tälläinen kiusallinen ollut pitemmän aikaa koneellaLogfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:36:41, on 2.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBNE.EXE
C:\WINDOWS\winudpmgr.exe
C:\Windows\mservice.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.plaza.fi/ellit
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;*.fi;*.*.fi;*.*.*.fi;localhost;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {75A08144-556B-49D9-8DB3-E3BD96A386E7} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {94BC3D1D-22E9-4744-8ED1-3E08A3B74078} - (no file)
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [EPSON Stylus DX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.EXE /P26 "EPSON Stylus DX4800 Series" /O6 "USB001" /M "Stylus DX4800"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
O4 - HKLM\..\Run: [Windows svchost] service.exe
O4 - HKLM\..\Run: [Windows UDP Control Center] winudpmgr.exe
O4 - HKLM\..\Run: [MSN] C:\Windows\mservice.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [EPSON Stylus Photo R265 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBNE.EXE /FU "C:\DOCUME~1\Riitta\LOCALS~1\Temp\E_SA8.tmp" /EF "HKCU"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1206545183769
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
--
End of file - 9644 bytes
...löytyykö mitään poistettavaa? kiitos!
malware
3
708
Vastaukset
- FixFix
eiköhän niistäkin selvitä
1.Lataa combofix.exe työpöydällesi yhdestä, kahdesta klinkistä:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.- Rita.j.
Tässähän tämä. Poistiko tämä combofix nyt ne saastuneet?
ComboFix 08-06-06.2 - Riitta 2008-06-06 22:06:56.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.287 [GMT 3:00]
Running from: C:\Documents and Settings\Riitta\Työpöytä\ComboFix.exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\d.exe
C:\Documents and Settings\Jesse\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Documents and Settings\Riitta\new.txt
C:\WINDOWS\system32\hgGaxyYO.dll
C:\WINDOWS\system32\msssc.dll
C:\WINDOWS\system32\rqRKDSMe.dll
C:\WINDOWS\ups.exe
.
---- Previous Run -------
.
C:\bot.exe
C:\setup.exe
C:\WINDOWS\BMabed4d73.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\service.exe
C:\WINDOWS\system32\cbXroLCU.dll
C:\WINDOWS\system32\efcCssTM.dll
C:\WINDOWS\system32\ljJDVmMf.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mlJCRiGa.dll
C:\WINDOWS\system32\nnnkLbyw.dll
C:\WINDOWS\system32\opnomnlM.dll
C:\WINDOWS\system32\PAyHOqru.ini
C:\WINDOWS\system32\PAyHOqru.ini2
C:\WINDOWS\system32\pmnkJcbB.dll
C:\WINDOWS\system32\tpetooem.ini
C:\WINDOWS\system32\wvUMCUNg.dll
C:\WINDOWS\system32\xxyvWqPG.dll
C:\WINDOWS\ups.exe
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-06 to 2008-06-06 )))))))))))))))))
.
2008-06-06 22:02 . 2008-06-06 22:02 57,856 --a------ C:\WINDOWS\system32\pmnligFU.dll
2008-06-06 21:28 . 2008-06-06 21:28 49,156 --a------ C:\shz.exe
2008-06-06 20:41 . 2008-06-06 20:41 49,156 --a------ C:\sjgz.exe
2008-06-06 20:40 . 2008-06-06 22:09 49,156 --a------ C:\hszs.exe
2008-06-06 20:38 . 2008-06-06 20:38 49,156 --a------ C:\Documents and Settings\Nina\sz.exe
2008-06-06 20:22 . 2008-06-06 20:22 49,156 --a------ C:\sjz.exe
2008-06-04 21:59 . 2008-06-04 22:06 86,528 --a------ C:\stp.exe
2008-06-04 16:41 . 2008-06-04 20:35 3,424 --a------ C:\is155400.exe
2008-06-03 23:39 . 2008-06-03 23:40 202,210 --a------ C:\sxy.exe
2008-06-03 22:58 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Riitta\setupa.exe
2008-06-03 21:57 . 2008-06-03 23:05 86,548 --a------ C:\ssetup.exe
2008-06-03 21:26 . 2008-06-04 10:10 3,423 --a------ C:\WINDOWS\is154890.exe
2008-06-03 17:01 . 2008-06-03 17:01 d-------- C:\Documents and Settings\Nina\Application Data\Simply Super Software
2008-06-03 01:01 . 2008-06-03 01:01 104,078 --a------ C:\WINDOWS\sb.exe
2008-06-02 22:29 . 2008-06-02 22:29 97,116 --a------ C:\WINDOWS\DC5177176.zip
2008-06-02 21:36 . 2008-06-02 21:36 d-------- C:\Program Files\Trend Micro
2008-06-02 21:35 . 2008-06-03 00:39 96,950 --a------ C:\Documents and Settings\Riitta\setup.exe
2008-06-02 21:28 . 2008-06-02 21:28 96,950 --a------ C:\stupx.exe
2008-06-02 21:23 . 2008-06-03 15:23 96,950 -r-hs---- C:\WINDOWS\mservice.exe
2008-06-02 21:23 . 2008-06-02 21:23 96,950 --a------ C:\stup.exe
2008-06-02 19:06 . 2008-06-02 19:07 35,840 --a------ C:\d1.exe
2008-06-02 19:05 . 2008-06-02 19:05 5,120 --a------ C:\rpqlvo.exe
2008-06-02 19:05 . 2008-06-02 19:05 2 --a------ C:\-1461813696
2008-06-02 19:03 . 2008-06-02 19:05 14,336 --a------ C:\abhwevhi.exe
2008-06-02 19:03 . 2008-06-02 19:03 2,048 --a------ C:\uucn.exe
2008-06-02 19:01 . 2008-06-02 19:03 6,144 --a------ C:\vieiiy.exe
2008-06-02 18:58 . 2008-06-02 19:00 11,264 --a------ C:\hldtlwe.exe
2008-06-02 17:35 . 2008-06-03 17:50 60,114 --a------ C:\bot1.exe
2008-06-01 19:45 . 2008-06-01 20:46 86,502 --a------ C:\sexy.com
2008-05-30 19:23 . 2008-05-30 22:12 60,132 --a------ C:\dcsi.exe
2008-05-30 19:04 . 2008-05-30 19:42 83,400 --a------ C:\img.exe
2008-05-30 19:03 . 2008-05-30 22:47 60,132 --a------ C:\dci.exe
2008-05-30 18:40 . 2008-05-30 18:40 83,400 -r-hs---- C:\WINDOWS\winudpmgr.exe
2008-05-30 18:05 . 2008-06-03 16:07 96,950 --a------ C:\Documents and Settings\Nina\setup.exe
2008-05-29 23:08 . 2008-05-29 23:08 86,340 -r-hs---- C:\WINDOWS\winudspm.exe
2008-05-29 22:45 . 2008-06-03 17:01 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-29 22:44 . 2008-06-06 22:01 d-------- C:\Program Files\Trojan Remover
2008-05-29 15:19 . 2008-05-29 15:19 59,392 --a------ C:\WINDOWS\system32\iifgHabc.dll
2008-05-28 21:04 . 2008-05-28 21:04 d-------- C:\Documents and Settings\Riitta\Application Data\EPSON
2008-05-28 18:46 . 2008-05-28 19:21 56,832 --a------ C:\WINDOWS\winudspm.exe.vir
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-06 17:44 --------- d-----w C:\Documents and Settings\Nina\Application Data\OpenOffice.org2
2008-06-04 04:29 --------- d-----w C:\Documents and Settings\Riitta\Application Data\uTorrent
2008-06-02 13:07 --------- d-----w C:\Documents and Settings\Nina\Application Data\gtk-2.0
2008-06-02 12:27 --------- d-----w C:\Documents and Settings\Nina\Application Data\uTorrent
2008-05-30 18:45 --------- d-----w C:\Program Files\EPSON Print CD
2008-05-23 14:23 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-05-20 18:02 --------- d-----w C:\Documents and Settings\Jesse\Application Data\OpenOffice.org2
2008-04-28 18:39 --------- d-----w C:\Program Files\Google
2008-04-28 15:56 --------- d-----w C:\Program Files\OpenOffice.org 2.0
2008-04-22 19:44 --------- d-----w C:\Documents and Settings\Riitta\Application Data\LimeWire
2008-04-17 12:48 --------- d-----w C:\Documents and Settings\Nina\Application Data\LimeWire
2008-04-08 18:34 --------- d-----w C:\Program Files\Java
2008-03-26 14:41 81,920 ------r C:\WINDOWS\bwUnin-6.1.4.56-4436233L.exe
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
.
((((((((((((((((((((((((((((( snapshot@2008-06-06_21.58.58.15 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-06 18:51:28 2,048 --s-a-w C:\WINDOWS\bootstat.dat
2008-06-06 19:01:36 2,048 --s-a-w C:\WINDOWS\bootstat.dat
2008-06-06 19:01:46 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5a0.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-28 16:21 68856]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 13:55 5674352]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-08-21 14:52 202024]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-10-28 22:10 335872]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 09:57 143360]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2008-03-01 08:10 15872]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 09:25 1828136]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"EPSON Stylus DX4800 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.exe" [2005-02-02 07:00 98304]
"Windows UDP Control"="winudspm.exe" [2008-05-29 23:08 86340 C:\WINDOWS\winudspm.exe]
"Windows svchost"="ups.exe" [2004-09-15 02:12 18432 C:\WINDOWS\system32\ups.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 02:12 15360]
C:\Documents and Settings\Jesse\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe [2006-07-14 21:26:34 393216]
C:\Documents and Settings\Nina\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe [2006-07-14 21:26:34 393216]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Nero\\Nero8\\Nero ShowTime\\ShowTime.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-06-06 18:47:06 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-06 22:09:25
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\WINDOWS\ups.exe
scan completed successfully
hidden files: 1
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\Ati2evxx.dll
.
Completion time: 2008-06-06 22:12:03
ComboFix-quarantined-files.txt 2008-06-06 19:11:18
Pre-Run: 41,344,987,136 tavua vapaana
Post-Run: 41,336,492,032 tavua vapaana
169 --- E O F --- 2008-05-28 18:21:10 - FixFix
Rita.j. kirjoitti:
Tässähän tämä. Poistiko tämä combofix nyt ne saastuneet?
ComboFix 08-06-06.2 - Riitta 2008-06-06 22:06:56.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.287 [GMT 3:00]
Running from: C:\Documents and Settings\Riitta\Työpöytä\ComboFix.exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\d.exe
C:\Documents and Settings\Jesse\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Documents and Settings\Riitta\new.txt
C:\WINDOWS\system32\hgGaxyYO.dll
C:\WINDOWS\system32\msssc.dll
C:\WINDOWS\system32\rqRKDSMe.dll
C:\WINDOWS\ups.exe
.
---- Previous Run -------
.
C:\bot.exe
C:\setup.exe
C:\WINDOWS\BMabed4d73.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\service.exe
C:\WINDOWS\system32\cbXroLCU.dll
C:\WINDOWS\system32\efcCssTM.dll
C:\WINDOWS\system32\ljJDVmMf.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mlJCRiGa.dll
C:\WINDOWS\system32\nnnkLbyw.dll
C:\WINDOWS\system32\opnomnlM.dll
C:\WINDOWS\system32\PAyHOqru.ini
C:\WINDOWS\system32\PAyHOqru.ini2
C:\WINDOWS\system32\pmnkJcbB.dll
C:\WINDOWS\system32\tpetooem.ini
C:\WINDOWS\system32\wvUMCUNg.dll
C:\WINDOWS\system32\xxyvWqPG.dll
C:\WINDOWS\ups.exe
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-06 to 2008-06-06 )))))))))))))))))
.
2008-06-06 22:02 . 2008-06-06 22:02 57,856 --a------ C:\WINDOWS\system32\pmnligFU.dll
2008-06-06 21:28 . 2008-06-06 21:28 49,156 --a------ C:\shz.exe
2008-06-06 20:41 . 2008-06-06 20:41 49,156 --a------ C:\sjgz.exe
2008-06-06 20:40 . 2008-06-06 22:09 49,156 --a------ C:\hszs.exe
2008-06-06 20:38 . 2008-06-06 20:38 49,156 --a------ C:\Documents and Settings\Nina\sz.exe
2008-06-06 20:22 . 2008-06-06 20:22 49,156 --a------ C:\sjz.exe
2008-06-04 21:59 . 2008-06-04 22:06 86,528 --a------ C:\stp.exe
2008-06-04 16:41 . 2008-06-04 20:35 3,424 --a------ C:\is155400.exe
2008-06-03 23:39 . 2008-06-03 23:40 202,210 --a------ C:\sxy.exe
2008-06-03 22:58 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Riitta\setupa.exe
2008-06-03 21:57 . 2008-06-03 23:05 86,548 --a------ C:\ssetup.exe
2008-06-03 21:26 . 2008-06-04 10:10 3,423 --a------ C:\WINDOWS\is154890.exe
2008-06-03 17:01 . 2008-06-03 17:01 d-------- C:\Documents and Settings\Nina\Application Data\Simply Super Software
2008-06-03 01:01 . 2008-06-03 01:01 104,078 --a------ C:\WINDOWS\sb.exe
2008-06-02 22:29 . 2008-06-02 22:29 97,116 --a------ C:\WINDOWS\DC5177176.zip
2008-06-02 21:36 . 2008-06-02 21:36 d-------- C:\Program Files\Trend Micro
2008-06-02 21:35 . 2008-06-03 00:39 96,950 --a------ C:\Documents and Settings\Riitta\setup.exe
2008-06-02 21:28 . 2008-06-02 21:28 96,950 --a------ C:\stupx.exe
2008-06-02 21:23 . 2008-06-03 15:23 96,950 -r-hs---- C:\WINDOWS\mservice.exe
2008-06-02 21:23 . 2008-06-02 21:23 96,950 --a------ C:\stup.exe
2008-06-02 19:06 . 2008-06-02 19:07 35,840 --a------ C:\d1.exe
2008-06-02 19:05 . 2008-06-02 19:05 5,120 --a------ C:\rpqlvo.exe
2008-06-02 19:05 . 2008-06-02 19:05 2 --a------ C:\-1461813696
2008-06-02 19:03 . 2008-06-02 19:05 14,336 --a------ C:\abhwevhi.exe
2008-06-02 19:03 . 2008-06-02 19:03 2,048 --a------ C:\uucn.exe
2008-06-02 19:01 . 2008-06-02 19:03 6,144 --a------ C:\vieiiy.exe
2008-06-02 18:58 . 2008-06-02 19:00 11,264 --a------ C:\hldtlwe.exe
2008-06-02 17:35 . 2008-06-03 17:50 60,114 --a------ C:\bot1.exe
2008-06-01 19:45 . 2008-06-01 20:46 86,502 --a------ C:\sexy.com
2008-05-30 19:23 . 2008-05-30 22:12 60,132 --a------ C:\dcsi.exe
2008-05-30 19:04 . 2008-05-30 19:42 83,400 --a------ C:\img.exe
2008-05-30 19:03 . 2008-05-30 22:47 60,132 --a------ C:\dci.exe
2008-05-30 18:40 . 2008-05-30 18:40 83,400 -r-hs---- C:\WINDOWS\winudpmgr.exe
2008-05-30 18:05 . 2008-06-03 16:07 96,950 --a------ C:\Documents and Settings\Nina\setup.exe
2008-05-29 23:08 . 2008-05-29 23:08 86,340 -r-hs---- C:\WINDOWS\winudspm.exe
2008-05-29 22:45 . 2008-06-03 17:01 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-29 22:44 . 2008-06-06 22:01 d-------- C:\Program Files\Trojan Remover
2008-05-29 15:19 . 2008-05-29 15:19 59,392 --a------ C:\WINDOWS\system32\iifgHabc.dll
2008-05-28 21:04 . 2008-05-28 21:04 d-------- C:\Documents and Settings\Riitta\Application Data\EPSON
2008-05-28 18:46 . 2008-05-28 19:21 56,832 --a------ C:\WINDOWS\winudspm.exe.vir
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-06 17:44 --------- d-----w C:\Documents and Settings\Nina\Application Data\OpenOffice.org2
2008-06-04 04:29 --------- d-----w C:\Documents and Settings\Riitta\Application Data\uTorrent
2008-06-02 13:07 --------- d-----w C:\Documents and Settings\Nina\Application Data\gtk-2.0
2008-06-02 12:27 --------- d-----w C:\Documents and Settings\Nina\Application Data\uTorrent
2008-05-30 18:45 --------- d-----w C:\Program Files\EPSON Print CD
2008-05-23 14:23 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-05-20 18:02 --------- d-----w C:\Documents and Settings\Jesse\Application Data\OpenOffice.org2
2008-04-28 18:39 --------- d-----w C:\Program Files\Google
2008-04-28 15:56 --------- d-----w C:\Program Files\OpenOffice.org 2.0
2008-04-22 19:44 --------- d-----w C:\Documents and Settings\Riitta\Application Data\LimeWire
2008-04-17 12:48 --------- d-----w C:\Documents and Settings\Nina\Application Data\LimeWire
2008-04-08 18:34 --------- d-----w C:\Program Files\Java
2008-03-26 14:41 81,920 ------r C:\WINDOWS\bwUnin-6.1.4.56-4436233L.exe
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
.
((((((((((((((((((((((((((((( snapshot@2008-06-06_21.58.58.15 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-06 18:51:28 2,048 --s-a-w C:\WINDOWS\bootstat.dat
2008-06-06 19:01:36 2,048 --s-a-w C:\WINDOWS\bootstat.dat
2008-06-06 19:01:46 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5a0.dat
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-28 16:21 68856]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 13:55 5674352]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-08-21 14:52 202024]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-10-28 22:10 335872]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 09:57 143360]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2008-03-01 08:10 15872]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 09:25 1828136]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"EPSON Stylus DX4800 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADE.exe" [2005-02-02 07:00 98304]
"Windows UDP Control"="winudspm.exe" [2008-05-29 23:08 86340 C:\WINDOWS\winudspm.exe]
"Windows svchost"="ups.exe" [2004-09-15 02:12 18432 C:\WINDOWS\system32\ups.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 02:12 15360]
C:\Documents and Settings\Jesse\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe [2006-07-14 21:26:34 393216]
C:\Documents and Settings\Nina\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe [2006-07-14 21:26:34 393216]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Nero\\Nero8\\Nero ShowTime\\ShowTime.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Common Files\\Nero\\Nero Web\\SetupX.exe"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-06-06 18:47:06 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-06 22:09:25
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\WINDOWS\ups.exe
scan completed successfully
hidden files: 1
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\Ati2evxx.dll
.
Completion time: 2008-06-06 22:12:03
ComboFix-quarantined-files.txt 2008-06-06 19:11:18
Pre-Run: 41,344,987,136 tavua vapaana
Post-Run: 41,336,492,032 tavua vapaana
169 --- E O F --- 2008-05-28 18:21:10Poista lisää poista sovelutuksesta
AskTBar
Poista kansio vikasiedossa
C:\Program Files==> \AskTBar
Ketjusta on poistettu 0 sääntöjenvastaista viestiä.
Luetuimmat keskustelut
Miksi jollain jää "talvi päälle"
Huvittaa kastoa ullkona jotain vahempaa äijää joka pukeutuu edelleen kun olisi +5 astetta lämmittä vaikka on helle keli3083137Mitä et hyväksy miehessä/naisessa josta olet kiinnostunut?
Itse en halua, että miehellä olisi lapsia!2221967Se katse silloin
Oli hetki, jolloin katseemme kohtasivat. Oli talvi vielä. Kerta toisensa jälkeen palaan tuohon jaettuun katseeseen. Tunt591602Tiesitkö? Farmi Suomi Kirsikka Simberg on tämän julkkisnaisen tytär - Katso tyrmäävät mallikuvat!
Oho, aikamoinen ylläri. Tiesitkö?! Kirsikka Simberg on yksi tämän kauden Farmi Suomi -kisaajista. Hänellä ei ole tuttu t41404- 811288
Tuhdit oluet kauppoihin. Miksi vastustaa?
8% oluet kauppoihin mutta mikä siinä on että osa politikoista vstustaa ? Kauppa kuitenkin hinnoittelee vahvan oluen ni2721213- 811064
Sinua tulen kyllä ikävöimään pitkään nainen
mutta oli pakko tehdä päätös oman mielenrauhan vuoksi. Toivottavasti saat elämältä kaiken mitä haluat.521051- 80991
Asiallinen lähestyminen
Mitä on asiallinen lähestyminen?? Tietääkö tai tajuaako kukaan, varsinkaan miehet??? Eilen NELJÄNNEN kerran jouduin isk145867