani\Application Data\GDIPFONTCACHEV1.DAT
.
((((((((((((((((((((((((((((( snapshot_2008-06-07_10.30.04.79 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-05 03:45:26 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-08 17:03:29 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-07 06:25:02 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-06-07 17:29:07 5,386,240 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-06-07 17:29:07 245,760 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-06-07 06:25:02 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-06-07 17:28:56 5,386,240 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-06-07 17:28:56 245,760 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
- 2006-10-11 23:35:14 49,248 ----a-w C:\WINDOWS\system32\java.exe
+ 2008-02-21 22:23:35 135,168 ----a-w C:\WINDOWS\system32\java.exe
- 2006-10-11 23:35:24 53,346 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2008-02-21 22:23:39 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
- 2006-10-12 01:10:56 127,078 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2008-02-21 23:33:32 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 17:21 1449984]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:07 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-06-20 21:42 77824 C:\WINDOWS\SOUNDMAN.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-10 04:06 7311360]
"nwiz"="nwiz.exe" [2005-12-10 04:06 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-12-10 04:06 86016]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 17:57 133016]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 13:36 229376]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-01-07 03:36 81920]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]
"DSLAGENTEXE"="dslagent.exe" [2001-10-02 04:42 16384 C:\WINDOWS\system32\dslagent.exe]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2005-06-03 01:37 122929]
"F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 04:07 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-11-14 19:46:49 113664]
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-06-07 18:05:38 553021]
F-Secure Automatic Update.lnk - C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe [2008-05-28 22:05:43 32807]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 13:01:04 83360]
WLAN Monitor Utility.lnk - C:\Program Files\WLAN\802.11 Wireless LAN\WWlanMonitor.exe [2007-05-12 22:05:12 475136]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= C:\Program Files\ffdshow\ffdshow.ax
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone -pikakäynnistys.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone -pikakäynnistys.lnk
backup=C:\WINDOWS\pss\HP Image Zone -pikakäynnistys.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^DOCUME~1^ALLUSE~1^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\DOCUME~1\ALLUSE~1\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray]
--a------ 2002-11-05 04:00 184320 C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2004-05-12 16:18 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2004-02-12 14:38 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 2200 Series]
--------- 2004-02-13 16:10 57344 C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 12:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2006-10-12 04:10 49263 C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2006-10-25 08:37 35328 C:\Program Files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires III - The WarChiefs Trial\\age3x.exe"=
"C:\\Program Files\\Microsoft Games\\Zoo Tycoon 2 Endangered Species Trial Version\\zt.exe"=
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-06-21 18:32]
R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2008-05-28 22:05]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 18:14]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-02-16 18:49]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2004-12-17 12:34]
R2 ScFBPNT2;CanoScan FBP2 Port Driver;C:\WINDOWS\system32\drivers\ScFBPNT2.SYS [2000-02-08 10:30]
R3 PCnetHL;AMD PCnet-Home Adapter Driver;C:\WINDOWS\system32\DRIVERS\pcntn5hl.sys [2001-08-17 15:11]
R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);C:\WINDOWS\system32\DRIVERS\RMSPPPOE.SYS [2002-10-03 11:09]
S2 gafwload;D-Link DSL-200 USB ADSL Loader;C:\WINDOWS\system32\DRIVERS\gafwload.sys [2001-09-28 07:07]
S3 glausb;D-Link DSL-200 USB ADSL Modem(LAN);C:\WINDOWS\system32\DRIVERS\glausb.sys [2001-09-28 07:04]
S3 StickCap;Digital TV DVB-T USB Stick adapter service;C:\WINDOWS\system32\Drivers\stickcap.sys []
S3 stickload;Digital TV stick firmware loader service;C:\WINDOWS\system32\DRIVERS\stickload.sys []
S3 USBFVNETR;WLAN 11Mbps USB ADAPTER-G;C:\WINDOWS\system32\DRIVERS\vnetusbr.sys [2003-04-17 11:20]
S3 V0010bVd;Creative WebCam Vista #2;C:\WINDOWS\system32\DRIVERS\V0010bVd.sys [2003-04-21 10:19]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa89565a-84a9-11dc-997d-0008a165eef9}]
\Shell\AutoRun\command - M:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
"2008-06-02 19:42:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 20:10:58
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-08 20:13:02
ComboFix-quarantined-files.txt 2008-06-08 17:12:49
ComboFix2.txt 2008-06-08 16:01:30
ComboFix3.txt 2008-06-08 11:40:06
ComboFix4.txt 2008-06-08 11:13:00
ComboFix5.txt 2008-06-07 07:37:57
Pre-Run: 5,838,024,704 bytes free
Post-Run: 5,825,155,072 bytes free
215 --- E O F --- 2008-06-02 00:02:40
f-scurelle elä rutaja
sulla on koneella Malwarebytes' Anti-Malware
päivitä se ensin ja aja siten vasta täysi scannaus
Malwarebytes' Anti-Malware 1.15
Tietokantaversio: 841
0:29:16 9.6.2008
mbam-log-6-9-2008 (00-29-16).txt
Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
Tarkistetut kohteet: 124927
Kulunut aika: 1 hour(s), 9 minute(s), 31 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 1
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
toimiikos kone nyt vai vielläkö tökkii
Eipä nuo toimet auttaneet mitenkään..
ComboFix 08-05-29.1 - Ani 2008-06-09 9:09:17.10 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.191 [GMT 3:00]
Running from: C:\Documents and Settings\Ani\Desktop\ComboFix.exe
* Resident AV is active
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2008-05-09 to 2008-06-09 )))))))))))))))))))))))))))))))
.
2008-06-07 20:28 . 2008-06-07 20:28 d-------- C:\WINDOWS\ERUNT
2008-06-07 18:55 . 2008-06-08 19:58 d-------- C:\Documents and Settings\Ani\Application Data\SUPERAntiSpyware.com
2008-06-07 18:55 . 2008-06-07 18:55 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-06-07 18:54 . 2008-06-07 18:54 d-------- C:\Program Files\Sun
2008-06-07 18:50 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-06-07 18:38 . 2008-06-07 18:38 d-------- C:\Program Files\CCleaner
2008-06-05 18:46 . 2008-06-08 07:52 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-05 18:46 . 2008-06-05 18:46 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-30 20:02 . 2008-05-30 20:02 d-------- C:\Documents and Settings\Ani\Application Data\Malwarebytes
2008-05-30 20:01 . 2008-06-08 21:30 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-30 20:01 . 2008-05-30 20:01 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-30 20:01 . 2008-06-05 16:04 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-30 20:01 . 2008-06-05 16:04 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-29 21:58 . 2008-05-29 21:58 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-05-29 21:55 . 2007-08-13 19:52 66,048 --a------ C:\WINDOWS\ieResetIcons.exe
2008-05-29 21:40 . 2008-05-29 21:40 d-------- C:\Program Files\Trend Micro
2008-05-28 22:14 . 2008-05-29 21:56 d-------- C:\Documents and Settings\Ani\Application Data\F-Secure
2008-05-28 22:06 . 2005-06-21 18:32 70,224 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
2008-05-28 22:06 . 2005-06-21 18:31 33,744 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys
2008-05-28 22:05 . 2008-05-28 22:05 d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
2008-05-28 22:05 . 2008-05-28 22:05 118,842 -r------- C:\WINDOWS\bwUnin-6.3.2.116-7681197L.exe
2008-05-28 22:02 . 2008-05-28 22:02 d-------- C:\Documents and Settings\Ani\Application Data\Yahoo!
2008-05-28 22:00 . 2008-05-28 22:00 57,344 --a------ C:\WINDOWS\system32\GEBUTKJI.0LL
2008-05-28 21:53 . 2008-05-28 22:05 d-------- C:\Program Files\F-Secure
2008-05-28 19:48 . 2008-05-28 19:49 57,344 --a------ C:\WINDOWS\system32\XXYWUSTU.0LL
2008-05-28 19:26 . 2008-05-28 19:43 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-28 18:49 . 2008-05-29 21:28 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-21 15:45 . 2008-05-21 15:45 d-------- C:\Program Files\D-Link
2008-05-21 15:45 . 2001-10-16 13:34 279,040 --a------ C:\WINDOWS\system32\gsi.cpl
2008-05-21 15:45 . 2001-09-28 07:04 242,946 --a------ C:\WINDOWS\system32\drivers\glausb.sys
2008-05-21 15:45 . 2001-10-16 13:35 75,776 --a------ C:\WINDOWS\system32\gsicon.exe
2008-05-21 15:45 . 2001-09-28 07:07 26,987 --a------ C:\WINDOWS\system32\drivers\gafwload.sys
2008-05-21 15:45 . 2001-10-02 04:43 25,088 --a------ C:\WINDOWS\system32\CoInst.dll
2008-05-21 15:45 . 2001-10-02 04:42 24,576 --a------ C:\WINDOWS\system32\delaySpawn.exe
2008-05-21 15:45 . 2001-10-02 04:42 16,384 --a------ C:\WINDOWS\system32\dslagent.exe
2008-05-21 15:44 . 2001-10-16 13:49 102,400 --a------ C:\WINDOWS\system32\instDll.dll
2008-05-21 15:44 . 2001-10-02 04:42 98,304 --a------ C:\WINDOWS\system32\gspnDll.dll
2008-05-21 15:44 . 2001-10-16 13:04 12,303 --------- C:\WINDOWS\wwdslcfg.ini
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 10:15 --------- d-----w C:\Program Files\DC++
2008-06-07 15:50 --------- d-----w C:\Program Files\Java
2008-05-30 18:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-30 18:23 --------- d-----w C:\Program Files\Windows Live
2008-05-29 21:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-05-29 18:28 --------- d-----w C:\Program Files\Lavasoft
2008-05-28 19:03 --------- d-----w C:\Program Files\Yahoo!
2008-05-28 15:50 --------- d-----w C:\Documents and Settings\Ani\Application Data\Lavasoft
2008-05-27 20:57 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-05-27 20:43 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-21 12:45 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-29 17:57 --------- d-----w C:\Documents and Settings\Ani\Application Data\Apple Computer
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-01-31 19:43 14,290 ----a-w C:\Program Files\settings.dat
2007-10-20 16:27 32,248 ----a-w C:\Documents and Settings\Ani\Application Data\GDIPFONTCACHEV1.DAT
.
((((((((((((((((((((((((((((( snapshot_2008-06-07_10.30.04.79 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-05 03:45:26 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-09 05:27:57 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-07 06:25:02 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-06-07 17:29:07 5,386,240 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-06-07 17:29:07 245,760 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-06-07 06:25:02 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-06-07 17:28:56 5,386,240 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-06-07 17:28:56 245,760 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
- 2006-10-11 23:35:14 49,248 ----a-w C:\WINDOWS\system32\java.exe
+ 2008-02-21 22:23:35 135,168 ----a-w C:\WINDOWS\system32\java.exe
- 2006-10-11 23:35:24 53,346 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2008-02-21 22:23:39 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
- 2006-10-12 01:10:56 127,078 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2008-02-21 23:33:32 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 17:21 1449984]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:07 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-06-20 21:42 77824 C:\WINDOWS\SOUNDMAN.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-10 04:06 7311360]
"nwiz"="nwiz.exe" [2005-12-10 04:06 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-12-10 04:06 86016]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 17:57 133016]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 13:36 229376]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-01-07 03:36 81920]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]
"DSLAGENTEXE"="dslagent.exe" [2001-10-02 04:42 16384 C:\WINDOWS\system32\dslagent.exe]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2005-06-03 01:37 122929]
"F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 04:07 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-11-14 19:46:49 113664]
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-06-07 18:05:38 553021]
F-Secure Automatic Update.lnk - C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe [2008-05-28 22:05:43 32807]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 13:01:04 83360]
WLAN Monitor Utility.lnk - C:\Program Files\WLAN\802.11 Wireless LAN\WWlanMonitor.exe [2007-05-12 22:05:12 475136]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= C:\Program Files\ffdshow\ffdshow.ax
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone -pikakäynnistys.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone -pikakäynnistys.lnk
backup=C:\WINDOWS\pss\HP Image Zone -pikakäynnistys.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^DOCUME~1^ALLUSE~1^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\DOCUME~1\ALLUSE~1\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray]
--a------ 2002-11-05 04:00 184320 C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2004-05-12 16:18 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2004-02-12 14:38 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 2200 Series]
--------- 2004-02-13 16:10 57344 C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 12:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2006-10-12 04:10 49263 C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2006-10-25 08:37 35328 C:\Program Files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires III - The WarChiefs Trial\\age3x.exe"=
"C:\\Program Files\\Microsoft Games\\Zoo Tycoon 2 Endangered Species Trial Version\\zt.exe"=
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-06-21 18:32]
R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2008-05-28 22:05]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 18:14]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-02-16 18:49]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2004-12-17 12:34]
R2 ScFBPNT2;CanoScan FBP2 Port Driver;C:\WINDOWS\system32\drivers\ScFBPNT2.SYS [2000-02-08 10:30]
R3 PCnetHL;AMD PCnet-Home Adapter Driver;C:\WINDOWS\system32\DRIVERS\pcntn5hl.sys [2001-08-17 15:11]
R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);C:\WINDOWS\system32\DRIVERS\RMSPPPOE.SYS [2002-10-03 11:09]
S2 gafwload;D-Link DSL-200 USB ADSL Loader;C:\WINDOWS\system32\DRIVERS\gafwload.sys [2001-09-28 07:07]
S3 glausb;D-Link DSL-200 USB ADSL Modem(LAN);C:\WINDOWS\system32\DRIVERS\glausb.sys [2001-09-28 07:04]
S3 StickCap;Digital TV DVB-T USB Stick adapter service;C:\WINDOWS\system32\Drivers\stickcap.sys []
S3 stickload;Digital TV stick firmware loader service;C:\WINDOWS\system32\DRIVERS\stickload.sys []
S3 USBFVNETR;WLAN 11Mbps USB ADAPTER-G;C:\WINDOWS\system32\DRIVERS\vnetusbr.sys [2003-04-17 11:20]
S3 V0010bVd;Creative WebCam Vista #2;C:\WINDOWS\system32\DRIVERS\V0010bVd.sys [2003-04-21 10:19]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa89565a-84a9-11dc-997d-0008a165eef9}]
\Shell\AutoRun\command - M:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
"2008-06-02 19:42:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-09 09:12:53
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-09 9:16:56
ComboFix-quarantined-files.txt 2008-06-09 06:16:22
ComboFix2.txt 2008-06-08 17:13:03
ComboFix3.txt 2008-06-08 16:01:30
ComboFix4.txt 2008-06-08 11:40:06
ComboFix5.txt 2008-06-08 11:13:00
Pre-Run: 5,851,611,136 bytes free
Post-Run: 5,816,135,680 bytes free
201 --- E O F --- 2008-06-02 00:02:40
ja missä on
Escan
Ohjeet tuolla sivulla.
http://koti.mbnet.fi/pattaya1/escanmwav.htm
lataa tuosta
http://www.spywareinfo.dk/download/mwav.exe
päivitä tuosta
http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
laita täpit merkkauksien mukaan
http://koti.mbnet.fi/pattaya1/eScan6.jpg
scannaa
jos ala luukkuun tulee jotain niin kopioi se näin:
Käytä komentoa Ctrl A.
Kopioi rivit komennolla Ctrl C.
Liitä rivit komennolla Ctrl V.
Laita virus log tänne.
Viruksentorjuntaohjelma ilmoittaa entiseen tapaan viruksista. Niitä on ollut muistaakseni neljä tai viisi erilaista, vaihtuu aina välillä (tai vaihtaa nimeään?).
ajossa.
Laitoin sen yöksi scannaamaan ja kone oli käynnistynyt uudestaan. Poistikohan se kuitenkin ne virukset?
Johtuukohan muuten viruksista, että hotmailiin kirjauduttaessa joka kerta ensimmäisellä kerralla valittaa väärää salasanaa. Vaikka laitan sen aina varmasti oikein.
nimee uudelleen jätää myös tekemättä joilekin mitään
********
scannaa uusi combofix loki
*******
mites se kone toimii
ComboFix 08-06-10.3 - Ani 2008-06-11 16:55:41.11 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.186 [GMT 3:00]
Running from: C:\Documents and Settings\Ani\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2008-05-11 to 2008-06-11 )))))))))))))))))))))))))))))))
.
2008-06-11 02:13 . 2008-04-14 14:01 272,128 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 02:13 . 2008-04-14 14:01 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-10 16:30 . 2008-06-11 00:30 0 --a------ C:\23990098.$$$
2008-06-10 12:14 . 2008-06-10 12:20 d-------- C:\virust
2008-06-07 20:28 . 2008-06-07 20:28 d-------- C:\WINDOWS\ERUNT
2008-06-07 18:55 . 2008-06-08 19:58 d-------- C:\Documents and Settings\Ani\Application Data\SUPERAntiSpyware.com
2008-06-07 18:55 . 2008-06-07 18:55 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-06-07 18:54 . 2008-06-07 18:54 d-------- C:\Program Files\Sun
2008-06-07 18:50 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-06-07 18:38 . 2008-06-07 18:38 d-------- C:\Program Files\CCleaner
2008-06-05 18:46 . 2008-06-09 20:16 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-05 18:46 . 2008-06-05 18:46 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-30 20:02 . 2008-05-30 20:02 d-------- C:\Documents and Settings\Ani\Application Data\Malwarebytes
2008-05-30 20:01 . 2008-06-08 21:30 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-30 20:01 . 2008-05-30 20:01 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-30 20:01 . 2008-06-05 16:04 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-30 20:01 . 2008-06-05 16:04 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-29 21:58 . 2008-05-29 21:58 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
2008-05-29 21:55 . 2007-08-13 19:52 66,048 --a------ C:\WINDOWS\ieResetIcons.exe
2008-05-29 21:40 . 2008-05-29 21:40 d-------- C:\Program Files\Trend Micro
2008-05-28 22:14 . 2008-05-29 21:56 d-------- C:\Documents and Settings\Ani\Application Data\F-Secure
2008-05-28 22:06 . 2005-06-21 18:32 70,224 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
2008-05-28 22:06 . 2005-06-21 18:31 33,744 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys
2008-05-28 22:05 . 2008-05-28 22:05 d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
2008-05-28 22:05 . 2008-05-28 22:05 118,842 -r------- C:\WINDOWS\bwUnin-6.3.2.116-7681197L.exe
2008-05-28 22:02 . 2008-05-28 22:02 d-------- C:\Documents and Settings\Ani\Application Data\Yahoo!
2008-05-28 21:53 . 2008-05-28 22:05 d-------- C:\Program Files\F-Secure
2008-05-28 19:26 . 2008-05-28 19:43 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-28 18:49 . 2008-05-29 21:28 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-21 15:45 . 2008-05-21 15:45 d-------- C:\Program Files\D-Link
2008-05-21 15:45 . 2001-10-16 13:34 279,040 --a------ C:\WINDOWS\system32\gsi.cpl
2008-05-21 15:45 . 2001-09-28 07:04 242,946 --a------ C:\WINDOWS\system32\drivers\glausb.sys
2008-05-21 15:45 . 2001-10-16 13:35 75,776 --a------ C:\WINDOWS\system32\gsicon.exe
2008-05-21 15:45 . 2001-09-28 07:07 26,987 --a------ C:\WINDOWS\system32\drivers\gafwload.sys
2008-05-21 15:45 . 2001-10-02 04:43 25,088 --a------ C:\WINDOWS\system32\CoInst.dll
2008-05-21 15:45 . 2001-10-02 04:42 24,576 --a------ C:\WINDOWS\system32\delaySpawn.exe
2008-05-21 15:45 . 2001-10-02 04:42 16,384 --a------ C:\WINDOWS\system32\dslagent.exe
2008-05-21 15:44 . 2001-10-16 13:49 102,400 --a------ C:\WINDOWS\system32\instDll.dll
2008-05-21 15:44 . 2001-10-02 04:42 98,304 --a------ C:\WINDOWS\system32\gspnDll.dll
2008-05-21 15:44 . 2001-10-16 13:04 12,303 --------- C:\WINDOWS\wwdslcfg.ini
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 10:15 --------- d-----w C:\Program Files\DC++
2008-06-07 15:50 --------- d-----w C:\Program Files\Java
2008-05-30 18:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-05-30 18:23 --------- d-----w C:\Program Files\Windows Live
2008-05-29 21:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-05-29 18:28 --------- d-----w C:\Program Files\Lavasoft
2008-05-28 19:03 --------- d-----w C:\Program Files\Yahoo!
2008-05-28 15:50 --------- d-----w C:\Documents and Settings\Ani\Application Data\Lavasoft
2008-05-27 20:57 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-05-27 20:43 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-05-21 12:45 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-29 17:57 --------- d-----w C:\Documents and Settings\Ani\Application Data\Apple Computer
2008-04-21 07:04 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-01-31 19:43 14,290 ----a-w C:\Program Files\settings.dat
2007-10-20 16:27 32,248 ----a-w C:\Documents and Settings\Ani\Application Data\GDIPFONTCACHEV1.DAT
.
((((((((((((((((((((((((((((( snapshot_2008-06-07_10.30.04.79 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-05 03:45:26 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-11 00:13:13 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-14 11:01:02 272,128 ------w C:\WINDOWS\Driver Cache\i386\bthport.sys
+ 2008-06-07 06:25:02 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-06-07 17:29:07 5,386,240 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-06-07 17:29:07 245,760 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-06-07 06:25:02 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-06-07 17:28:56 5,386,240 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-06-07 17:28:56 245,760 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
- 2008-02-16 08:59:34 1,023,488 ----a-w C:\WINDOWS\system32\browseui.dll
+ 2008-04-21 07:03:56 1,023,488 ----a-w C:\WINDOWS\system32\browseui.dll
- 2008-02-16 08:59:35 151,040 ----a-w C:\WINDOWS\system32\cdfview.dll
+ 2008-04-21 07:03:56 151,040 ----a-w C:\WINDOWS\system32\cdfview.dll
- 2008-02-16 08:59:35 1,054,208 ----a-w C:\WINDOWS\system32\danim.dll
+ 2008-04-21 07:03:57 1,054,208 ----a-w C:\WINDOWS\system32\danim.dll
- 2008-02-16 08:59:34 1,023,488 -c--a-w C:\WINDOWS\system32\dllcache\browseui.dll
+ 2008-04-21 07:03:56 1,023,488 -c--a-w C:\WINDOWS\system32\dllcache\browseui.dll
- 2008-02-16 08:59:35 151,040 -c--a-w C:\WINDOWS\system32\dllcache\cdfview.dll
+ 2008-04-21 07:03:56 151,040 -c--a-w C:\WINDOWS\system32\dllcache\cdfview.dll
- 2008-02-16 08:59:35 1,054,208 -c--a-w C:\WINDOWS\system32\dllcache\danim.dll
+ 2008-04-21 07:03:57 1,054,208 -c--a-w C:\WINDOWS\system32\dllcache\danim.dll
- 2008-02-16 08:59:35 357,888 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2008-04-21 07:03:57 357,888 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2008-02-16 08:59:35 205,312 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2008-04-21 07:03:57 205,312 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2008-02-16 08:59:35 55,808 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2008-04-21 07:03:57 55,808 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll
- 2008-02-15 09:23:37 18,432 -c--a-w C:\WINDOWS\system32\dllcache\iedw.exe
+ 2008-04-17 10:52:54 18,432 -c--a-w C:\WINDOWS\system32\dllcache\iedw.exe
- 2008-02-16 08:59:35 251,392 -c--a-w C:\WINDOWS\system32\dllcache\iepeers.dll
+ 2008-04-21 07:03:58 251,392 -c--a-w C:\WINDOWS\system32\dllcache\iepeers.dll
- 2008-02-16 08:59:35 96,256 -c--a-w C:\WINDOWS\system32\dllcache\inseng.dll
+ 2008-04-21 07:03:58 96,256 -c--a-w C:\WINDOWS\system32\dllcache\inseng.dll
- 2008-02-16 08:59:35 16,384 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2008-04-21 07:03:58 16,384 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2008-02-16 22:29:38 3,059,712 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2008-04-21 07:03:59 3,059,712 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll
- 2008-02-16 08:59:37 449,024 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2008-04-21 07:03:59 449,024 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2008-02-16 08:59:37 146,432 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2008-04-21 07:03:59 146,432 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll
- 2008-02-16 08:59:37 532,480 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2008-04-21 07:03:59 532,480 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll
- 2008-02-16 08:59:37 39,424 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2008-04-21 07:03:59 39,424 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
- 2007-10-29 22:43:03 1,287,680 -c--a-w C:\WINDOWS\system32\dllcache\quartz.dll
+ 2008-05-07 05:18:48 1,287,680 -c--a-w C:\WINDOWS\system32\dllcache\quartz.dll
- 2006-07-13 08:48:58 202,240 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys
+ 2008-05-08 12:28:49 202,752 -c--a-w C:\WINDOWS\system32\dllcache\rmcast.sys
- 2008-02-16 08:59:38 1,494,528 -c--a-w C:\WINDOWS\system32\dllcache\shdocvw.dll
+ 2008-04-21 07:04:00 1,494,528 -c--a-w C:\WINDOWS\system32\dllcache\shdocvw.dll
- 2008-02-16 08:59:38 474,112 -c--a-w C:\WINDOWS\system32\dllcache\shlwapi.dll
+ 2008-04-21 07:04:00 474,112 -c--a-w C:\WINDOWS\system32\dllcache\shlwapi.dll
- 2008-02-16 08:59:38 615,936 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2008-04-21 07:04:00 615,936 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll
- 2008-02-16 08:59:39 659,456 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2008-04-21 07:04:00 659,456 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll
- 2008-02-16 08:59:35 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll
+ 2008-04-21 07:03:57 357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll
- 2008-02-16 08:59:35 205,312 ----a-w C:\WINDOWS\system32\dxtrans.dll
+ 2008-04-21 07:03:57 205,312 ----a-w C:\WINDOWS\system32\dxtrans.dll
- 2008-02-16 08:59:35 55,808 ----a-w C:\WINDOWS\system32\extmgr.dll
+ 2008-04-21 07:03:57 55,808 ----a-w C:\WINDOWS\system32\extmgr.dll
- 2008-02-16 08:59:35 251,392 ----a-w C:\WINDOWS\system32\iepeers.dll
+ 2008-04-21 07:03:58 251,392 ----a-w C:\WINDOWS\system32\iepeers.dll
- 2008-02-16 08:59:35 96,256 ----a-w C:\WINDOWS\system32\inseng.dll
+ 2008-04-21 07:03:58 96,256 ----a-w C:\WINDOWS\system32\inseng.dll
- 2006-10-11 23:35:14 49,248 ----a-w C:\WINDOWS\system32\java.exe
+ 2008-02-21 22:23:35 135,168 ----a-w C:\WINDOWS\system32\java.exe
- 2006-10-11 23:35:24 53,346 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2008-02-21 22:23:39 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
- 2006-10-12 01:10:56 127,078 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2008-02-21 23:33:32 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
- 2008-02-16 08:59:35 16,384 ----a-w C:\WINDOWS\system32\jsproxy.dll
+ 2008-04-21 07:03:58 16,384 ----a-w C:\WINDOWS\system32\jsproxy.dll
- 2008-05-09 21:35:04 16,863,864 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-05-29 23:35:11 17,486,968 ----a-w C:\WINDOWS\system32\MRT.exe
- 2008-02-16 22:29:38 3,059,712 ----a-w C:\WINDOWS\system32\mshtml.dll
+ 2008-04-21 07:03:59 3,059,712 ----a-w C:\WINDOWS\system32\mshtml.dll
- 2008-02-16 08:59:37 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll
+ 2008-04-21 07:03:59 449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll
- 2008-02-16 08:59:37 146,432 ----a-w C:\WINDOWS\system32\msrating.dll
+ 2008-04-21 07:03:59 146,432 ----a-w C:\WINDOWS\system32\msrating.dll
- 2008-02-16 08:59:37 532,480 ----a-w C:\WINDOWS\system32\mstime.dll
+ 2008-04-21 07:03:59 532,480 ----a-w C:\WINDOWS\system32\mstime.dll
- 2008-02-16 08:59:37 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll
+ 2008-04-21 07:03:59 39,424 ----a-w C:\WINDOWS\system32\pngfilt.dll
- 2008-02-16 08:59:38 1,494,528 ----a-w C:\WINDOWS\system32\shdocvw.dll
+ 2008-04-21 07:04:00 1,494,528 ----a-w C:\WINDOWS\system32\shdocvw.dll
- 2008-02-16 08:59:38 474,112 ----a-w C:\WINDOWS\system32\shlwapi.dll
+ 2008-04-21 07:04:00 474,112 ----a-w C:\WINDOWS\system32\shlwapi.dll
- 2006-12-10 12:10:02 14,640 ----a-w C:\WINDOWS\system32\spmsg.dll
+ 2007-11-30 11:18:51 17,272 ------w C:\WINDOWS\system32\spmsg.dll
- 2008-02-16 08:59:38 615,936 ----a-w C:\WINDOWS\system32\urlmon.dll
+ 2008-04-21 07:04:00 615,936 ----a-w C:\WINDOWS\system32\urlmon.dll
- 2008-02-15 09:06:21 351,744 ----a-w C:\WINDOWS\system32\xpsp3res.dll
+ 2008-04-17 10:37:04 351,744 ----a-w C:\WINDOWS\system32\xpsp3res.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 17:21 1449984]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:07 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-06-20 21:42 77824 C:\WINDOWS\SOUNDMAN.EXE]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-12-10 04:06 7311360]
"nwiz"="nwiz.exe" [2005-12-10 04:06 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-12-10 04:06 86016]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 17:57 133016]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 13:36 229376]
"SsAAD.exe"="C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe" [2006-01-07 03:36 81920]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]
"DSLAGENTEXE"="dslagent.exe" [2001-10-02 04:42 16384 C:\WINDOWS\system32\dslagent.exe]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2005-06-03 01:37 122929]
"F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 04:07 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-11-14 19:46:49 113664]
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-06-07 18:05:38 553021]
F-Secure Automatic Update.lnk - C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe [2008-05-28 22:05:43 32807]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 13:01:04 83360]
WLAN Monitor Utility.lnk - C:\Program Files\WLAN\802.11 Wireless LAN\WWlanMonitor.exe [2007-05-12 22:05:12 475136]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= C:\Program Files\ffdshow\ffdshow.ax
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Image Zone -pikakäynnistys.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Image Zone -pikakäynnistys.lnk
backup=C:\WINDOWS\pss\HP Image Zone -pikakäynnistys.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^DOCUME~1^ALLUSE~1^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\DOCUME~1\ALLUSE~1\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray]
--a------ 2002-11-05 04:00 184320 C:\Program Files\Creative\Shared Files\CAMTRAY.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
--a------ 2004-05-12 16:18 241664 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2004-02-12 14:38 49152 C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark 2200 Series]
--------- 2004-02-13 16:10 57344 C:\Program Files\Lexmark 2200 Series\lxbvbmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 12:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2006-10-12 04:10 49263 C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2006-10-25 08:37 35328 C:\Program Files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires III - The WarChiefs Trial\\age3x.exe"=
"C:\\Program Files\\Microsoft Games\\Zoo Tycoon 2 Endangered Species Trial Version\\zt.exe"=
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-06-21 18:32]
R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2008-05-28 22:05]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2004-09-10 18:14]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-02-16 18:49]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2004-12-17 12:34]
R2 ScFBPNT2;CanoScan FBP2 Port Driver;C:\WINDOWS\system32\drivers\ScFBPNT2.SYS [2000-02-08 10:30]
R3 PCnetHL;AMD PCnet-Home Adapter Driver;C:\WINDOWS\system32\DRIVERS\pcntn5hl.sys [2001-08-17 15:11]
R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);C:\WINDOWS\system32\DRIVERS\RMSPPPOE.SYS [2002-10-03 11:09]
S2 gafwload;D-Link DSL-200 USB ADSL Loader;C:\WINDOWS\system32\DRIVERS\gafwload.sys [2001-09-28 07:07]
S3 glausb;D-Link DSL-200 USB ADSL Modem(LAN);C:\WINDOWS\system32\DRIVERS\glausb.sys [2001-09-28 07:04]
S3 StickCap;Digital TV DVB-T USB Stick adapter service;C:\WINDOWS\system32\Drivers\stickcap.sys []
S3 stickload;Digital TV stick firmware loader service;C:\WINDOWS\system32\DRIVERS\stickload.sys []
S3 USBFVNETR;WLAN 11Mbps USB ADAPTER-G;C:\WINDOWS\system32\DRIVERS\vnetusbr.sys [2003-04-17 11:20]
S3 V0010bVd;Creative WebCam Vista #2;C:\WINDOWS\system32\DRIVERS\V0010bVd.sys [2003-04-21 10:19]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fa89565a-84a9-11dc-997d-0008a165eef9}]
\Shell\AutoRun\command - M:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
"2008-06-09 19:42:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-11 16:58:59
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-11 17:20:36
ComboFix-quarantined-files.txt 2008-06-11 14:20:11
ComboFix2.txt 2008-06-09 06:16:58
ComboFix3.txt 2008-06-08 17:13:03
ComboFix4.txt 2008-06-08 16:01:30
ComboFix5.txt 2008-06-08 11:40:06
Pre-Run: 5,751,136,256 bytes free
Post-Run: 5,033,152,512 bytes free
292 --- E O F --- 2008-06-11 00:06:16
mites kone toimii
Eli nyt ilmeisesti sai häädettyä ne! Kiitos kovasti avusta!