Kun sain kanssa ton viruksen koneelle pari päivää sitten. Kaverikin sai sen ja ne vei sen koneensa huoltoon, siellä se korjaaja oli sanonu, että virusta oli "helv.." vaikea poistaa kun se virus etsii viruksia koneelle lisää.. No saivat koneen puhtaaksi. Mulla on nyt tää tälleen että onneksi pääsin suomi24, muille nettisivuille en oikeen pääse ja tää avaa välistä pop-up viruksia, ja turvaPC nettisivua..
Jos joku ymmärtää seuraavasta jutustani jotain, niin kiitos jos vastailet.
Välistä tulee ilmoitus:
Rundll32.exe -application Error
The instruction at "0x77124920" refencedmemory at "sama numerosarja". The memory could not be "read" Click on OK to terminate the program.
^ elikkä tollanen tulee välistä.. ei oo nyt kyllä tullu muutamaan päivään että ehkä poistunut toi?
Sitten kun käynnistän koneen, niin tähän työpöydälle hyppää mustia ruutuja, välistä 1 ja välistä enemmän. niissä lukee siinä C:bot.exe, ja siihen tulee alle välistä ruutu missä lukee näin:
16 Bit MS-Dos subsystem
C:bot/exe.
The NTVDM CPU has encounted an illegal instruction. CS:00ff IP:0000 OP:00 00 00 00 00 Choose 'Close' To terminate the application.
Close Ignore
Painan aina Close niin se sammuu se ruutu, mut en nyt tiiä painanko oikein..
Muunsin sitte niu numerosarjat nolliksi, oikeesti niis on enemmä eri numeroita.
Ja C: kansiossa on sexy.exe ja bot.exe ja jotain sexxy1 sex22 bot1 sxy jne tollasia. poistan ne aina ja heitän roskii mut ne tulee kuitenkin takasiin.. :/
Hei kiitti jos joku neropatti tajus jotain :)
Jos joku ymmärtää seuraavasta jutustani jotain, niin kiitos jos vastailet.
Välistä tulee ilmoitus:
Rundll32.exe -application Error
The instruction at "0x77124920" refencedmemory at "sama numerosarja". The memory could not be "read" Click on OK to terminate the program.
^ elikkä tollanen tulee välistä.. ei oo nyt kyllä tullu muutamaan päivään että ehkä poistunut toi?
Sitten kun käynnistän koneen, niin tähän työpöydälle hyppää mustia ruutuja, välistä 1 ja välistä enemmän. niissä lukee siinä C:bot.exe, ja siihen tulee alle välistä ruutu missä lukee näin:
16 Bit MS-Dos subsystem
C:bot/exe.
The NTVDM CPU has encounted an illegal instruction. CS:00ff IP:0000 OP:00 00 00 00 00 Choose 'Close' To terminate the application.
Close Ignore
Painan aina Close niin se sammuu se ruutu, mut en nyt tiiä painanko oikein..
Muunsin sitte niu numerosarjat nolliksi, oikeesti niis on enemmä eri numeroita.
Ja C: kansiossa on sexy.exe ja bot.exe ja jotain sexxy1 sex22 bot1 sxy jne tollasia. poistan ne aina ja heitän roskii mut ne tulee kuitenkin takasiin.. :/
Hei kiitti jos joku neropatti tajus jotain :)
Vastaukset 39
Vanhimmat
katotaas mitä siinä koneessa on
1.Lataa combofix.exe työpöydällesi yhdestä, kahdesta klinkistä:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe
2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
Itse kokeilin kaikki mahdolliset keinot poistaa k.o virus. Vasta ComboFix oli se, joka toimi. Nyt taas pelittää hyvin.
Logissa on kyllä tosi pitkä litania tekstiä, ja siinä näkyy tän koneen käyttäjän nimiä, yms. En haluis välttämättä luovuttaa koko tekstiä jos siinä on jotain mitä ei sais kertoo eteenpäi..?? :S
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !
Toi lukee Logissa melkeen ekana, mikä häh konsoli?
Other Deletions Kohdassa on paljon sisältöä, eli oli poistanu paljo juttuja?
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
Nojoo, vastaile fixfix
laitaa yksi tai tuleeha niitä useempia laitettavaksi.
minä en tuon lokini laitoon kuole.
ComboFix 08-06-06.6 - Admin 2008-06-07 14:53:34.22 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.1544 [GMT 3:00]
Running from: C:\Documents and Settings\XXXXX\Työpöytä\ComboFix.exe
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-07 to 2008-06-07 )))))))))))))))))
.
2008-06-04 22:42 . 2008-06-04 22:42 106 --a------ C:\delete.bat
2008-05-27 21:50 . 2008-05-28 00:47 d-------- C:\WINDOWS\SxsCaPendDel
2008-05-25 23:34 . 2008-02-20 16:18 d--h----- C:\Documents and Settings\XXXX\Verkkoympäristö
2008-05-25 23:34 . 2008-02-20 16:18 d-------- C:\Documents and Settings\Masko\Työpöytä
2008-05-25 23:34 . 2008-02-20 16:18 d--h----- C:\Documents and Settings\Masko\Tulostinympäristö
2008-05-25 23:34 . 2008-05-25 23:34 dr------- C:\Documents and Settings\Masko\Suosikit
2008-05-25 23:34 . 2008-05-25 23:34 dr------- C:\Documents and Settings\Masko\Omat tiedostot
2008-05-25 23:34 . 2008-02-20 14:25 d--h----- C:\Documents and Settings\Masko\Mallit
2008-05-25 23:34 . 2008-02-20 16:18 dr------- C:\Documents and Settings\Masko\Käynnistä-valikko
2008-05-25 23:34 . 2008-05-25 23:34 d-------- C:\Documents and Settings\Masko
2008-05-25 23:34 . 2006-03-02 15:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-05-10 21:48 . 2008-05-21 12:27 d-------- C:\Kaspersky
2008-05-10 21:48 . 2008-05-10 21:52 d-------- C:\Bases
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-07 04:51 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-06-05 13:04 34,296 ----a-w C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-05 13:04 15,864 ----a-w C:\WINDOWS\system32\drivers\mbam.sys
2008-05-27 20:08 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-27 18:50 --------- d-----w C:\Program Files\Microsoft Games
2008-05-27 18:36 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-27 18:36 --------- d-----w C:\Program Files\SpywareBlaster
2008-05-23 17:04 --------- d-----w C:\Program Files\Bet24
2008-04-28 00:59 24,224 ----a-w C:\Documents and Settings\Admin\Application Data\GDIPFONTCACHEV1.DAT
2008-04-27 14:02 --------- d-----w C:\Program Files\Google
2008-04-24 10:28 --------- d-----w C:\Documents and Settings\Admin\Application Data\HP
2008-04-10 18:37 --------- d-----w C:\Program Files\Picasa2
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2004-10-01 13:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CC17CB93-633F-407D-98F8-25DE790608BD}"= "C:\Program Files\Sunda Systems\Seram Web\webtra2.dll" [2008-01-20 22:32 625664]
[HKEY_CLASSES_ROOT\clsid\{cc17cb93-633f-407d-98f8-25de790608bd}]
[HKEY_CLASSES_ROOT\WebTra.WebTraObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{215F151F-7DDC-493e-95D5-4A0A98048EB8}]
[HKEY_CLASSES_ROOT\WebTra.WebTraObj]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{CC17CB93-633F-407D-98F8-25DE790608BD}"= C:\Program Files\Sunda Systems\Seram Web\webtra2.dll [2008-01-20 22:32 625664]
[HKEY_CLASSES_ROOT\clsid\{cc17cb93-633f-407d-98f8-25de790608bd}]
[HKEY_CLASSES_ROOT\WebTra.WebTraObj.1]
[HKEY_CLASSES_ROOT\TypeLib\{215F151F-7DDC-493e-95D5-4A0A98048EB8}]
[HKEY_CLASSES_ROOT\WebTra.WebTraObj]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 15:00 15360]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 04:23 443968]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2003-08-29 15:17 188416]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2003-08-29 15:20 77824]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 02:19 79224]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 04:11 925696]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-03-09 16:29 7561216]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 15:00 15360]
C:\Documents and Settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 05:44:06 29696]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 00:23:26 282624]
HP Image Zone -pikak„ynnistys.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-05-12 01:49:24 73728]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 13:01:04 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.enc"= ITIG726.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerBar]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
R3 PID_0920;Logitech QuickCam Express(PID_0920);C:\WINDOWS\system32\DRIVERS\LV532AV.SYS [2003-09-16 06:41]
S0 TfFsMon;TfFsMon;C:\WINDOWS\system32\drivers\TfFsMon.sys []
S0 TfSysMon;TfSysMon;C:\WINDOWS\system32\drivers\TfSysMon.sys []
S3 TfNetMon;TfNetMon;C:\WINDOWS\system32\drivers\TfNetMon.sys []
.
'Ajoitetut tehtävät'-kansion sisältö
"2008-06-07 11:12:00 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-07 14:54:31
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-07 14:54:54
ComboFix-quarantined-files.txt 2008-06-07 11:54:52
Pre-Run: 77,352,370,176 tavua vapaana
Post-Run: 77,343,686,656 tavua vapaana
132 --- E O F --- 2008-05-27 17:57:40
tossa mallia miten loki laitetaan
sitten sitä voi fixsata näin ne nimet
C:\Documents and Settings\Masko\Työpöytä
C:\Documents and Settings\XXXXX\Työpöytä
ComboFix 08-06-07.3 - XXXX 2008-06-08 14:08:11.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.51 [GMT 3:00]
Running from: C:\Documents and Settings\XXX.XXXX-ISLO1C8EI\Desktop\ComboFix.exe
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\DOCUME~1\xxxx~1.XXX\LOCALS~1\Temp\Del2.tmp
C:\Documents and Settings\All Users.WINDOWS\Application Data\WinAntiVirus Pro 2006
C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\NetMon
C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\NetMon\domains.txt
C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\NetMon\log.txt
C:\Documents and Settings\XXXXX.XXXX-ISLO1C8EI\Application Data\DriveCleaner 2006 Free
C:\Documents and Settings\XXXXX.XXXXX-ISLO1C8EI\Application Data\DriveCleaner 2006 Free\Logs\update.log
C:\Documents and Settings\XXXX\Application Data\HbTools
C:\Documents and Settings\XXXX\Application Data\HbTools\Wallpaper\[u]0[/u]70304Fun004_wp.jpg
C:\Documents and Settings\XXXX\Application Data\HbTools\Wallpaper\[u]0[/u]70304Fun012_wp.jpg
C:\Documents and Settings\XXXX\Application Data\HbTools\Wallpaper\[u]0[/u]90204WildLife0055_wp.jpg
C:\Documents and Settings\XXXX\Application Data\HbTools\Wallpaper\110504fun008_wp.jpg
C:\Documents and Settings\XXXX\Application Data\Starware
C:\Documents and Settings\XXXX\Application Data\Starware\MasterOptions.xml
C:\Documents and Settings\XXXX\Application Data\Starware\ProductOptions.xml
C:\Documents and Settings\XXXX\Application Data\Starware\ToolbarOptions.xml
C:\Documents and Settings\XXXX.XXXX-ISLO1C8EI\Application Data\DriveCleaner 2006 Free
C:\Documents and Settings\XXXX.XXXX-ISLO1C8EI\Application Data\DriveCleaner 2006 Free\Logs\update.log
C:\Documents and Settings\XXXXX.XXXXX-ISLO1C8EI\Application Data\macromedia\Flash Player\#SharedObjects\PW3W5X7P\iforex.com
C:\Documents and Settings\XXXX.XXXX-ISLO1C8EI\Application Data\macromedia\Flash Player\#SharedObjects\PW3W5X7P\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\XXXXX.XXXXX-ISLO1C8EI\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\XXXXX.XXXXX-ISLO1C8EI\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\Documents and Settings\XXXX.XXXX-ISLO1C8EI\Application Data\searchtoolbarcorp
C:\Documents and Settings\XXXXX.XXXX-ISLO1C8EI\Application Data\searchtoolbarcorp\Toolbar Vision\PageHistory.txt
C:\Documents and Settings\XXXX.XXXX-ISLO1C8EI\Application Data\searchtoolbarcorp\Toolbar Vision\WebHistory.txt
C:\Documents and Settings\XXXX.XXXX-ISLO1C8EI\Application Data\WinAntiVirus Pro 2006
C:\Documents and Settings\XXXX.XXXX-ISLO1C8EI\Application Data\WinAntiVirus Pro 2006\Logs\update.log
C:\Documents and Settings\XXXX.XXXX-ISLO1C8EI\Application Data\WinAntiVirus Pro 2006\Logs\wa6Support.log
C:\Documents and Settings\XXXX.XXXX-ISLO1C8EI\Application Data\WinAntiVirus Pro 2006\Logs\winav.log
C:\Documents and Settings\XXXX.XXXX-ISLO1C8EI\Application Data\WinAntiVirus Pro 2006\PGE.dat
C:\Program Files\Common Files\companion wizard
C:\Program Files\Common Files\companion wizard\compwiz.exe
C:\Program Files\Common Files\companion wizard\WapCHK.dll
C:\Program Files\Common Files\companion wizard\WapCHK{056AC675-C311-4377-AF49-CA39DFBAA62C}.dll
C:\Program Files\Common Files\companion wizard\WapCHK{18A4231C-103E-44BB-B6E1-75744CAC626E}.dll
C:\Program Files\Common Files\companion wizard\WapCHK{1B9A00B4-2D27-4C58-9D5C-1A95FA1EB353}.dll
C:\Program Files\Common Files\companion wizard\WapCHK{1F832E07-8D7F-44E2-979D-6C458BF6EE41}.dll
C:\Program Files\Common Files\companion wizard\WapCHK{2CB5F8C0-67E7-4AEE-9AAE-CD7B241AF5AD}.dll
C:\Program Files\Common Files\companion wizard\WapCHK{343CE377-EF16-4FF5-9484-13F347A76517}.dll
C:\Program Files\Common Files\companion wizard\WapCHK{454CF1FA-3A96-4241-9D90-591A03C99EEB}.dll
C:\Program Files\Common Files\companion wizard\WapCHK{5738C464-1229-4F24-81BA-B0F695A39F8E}.dll
C:\Program Files\Common Files\companion wizard\WapCHK{5A2458C3-C46E-4928-AE8D-C083316581DD}.dll
C:\Program Files\Common Files\companion wizard\WapCHK{7496B626-45DE-4378-AB35-D7FA813BEC5F}.dll
C:\Program Files\Common Files\companion wizard\WapCHK{A77953D5-80D8-4876-B051-42E0A0FB9F5D}.dll
C:\Program Files\Common Files\companion wizard\WapCHK{AA2A2A9F-4FAF-4274-B872-2D7B7E666B04}.dll
C:\Program Files\Common Files\companion wizard\WapCHK{B3E117E1-A445-4439-9EA8-7F0BDADA208E}.dll
C:\Program Files\Common Files\companion wizard\WapCHK{BCA25E4B-316F-4512-8C1F-62D7E4728ADE}.dll
C:\Program Files\Common Files\companion wizard\WapCHK{C4C8177A-0652-4DCA-9796-17316BE0F980}.dll
C:\Program Files\Common Files\companion wizard\WapCHK{C9849BE9-2153-46C1-ABB8-BB946EDC54A7}.dll
C:\Program Files\Common Files\companion wizard\WapCHK{E3C07116-1723-4A2C-A1E9-A3980435EC90}.dll
C:\Program Files\Common Files\companion wizard\WapCHK{EE28D2C4-D114-4BBA-AA9B-99F7AC93D282}.dll
C:\WINDOWS\BM578c6e54.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\service.exe
C:\WINDOWS\system32\avnqbtxe.exe
C:\WINDOWS\system32\awpacwxj.exe
C:\WINDOWS\system32\bidvmcof.ini
C:\WINDOWS\system32\dqqesset.dll
C:\WINDOWS\system32\dsywcqwg.exe
C:\WINDOWS\system32\fvbqklqb.dll
C:\WINDOWS\system32\guard.tmp
C:\WINDOWS\system32\hgGaWNHw.dll
C:\WINDOWS\system32\ijefkmuu.exe
C:\WINDOWS\system32\iwrafwhl.ini
C:\WINDOWS\system32\JiSYyyay.ini
C:\WINDOWS\system32\JiSYyyay.ini2
C:\WINDOWS\system32\jshweuhn.ini
C:\WINDOWS\system32\lalytnow.exe
C:\WINDOWS\system32\lhwfarwi.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nnnKCtUO.dll
C:\WINDOWS\system32\oowegyup.dll
C:\WINDOWS\system32\pmlrjtov.dll
C:\WINDOWS\system32\rmutfkrk.dll
C:\WINDOWS\system32\rnfiwaaa.exe
C:\WINDOWS\system32\stera.log
C:\WINDOWS\system32\tsuninst.exe
C:\WINDOWS\system32\vcmekfsc.dll
C:\WINDOWS\system32\wgqxsmnc.ini
C:\WINDOWS\system32\wHNWaGgh.ini
C:\WINDOWS\system32\wHNWaGgh.ini2
C:\WINDOWS\system32\vsfbbuvc.dll
C:\WINDOWS\system32\vtUOhGvW.dll
C:\WINDOWS\system32\xfsmscfr.ini
C:\WINDOWS\system32\xIlSBJlm.ini
C:\WINDOWS\system32\xIlSBJlm.ini2
C:\WINDOWS\system32\yadyybdn.dll
C:\WINDOWS\system32\ygvorasa.ini
C:\WINDOWS\ups.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_FOPN
((((((((((((((((((((((((( Files Created from 2008-05-08 to 2008-06-08 )))))))))))))))))))))))))))))))
.
2008-06-07 16:24 . 2008-06-07 16:24 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
2008-06-07 16:22 . 2008-06-07 16:22 d-------- C:\Program Files\SUPERAntiSpyware
2008-06-07 16:22 . 2008-06-07 16:22 d-------- C:\Documents and Settings\XXXX.XXXXX-ISLO1C8EI\Application Data\SUPERAntiSpyware.com
2008-06-07 16:21 . 2008-06-07 16:21 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-03 21:33 . 2008-06-04 06:25 3,423 --a------ C:\WINDOWS\is154890.exe
2008-06-02 22:29 . 2008-06-02 22:29 97,116 --a------ C:\WINDOWS\DC5177176.zip
2008-05-22 22:47 . 2008-05-22 22:47 50 --a------ C:\WINDOWS\MegaManager.INI
2008-05-22 20:51 . 2008-05-22 20:51 d-------- C:\Documents and Settings\XXXX.XXXX-ISLO1C8EI\Application Data\MegauploadToolbar
2008-05-14 22:57 . 2008-05-14 22:57 d-------- C:\Program Files\EA GAMES
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 12:22 --------- d-----w C:\Documents and Settings\XXXX.XXXXX-ISLO1C8EI\Application Data\BitTorrent
2008-06-08 12:17 --------- d-----w C:\Documents and Settings\XXX.XXXX-ISLO1C8EI\Application Data\DNA
2008-06-07 20:57 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller
2008-06-01 20:26 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-01 20:19 --------- d-----w C:\Program Files\Yahoo!
2008-05-28 18:48 43,373 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_05_27_19_27_04_small.dmp.zip
2008-05-27 16:18 45,404 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_05_27_19_08_02_small.dmp.zip
2008-05-19 16:46 48,677 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_05_18_14_49_33_small.dmp.zip
2008-04-26 11:12 --------- d-----w C:\Documents and Settings\XXXX.XXXXX-ISLO1C8EI\Application Data\Nokia Multimedia Player
2008-04-26 11:12 --------- d-----w C:\Documents and Settings\XXXX.XXXXX-ISLO1C8EI\Application Data\Nokia
2008-04-22 17:45 --------- d-----w C:\Program Files\WinImage
2008-04-18 08:17 92,160 ----a-w C:\WINDOWS\Internet Logs\xDB3D.tmp
2008-04-16 19:01 --------- d-----w C:\Program Files\BitTorrent
2008-04-16 16:29 --------- d-----w C:\Documents and Settings\XXXX.XXXX-ISLO1C8EI\Application Data\PC Suite
2008-04-13 19:34 --------- d-----w C:\Documents and Settings\XXXX.XXXXX-ISLO1C8EI\Application Data\BitTorrent
2008-04-12 20:08 304,160 ----a-w C:\StiImg.dat
2008-04-12 12:47 --------- d-----w C:\Documents and Settings\XXXXX.XXXXX-ISLO1C8EI\Application Data\Nokia
2008-04-12 12:47 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\PC Suite
2008-04-12 12:46 --------- d-----w C:\Documents and Settings\XXXX.XXXX-ISLO1C8EI\Application Data\PC Suite
2008-04-12 12:41 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-04-12 12:41 --------- d-----w C:\Program Files\Common Files\Nokia
2008-04-12 12:40 --------- d-----w C:\Program Files\DIFX
2008-04-12 12:39 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-04-09 11:38 48,286 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_04_08_12_20_48_small.dmp.zip
2008-03-31 15:06 1,685,504 ----a-w C:\WINDOWS\Internet Logs\xDB3C.tmp
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 19:48 13,391,896 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_03_20_21_30_52_full.dmp.zip
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-15 09:32 46,307 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_03_14_19_02_06_small.dmp.zip
2008-03-08 11:34 48,329 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_03_07_19_41_16_small.dmp.zip
2007-05-26 09:01 20 ---h--w C:\Documents and Settings\All Users.WINDOWS\Application Data\PKP_DLec.DAT
2005-01-08 18:06 17,144 ----a-w C:\Documents and Settings\XXXX\Application Data\GDIPFONTCACHEV1.DAT
2007-06-27 09:56 88 --sh--r C:\WINDOWS\system32\[u]0[/u]3B14C14E1.sys
2007-07-31 15:28 8 --sh--r C:\WINDOWS\system32\E1144CB103.dll
2007-06-27 09:57 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SxBzBufferZoneOverlay]
@={37ADBD0B-11EC-4A2C-9F93-5C3ACC7994DF}
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SxBzConfidentialOverlay]
@={F594B094-8768-4632-8143-12852EBBD688}
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SxBzForbiddenOverlay]
@={F1A1DA12-E651-4AD0-A1A0-6214546B2F9D}
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SxBzUnknownOverlay]
@={E4FC4B31-8A4F-45E6-BDAC-28F612371FE3}
[HKEY_CLASSES_ROOT\CLSID\{37ADBD0B-11EC-4A2C-9F93-5C3ACC7994DF}]
2006-11-09 16:07 1580032 --a------ C:\WINDOWS\system32\rlshellext.dll
[HKEY_CLASSES_ROOT\CLSID\{F594B094-8768-4632-8143-12852EBBD688}]
2006-11-09 16:07 1580032 --a------ C:\WINDOWS\system32\rlshellext.dll
[HKEY_CLASSES_ROOT\CLSID\{F1A1DA12-E651-4AD0-A1A0-6214546B2F9D}]
2006-11-09 16:07 1580032 --a------ C:\WINDOWS\system32\rlshellext.dll
[HKEY_CLASSES_ROOT\CLSID\{E4FC4B31-8A4F-45E6-BDAC-28F612371FE3}]
2006-11-09 16:07 1580032 --a------ C:\WINDOWS\system32\rlshellext.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:56 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 19:24 1694208]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-05-08 23:35 289088]
"BitTorrent"="D:\BitTorrent\BitTorrent.exe" [2008-04-16 22:01 587568]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ADSL_A2"="A2Installed" []
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-03-16 11:34 755480]
"SoundMan"="SOUNDMAN.EXE" [2004-01-08 21:54 65536 C:\WINDOWS\SOUNDMAN.EXE]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 21:16 286720]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"cctray"="C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [2007-08-28 10:54 177416]
"CAVRID"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2007-05-03 14:26 230928]
"BufferZone"="C:\Program Files\BufferZone\CLIENTGUI.exe" [2006-11-09 16:07 3274537]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 16:00 79224]
"PCSuiteTrayApplication"="C:\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360]
"Windows svchost"="ups.exe" [2004-08-04 10:56 18432 C:\WINDOWS\system32\ups.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Nokia PC Suite 6\PcSync2.exe" [ ]
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 13:01:04 83360]
NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2006-09-04 20:53:23 118784]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 10:13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\arsent]
C:\WINDOWS\WINDOW~1\arsent.dll
[HKLM\~\startupfolder\C:^Documents and Settings^XXXXX.XXXXX-ISLO1C8EI^Start Menu^Programs^Startup^ADSL Diagnostic Tools.LNK]
path=C:\Documents and Settings\XXXXX.XXXXX-ISLO1C8EI\Start Menu\Programs\Startup\ADSL Diagnostic Tools.LNK
backup=C:\WINDOWS\pss\ADSL Diagnostic Tools.LNKStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\idx32]
C:\WINDOWS\System32\idx32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\keyboard]
C:\windows\keyboard16.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft (R) Windows Update Manager]
C:\WINDOWS\update\updmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mousepad]
C:\windows\mousepad16.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 19:24 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\newname]
C:\\newname16.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntivirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\eMule0.47a\\eMule0.47a\\emule.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26702:TCP"= 26702:TCP:BitComet 26702 TCP
"26702:UDP"= 26702:UDP:BitComet 26702 UDP
R0 viasraid;viasraid;C:\WINDOWS\system32\DRIVERS\viasraid.sys [2003-06-12 13:31]
R3 PAC207;SoC PC-Camer@;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 12:29]
S2 DP1112;DP1112;C:\WINDOWS\System32\Drivers\DP.sys []
S2 netshare;Windows Network Sharing Service;C:\WINDOWS\share\svchost.exe [2001-08-23 15:00]
S2 UpdateManager;Windows Update Manager;C:\WINDOWS\update\updmgr.exe []
S3 AMGM;ADSL Management and Monitor Interface;C:\WINDOWS\system32\DRIVERS\amgm.sys [2002-01-08 16:24]
S3 itexadsla2;TW-IA300 Service;C:\WINDOWS\system32\DRIVERS\TWIn95a2.sys [2002-01-08 16:24]
.
Contents of the 'Scheduled Tasks' folder
"2008-06-08 12:00:05 C:\WINDOWS\Tasks\AE7E4F049191FFC4.job"
- c:\docume~1\XXXX~1.tan\applic~1\trustj~1\Team way amen.exe
"2008-05-21 15:09:29 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 15:12:03
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\BufferZone\WINBORDER.DLL
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe
C:\WINDOWS\system32\PAStiSvc.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Yahoo!\Messenger\Ymsgr_tray.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
.
**************************************************************************
.
Completion time: 2008-06-08 15:31:20 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-08 12:29:45
Pre-Run: 3,921,006,592 bytes free
Post-Run: 9,332,260,864 bytes free
288 --- E O F --- 2008-05-16 21:58:46
___________________________________________________
No PLÄÄH, saatto jäähä nimii sinne. Kyllästyin jo sensuroimaa niitä. Mut mite tajuut tosta mitään?
ja tuota säästelit
Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
[quote]
File::
C:\WINDOWS\is154890.exe
C:\WINDOWS\DC5177176.zip
[/quote]
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
[img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
**********
Lataa NoLop työpöydällesi yhdestä seuraavista linkeistä...
http://www.spywareedge.net/nolop/NoLop.exe
http://www.spywaretimes.com/Tools/download/21/chk,ed0778d88843ca2625ab6208a197bcc5/
http://www.thespykiller.co.uk/forum/index.php?action=tpmod;dl=item16
1.Sulje kaikki ohjelmat, koska tämä vaihe vaatii uudelleenkäynnistyksen
2.Tuplaklikkaa NoLop.exe ajaaksesi sen
3.Klikkaa nappulaa "Search and Destroy"
4, Kun skannaus on valmis, sinua pyydetään käynnistämään kone uudestaan, jos infektio löytyy. Klikkaa OK
5. Klikkaa "REBOOT"-painiketta.
6. NoLopin pitäisi antaa viesti. Jos ei, tuplaklikkaa ohjelmaa ja se valmistuu. Lähetä C:\NoLop.log-tiedoston sisältö uuden HijackThis-lokin kera.
-- Jos saat seuraavan virheen, "mscomctl.ocx or one of its dependencies are not correctly registered," lataamscomctl.ocx http://www.boletrice.com/downloads/mscomctl.ocx
ja tallenna se system32-hakemistoosi (yleensä c:\Windows\system32). Tämän jälkeen aja ohjelma uudestaan.
MIkä muistio? Log vai? ja mikä ihme quotebox siis häh :S. Selitä silleen ku selittäisit keharille pliis!!
En oo nyt varma lähtetinks tälläsen viestin jo ku tää säätää jotai mut en tajunnu yht mit. voitko selittää ton alun silleen ku selittäisin ööö 5 vuotiaalle :D
alla olevan laitat muistioon
käynnistä nappi > kaikki ohjelmat > apuohjelmat klikaa muistio siten tuo alla olevan kopioit siihen
sitten muistion yläreunasta tiedosto siintä tallenna nimellä > CFScript.txt < sehän oli noiten väkästen välissä oleva siten sen pitää mennä työpöydälle missä se combofix on sitten raahaat sen kuten kuva osoittaa.
http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif
File::
C:\WINDOWS\is154890.exe
C:\WINDOWS\DC5177176.zip
File::
C:\WINDOWS\is154890.exe
C:\WINDOWS\DC5177176.zip
^ pitääks noi lisätä siihe CSFcript notepadin perää vai mitä noi on niiku?
Hei kiitti oikeesti, oot vissiin koht 3 päivää jaksanu jaaritella täs ku en tajuu mitää ;D
Hetkine! tajusin, siis toi sun C:\WINDOWS\is154890.exe
C:\WINDOWS\DC5177176.zip
Toi on siis ainoo teksti mikä pitää lisätä siihen notepadiin!! Nyt mää kätsäsin! Elikkä toi teksti notepadiin, sitten vedetään se Combon päälle, sitte seurataan ohjeita ja käynnistellään konetta ja tullaan takasin pyytään apuja ;D selkis, nyt käyn hommiin.
uudelleen
***********
Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
[quote]
File::
C:\WINDOWS\is154890.exe
C:\WINDOWS\DC5177176.zip
[/quote]
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
[img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
*************
Tuo alla oleva laitetaan tyhjään muistioon
File::
C:\WINDOWS\is154890.exe
C:\WINDOWS\DC5177176.zip
se tallenetaan nimellä CFScript.txt työpöydäälle
siellä se raahataan siihen punaissen palloon missä valkoinan X sisällä
anna sitten sen touhuta mitä touhuaa
sitten kun se on tohunnut sammuta ja käynnistä.
ComboFix 08-06-07.3 - Sini 2008-06-08 23:41:24.3 - NTFSx86
Running from: C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Desktop\CFScript.txt
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2008-05-08 to 2008-06-08 )))))))))))))))))))))))))))))))
.
2008-06-08 15:31 . 2008-06-08 15:31 d-------- C:\Documents and Settings\Jõrjestelmõnvalvoja
2008-06-07 16:24 . 2008-06-07 16:24 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
2008-06-07 16:22 . 2008-06-07 16:22 d-------- C:\Program Files\SUPERAntiSpyware
2008-06-07 16:22 . 2008-06-07 16:22 d-------- C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\SUPERAntiSpyware.com
2008-06-07 16:21 . 2008-06-07 16:21 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-22 22:47 . 2008-05-22 22:47 50 --a------ C:\WINDOWS\MegaManager.INI
2008-05-22 20:51 . 2008-05-22 20:51 d-------- C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\MegauploadToolbar
2008-05-14 22:57 . 2008-05-14 22:57 d-------- C:\Program Files\EA GAMES
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 20:50 --------- d-----w C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\DNA
2008-06-08 19:31 --------- d-----w C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\BitTorrent
2008-06-07 20:57 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller
2008-06-01 20:26 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-01 20:19 --------- d-----w C:\Program Files\Yahoo!
2008-05-28 18:48 43,373 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_05_27_19_27_04_small.dmp.zip
2008-05-27 16:18 45,404 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_05_27_19_08_02_small.dmp.zip
2008-05-19 16:46 48,677 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_05_18_14_49_33_small.dmp.zip
2008-04-26 11:12 --------- d-----w C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\Nokia Multimedia Player
2008-04-26 11:12 --------- d-----w C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\Nokia
2008-04-22 17:45 --------- d-----w C:\Program Files\WinImage
2008-04-18 08:17 92,160 ----a-w C:\WINDOWS\Internet Logs\xDB3D.tmp
2008-04-16 19:01 --------- d-----w C:\Program Files\BitTorrent
2008-04-16 16:29 --------- d-----w C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\PC Suite
2008-04-13 19:34 --------- d-----w C:\Documents and Settings\tanja.TANJA-ISLO1C8EI\Application Data\BitTorrent
2008-04-12 20:08 304,160 ----a-w C:\StiImg.dat
2008-04-12 12:47 --------- d-----w C:\Documents and Settings\tanja.TANJA-ISLO1C8EI\Application Data\Nokia
2008-04-12 12:47 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\PC Suite
2008-04-12 12:46 --------- d-----w C:\Documents and Settings\tanja.TANJA-ISLO1C8EI\Application Data\PC Suite
2008-04-12 12:41 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-04-12 12:41 --------- d-----w C:\Program Files\Common Files\Nokia
2008-04-12 12:40 --------- d-----w C:\Program Files\DIFX
2008-04-12 12:39 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-04-09 11:38 48,286 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_04_08_12_20_48_small.dmp.zip
2008-03-31 15:06 1,685,504 ----a-w C:\WINDOWS\Internet Logs\xDB3C.tmp
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 19:48 13,391,896 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_03_20_21_30_52_full.dmp.zip
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-15 09:32 46,307 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_03_14_19_02_06_small.dmp.zip
2008-03-08 11:34 48,329 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_03_07_19_41_16_small.dmp.zip
2007-05-26 09:01 20 ---h--w C:\Documents and Settings\All Users.WINDOWS\Application Data\PKP_DLec.DAT
2005-01-08 18:06 17,144 ----a-w C:\Documents and Settings\sini\Application Data\GDIPFONTCACHEV1.DAT
2007-06-27 09:56 88 --sh--r C:\WINDOWS\system32\[u]0[/u]3B14C14E1.sys
2007-07-31 15:28 8 --sh--r C:\WINDOWS\system32\E1144CB103.dll
2007-06-27 09:57 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SxBzBufferZoneOverlay]
@={37ADBD0B-11EC-4A2C-9F93-5C3ACC7994DF}
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SxBzConfidentialOverlay]
@={F594B094-8768-4632-8143-12852EBBD688}
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SxBzForbiddenOverlay]
@={F1A1DA12-E651-4AD0-A1A0-6214546B2F9D}
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SxBzUnknownOverlay]
@={E4FC4B31-8A4F-45E6-BDAC-28F612371FE3}
[HKEY_CLASSES_ROOT\CLSID\{37ADBD0B-11EC-4A2C-9F93-5C3ACC7994DF}]
2006-11-09 16:07 1580032 --a------ C:\WINDOWS\system32\rlshellext.dll
[HKEY_CLASSES_ROOT\CLSID\{F594B094-8768-4632-8143-12852EBBD688}]
2006-11-09 16:07 1580032 --a------ C:\WINDOWS\system32\rlshellext.dll
[HKEY_CLASSES_ROOT\CLSID\{F1A1DA12-E651-4AD0-A1A0-6214546B2F9D}]
2006-11-09 16:07 1580032 --a------ C:\WINDOWS\system32\rlshellext.dll
[HKEY_CLASSES_ROOT\CLSID\{E4FC4B31-8A4F-45E6-BDAC-28F612371FE3}]
2006-11-09 16:07 1580032 --a------ C:\WINDOWS\system32\rlshellext.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:56 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 19:24 1694208]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-05-08 23:35 289088]
"BitTorrent"="D:\BitTorrent\BitTorrent.exe" [2008-04-16 22:01 587568]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ADSL_A2"="A2Installed" []
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-03-16 11:34 755480]
"SoundMan"="SOUNDMAN.EXE" [2004-01-08 21:54 65536 C:\WINDOWS\SOUNDMAN.EXE]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 21:16 286720]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"cctray"="C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [2007-08-28 10:54 177416]
"CAVRID"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2007-05-03 14:26 230928]
"BufferZone"="C:\Program Files\BufferZone\CLIENTGUI.exe" [2006-11-09 16:07 3274537]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 16:00 79224]
"PCSuiteTrayApplication"="C:\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360]
"Windows svchost"="ups.exe" [2004-08-04 10:56 18432 C:\WINDOWS\system32\ups.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Nokia PC Suite 6\PcSync2.exe" [ ]
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 13:01:04 83360]
NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2006-09-04 20:53:23 118784]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 10:13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\arsent]
C:\WINDOWS\WINDOW~1\arsent.dll
[HKLM\~\startupfolder\C:^Documents and Settings^tanja.TANJA-ISLO1C8EI^Start Menu^Programs^Startup^ADSL Diagnostic Tools.LNK]
path=C:\Documents and Settings\tanja.TANJA-ISLO1C8EI\Start Menu\Programs\Startup\ADSL Diagnostic Tools.LNK
backup=C:\WINDOWS\pss\ADSL Diagnostic Tools.LNKStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\idx32]
C:\WINDOWS\System32\idx32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\keyboard]
C:\windows\keyboard16.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft (R) Windows Update Manager]
C:\WINDOWS\update\updmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mousepad]
C:\windows\mousepad16.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 19:24 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\newname]
C:\\newname16.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntivirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\eMule0.47a\\eMule0.47a\\emule.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26702:TCP"= 26702:TCP:BitComet 26702 TCP
"26702:UDP"= 26702:UDP:BitComet 26702 UDP
R0 viasraid;viasraid;C:\WINDOWS\system32\DRIVERS\viasraid.sys [2003-06-12 13:31]
R3 PAC207;SoC PC-Camer@;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 12:29]
S2 DP1112;DP1112;C:\WINDOWS\System32\Drivers\DP.sys []
S2 netshare;Windows Network Sharing Service;C:\WINDOWS\share\svchost.exe [2001-08-23 15:00]
S2 UpdateManager;Windows Update Manager;C:\WINDOWS\update\updmgr.exe []
S3 AMGM;ADSL Management and Monitor Interface;C:\WINDOWS\system32\DRIVERS\amgm.sys [2002-01-08 16:24]
S3 itexadsla2;TW-IA300 Service;C:\WINDOWS\system32\DRIVERS\TWIn95a2.sys [2002-01-08 16:24]
.
Contents of the 'Scheduled Tasks' folder
"2008-06-08 21:00:06 C:\WINDOWS\Tasks\AE7E4F049191FFC4.job"
- c:\docume~1\tanja~1.tan\applic~1\trustj~1\Team way amen.exe
"2008-05-21 15:09:29 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 23:53:48
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\BufferZone\WINBORDER.DLL
.
Completion time: 2008-06-09 0:09:09
ComboFix-quarantined-files.txt 2008-06-08 21:07:44
ComboFix2.txt 2008-06-08 19:15:50
ComboFix3.txt 2008-06-08 12:31:25
Pre-Run: 9,252,122,624 bytes free
Post-Run: 9,238,929,408 bytes free
178 --- E O F --- 2008-05-16 21:58:46
______________________________________________
Noo nyt en jaksanu enää sensuroija noit nimii, olkoot ;D Toi oli lyhentyny eli se oli tehny sille jotai?
Lataa NoLop työpöydällesi yhdestä seuraavista linkeistä...
http://www.spywareedge.net/nolop/NoLop.exe
http://www.spywaretimes.com/Tools/download/21/chk,ed0778d88843ca2625ab6208a197bcc5/
http://www.thespykiller.co.uk/forum/index.php?action=tpmod;dl=item16
1.Sulje kaikki ohjelmat, koska tämä vaihe vaatii uudelleenkäynnistyksen
2.Tuplaklikkaa NoLop.exe ajaaksesi sen
3.Klikkaa nappulaa "Search and Destroy"
4, Kun skannaus on valmis, sinua pyydetään käynnistämään kone uudestaan, jos infektio löytyy. Klikkaa OK
5. Klikkaa "REBOOT"-painiketta.
6. NoLopin pitäisi antaa viesti. Jos ei, tuplaklikkaa ohjelmaa ja se valmistuu. Lähetä C:\NoLop.log-tiedoston sisältö uuden HijackThis-lokin kera.
-- Jos saat seuraavan virheen, "mscomctl.ocx or one of its dependencies are not correctly registered," lataamscomctl.ocx http://www.boletrice.com/downloads/mscomctl.ocx
ja tallenna se system32-hakemistoosi (yleensä c:\Windows\system32). Tämän jälkeen aja ohjelma uudestaan.
Lataa NoLop työpöydällesi yhdestä seuraavista linkeistä...
http://www.spywareedge.net/nolop/NoLop.exe
http://www.spywaretimes.com/Tools/download/21/chk,ed077 8d88843ca2625ab6208a197bcc5/
http://www.thespykiller.co.uk/forum/index.php?action=tp mod;dl=item16
^ Elikkä pääsin nyt tohon vaiheeseen ;D painoin tota ekaa linkkiä ja se kuvake tuli työpöydälle ja klikkasin ja se rupes siinä asentelee kunnes se sano: The feature you are trying to use is a CD-ROM or other removable disk that is not avaible.
Insert the microsoft office XP Professional with frotpage disk and click OK
Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
[quote]
File::
C:\WINDOWS\Tasks\AE7E4F049191FFC4.job
[/quote]
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
[img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
ComboFix 08-06-07.3 - Sini 2008-06-09 1:00:42.4 - NTFSx86
Running from: C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Desktop\CFScript.txt
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2008-05-08 to 2008-06-08 )))))))))))))))))))))))))))))))
.
2008-06-09 00:36 . 2008-06-09 00:39 d-------- C:\NoLopBackups
2008-06-08 15:31 . 2008-06-08 15:31 d-------- C:\Documents and Settings\Jõrjestelmõnvalvoja
2008-06-07 16:24 . 2008-06-07 16:24 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
2008-06-07 16:22 . 2008-06-07 16:22 d-------- C:\Program Files\SUPERAntiSpyware
2008-06-07 16:22 . 2008-06-07 16:22 d-------- C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\SUPERAntiSpyware.com
2008-06-07 16:21 . 2008-06-07 16:21 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-22 22:47 . 2008-05-22 22:47 50 --a------ C:\WINDOWS\MegaManager.INI
2008-05-22 20:51 . 2008-05-22 20:51 d-------- C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\MegauploadToolbar
2008-05-14 22:57 . 2008-05-14 22:57 d-------- C:\Program Files\EA GAMES
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 22:07 --------- d-----w C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\DNA
2008-06-08 21:50 --------- d-----w C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\BitTorrent
2008-06-07 20:57 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller
2008-06-01 20:26 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-01 20:19 --------- d-----w C:\Program Files\Yahoo!
2008-05-28 18:48 43,373 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_05_27_19_27_04_small.dmp.zip
2008-05-27 16:18 45,404 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_05_27_19_08_02_small.dmp.zip
2008-05-19 16:46 48,677 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_05_18_14_49_33_small.dmp.zip
2008-04-26 11:12 --------- d-----w C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\Nokia Multimedia Player
2008-04-26 11:12 --------- d-----w C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\Nokia
2008-04-22 17:45 --------- d-----w C:\Program Files\WinImage
2008-04-18 08:17 92,160 ----a-w C:\WINDOWS\Internet Logs\xDB3D.tmp
2008-04-16 19:01 --------- d-----w C:\Program Files\BitTorrent
2008-04-16 16:29 --------- d-----w C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\PC Suite
2008-04-13 19:34 --------- d-----w C:\Documents and Settings\tanja.TANJA-ISLO1C8EI\Application Data\BitTorrent
2008-04-12 20:08 304,160 ----a-w C:\StiImg.dat
2008-04-12 12:47 --------- d-----w C:\Documents and Settings\tanja.TANJA-ISLO1C8EI\Application Data\Nokia
2008-04-12 12:47 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\PC Suite
2008-04-12 12:46 --------- d-----w C:\Documents and Settings\tanja.TANJA-ISLO1C8EI\Application Data\PC Suite
2008-04-12 12:41 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-04-12 12:41 --------- d-----w C:\Program Files\Common Files\Nokia
2008-04-12 12:40 --------- d-----w C:\Program Files\DIFX
2008-04-12 12:39 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-04-09 11:38 48,286 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_04_08_12_20_48_small.dmp.zip
2008-03-31 15:06 1,685,504 ----a-w C:\WINDOWS\Internet Logs\xDB3C.tmp
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 19:48 13,391,896 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_03_20_21_30_52_full.dmp.zip
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-15 09:32 46,307 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_03_14_19_02_06_small.dmp.zip
2008-03-08 11:34 48,329 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_03_07_19_41_16_small.dmp.zip
2007-05-26 09:01 20 ---h--w C:\Documents and Settings\All Users.WINDOWS\Application Data\PKP_DLec.DAT
2005-01-08 18:06 17,144 ----a-w C:\Documents and Settings\sini\Application Data\GDIPFONTCACHEV1.DAT
2007-06-27 09:56 88 --sh--r C:\WINDOWS\system32\[u]0[/u]3B14C14E1.sys
2007-07-31 15:28 8 --sh--r C:\WINDOWS\system32\E1144CB103.dll
2007-06-27 09:57 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((( snapshot@2008-06-08_15.28.42.45 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-08 12:02:20 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-08 21:39:40 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-08 21:40:13 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_260.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SxBzBufferZoneOverlay]
@={37ADBD0B-11EC-4A2C-9F93-5C3ACC7994DF}
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SxBzConfidentialOverlay]
@={F594B094-8768-4632-8143-12852EBBD688}
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SxBzForbiddenOverlay]
@={F1A1DA12-E651-4AD0-A1A0-6214546B2F9D}
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SxBzUnknownOverlay]
@={E4FC4B31-8A4F-45E6-BDAC-28F612371FE3}
[HKEY_CLASSES_ROOT\CLSID\{37ADBD0B-11EC-4A2C-9F93-5C3ACC7994DF}]
2006-11-09 16:07 1580032 --a------ C:\WINDOWS\system32\rlshellext.dll
[HKEY_CLASSES_ROOT\CLSID\{F594B094-8768-4632-8143-12852EBBD688}]
2006-11-09 16:07 1580032 --a------ C:\WINDOWS\system32\rlshellext.dll
[HKEY_CLASSES_ROOT\CLSID\{F1A1DA12-E651-4AD0-A1A0-6214546B2F9D}]
2006-11-09 16:07 1580032 --a------ C:\WINDOWS\system32\rlshellext.dll
[HKEY_CLASSES_ROOT\CLSID\{E4FC4B31-8A4F-45E6-BDAC-28F612371FE3}]
2006-11-09 16:07 1580032 --a------ C:\WINDOWS\system32\rlshellext.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:56 15360]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-05-08 23:35 289088]
"BitTorrent"="D:\BitTorrent\BitTorrent.exe" [2008-04-16 22:01 587568]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ADSL_A2"="A2Installed" []
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-03-16 11:34 755480]
"SoundMan"="SOUNDMAN.EXE" [2004-01-08 21:54 65536 C:\WINDOWS\SOUNDMAN.EXE]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 21:16 286720]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"cctray"="C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [2007-08-28 10:54 177416]
"CAVRID"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2007-05-03 14:26 230928]
"BufferZone"="C:\Program Files\BufferZone\CLIENTGUI.exe" [2006-11-09 16:07 3274537]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 16:00 79224]
"PCSuiteTrayApplication"="C:\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360]
"Windows svchost"="ups.exe" [2004-08-04 10:56 18432 C:\WINDOWS\system32\ups.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Nokia PC Suite 6\PcSync2.exe" [ ]
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 13:01:04 83360]
NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2006-09-04 20:53:23 118784]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 10:13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\arsent]
C:\WINDOWS\WINDOW~1\arsent.dll
[HKLM\~\startupfolder\C:^Documents and Settings^tanja.TANJA-ISLO1C8EI^Start Menu^Programs^Startup^ADSL Diagnostic Tools.LNK]
path=C:\Documents and Settings\tanja.TANJA-ISLO1C8EI\Start Menu\Programs\Startup\ADSL Diagnostic Tools.LNK
backup=C:\WINDOWS\pss\ADSL Diagnostic Tools.LNKStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\idx32]
C:\WINDOWS\System32\idx32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\keyboard]
C:\windows\keyboard16.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft (R) Windows Update Manager]
C:\WINDOWS\update\updmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mousepad]
C:\windows\mousepad16.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 19:24 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\newname]
C:\\newname16.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntivirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\eMule0.47a\\eMule0.47a\\emule.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26702:TCP"= 26702:TCP:BitComet 26702 TCP
"26702:UDP"= 26702:UDP:BitComet 26702 UDP
R0 viasraid;viasraid;C:\WINDOWS\system32\DRIVERS\viasraid.sys [2003-06-12 13:31]
R3 PAC207;SoC PC-Camer@;C:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-02-24 12:29]
S2 DP1112;DP1112;C:\WINDOWS\System32\Drivers\DP.sys []
S2 netshare;Windows Network Sharing Service;C:\WINDOWS\share\svchost.exe [2001-08-23 15:00]
S2 UpdateManager;Windows Update Manager;C:\WINDOWS\update\updmgr.exe []
S3 AMGM;ADSL Management and Monitor Interface;C:\WINDOWS\system32\DRIVERS\amgm.sys [2002-01-08 16:24]
S3 itexadsla2;TW-IA300 Service;C:\WINDOWS\system32\DRIVERS\TWIn95a2.sys [2002-01-08 16:24]
*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-05-21 15:09:29 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-09 01:11:35
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\BufferZone\WINBORDER.DLL
.
Completion time: 2008-06-09 1:26:33
ComboFix-quarantined-files.txt 2008-06-08 22:25:44
ComboFix2.txt 2008-06-08 21:09:16
ComboFix3.txt 2008-06-08 19:15:50
ComboFix4.txt 2008-06-08 12:31:25
Pre-Run: 9,218,531,328 bytes free
Post-Run: 9,204,068,352 bytes free
183 --- E O F --- 2008-05-16 21:58:46
lups lops
Lataa Malwarebytes' Anti-Malware työpöydällesi.
http://www.besttechie.net/tools/mbam-setup.exe
• Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
• Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes' Anti-Malware ja Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaa Finish.
• Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
• Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
• Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
• Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
• Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
• Lähetä lokin sisältö seuraavassa viestissäsi.
Malwarebytes' Anti-Malware 1.15
Tietokantaversio: 842
18:38:28 9.6.2008
mbam-log-6-9-2008 (18-38-28).txt
Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
Tarkistetut kohteet: 138066
Kulunut aika: 1 hour(s), 10 minute(s), 25 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 43
Saastuneita rekisteriarvoja: 1
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 13
Saastuneita tiedostoja: 187
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
HKEY_CLASSES_ROOT\CLSID\{e282c728-189d-419e-8ee2-1601f4b39ba5} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{168dc258-1455-4e61-8590-9dac2f27b675} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1a8642f1-dc80-4edc-a39d-0fb62a58b455} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3f91eb90-ef62-44ee-a685-fac29af111cd} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5c29c7e4-5321-4cad-be2e-877666bed5df} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{83dfb6ee-ab18-41b5-86d4-b544a141d67e} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{88d6cf0e-cf70-4c24-bf6e-e4e414bc649c} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8f6a82a2-d7b1-443e-bb9f-f7dc887dd618} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9856e2d8-ffb2-4fe5-8cad-d5ad6a35a804} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a3d06987-c35e-49e4-8fe2-ac67b9fbfb4c} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a58c497b-3ee2-45e7-9594-daca6be2a0d0} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ad0a3058-fd49-4f98-a514-fd055201835e} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ad5915ea-b61a-4dba-b5c8-ef4b2df0a3c7} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{af2e62b6-f9e1-4d4f-a10a-9dc8e6dcbcc0} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bb187c0d-6f53-4f3e-9590-98fd3a7364a2} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c5041fd9-4819-4dc4-b20e-c950b5b03d2a} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d17726cc-d4dd-4c4a-9671-471d56e413b5} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{db8cce99-59c6-4552-8bfc-058feb38d6ce} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{dc3a04ee-cdd7-4407-915c-a5502f97eecd} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e1a63484-a022-4d42-830a-fbd411514440} (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\videoegg.activexloader (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\videoegg.activexloader.1 (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{f9fa603d-697c-4900-a950-e54f08324a24} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\videoegg (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videoegg.com/Publisher,version=1.5 (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\MozillaPlugins\@videoegg.com/Publisher,version=1.5 (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\nmwegbsf.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
Saastuneita rekisteriarvoja:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows svchost (Backdoor.Bot) -> Quarantined and deleted successfully.
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg (Adware.VideoEgg) -> Delete on reboot.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Data (Adware.VideoEgg) -> Delete on reboot.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Loader (Adware.VideoEgg) -> Delete on reboot.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher (Adware.VideoEgg) -> Delete on reboot.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Updater (Adware.VideoEgg) -> Delete on reboot.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Loader\4665 (Adware.VideoEgg) -> Delete on reboot.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520 (Adware.VideoEgg) -> Delete on reboot.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4665 (Adware.VideoEgg) -> Delete on reboot.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources (Adware.VideoEgg) -> Delete on reboot.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg (Adware.VideoEgg) -> Delete on reboot.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images (Adware.VideoEgg) -> Delete on reboot.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\messages (Adware.VideoEgg) -> Delete on reboot.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Updater\4665 (Adware.VideoEgg) -> Delete on reboot.
Saastuneita tiedostoja:
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Loader\4665\npvideoegg-loader.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Updater\updater.exe (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Updater\VideoEggBroker.exe (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Updater\VideoEggBroker.exe.old (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Desktop\käyttämättömät\VideoEggPublisher.exe (Malware.Tool) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\avnqbtxe.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\awpacwxj.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\dqqesset.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\dsywcqwg.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\hgGaWNHw.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\ijefkmuu.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\lalytnow.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\lhwfarwi.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\nnnKCtUO.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\oowegyup.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\pmlrjtov.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\rnfiwaaa.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\vtUOhGvW.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{432351C5-73A0-41F6-A792-2E31B491D2A2}\RP2\A0000031.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{432351C5-73A0-41F6-A792-2E31B491D2A2}\RP2\A0000032.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{432351C5-73A0-41F6-A792-2E31B491D2A2}\RP2\A0000033.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{432351C5-73A0-41F6-A792-2E31B491D2A2}\RP2\A0000034.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{432351C5-73A0-41F6-A792-2E31B491D2A2}\RP2\A0000036.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{432351C5-73A0-41F6-A792-2E31B491D2A2}\RP2\A0000037.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{432351C5-73A0-41F6-A792-2E31B491D2A2}\RP2\A0000038.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{432351C5-73A0-41F6-A792-2E31B491D2A2}\RP2\A0000039.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{432351C5-73A0-41F6-A792-2E31B491D2A2}\RP2\A0000040.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{432351C5-73A0-41F6-A792-2E31B491D2A2}\RP2\A0000041.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{432351C5-73A0-41F6-A792-2E31B491D2A2}\RP2\A0000043.exe (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{432351C5-73A0-41F6-A792-2E31B491D2A2}\RP2\A0000046.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{432351C5-73A0-41F6-A792-2E31B491D2A2}\RP2\A0000082.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{432351C5-73A0-41F6-A792-2E31B491D2A2}\RP2\A0000111.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F9DD3D7F-35DD-4793-9880-FD328394B6FA}\RP232\A0094179.dll (Adware.Hotbar) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{F9DD3D7F-35DD-4793-9880-FD328394B6FA}\RP232\A0094185.dll (Adware.Hotbar) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\DataLOCKED (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Uninstall.exe (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Data\report.log (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Loader\loader.ver (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\publisher.ver (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\avcodec.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\crashRpt.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\FLVEncoder.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\lame_enc.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\LevelMeter.ax (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\libcurlve.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\libpng.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\npvideoegg-publisher.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\VideoEgg_FLVWriter.ax (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\zlib.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\aol_watermark.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\audio_combo.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\audio_source.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\big_gray_logo.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\big_logo_cropped.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\blank_slide.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\button_browse_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\button_browse_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\button_browse_up.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\camcorders_title.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\camcorder_btn_highlighted.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\camcorder_slide.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\corners_bottom_left.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\corners_bottom_left_curve.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\corners_bottom_right.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\corners_top_right.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\done.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\done_capture.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\done_capture_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\done_capture_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\done_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\done_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\dropshadow_bottom_left.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\dropshadow_horiz.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\dropshadow_vertical.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\dropzone.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\dv_fast_forward.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\dv_pause.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\dv_play.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\dv_rewind.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\dv_stop.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\email_instructions.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\email_sent.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\email_sent_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\email_sent_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\eraser.CUR (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\eraser_cursor.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\file_btn_highlighted.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\file_slide.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\help.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_camcorder.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_camcorders.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_camcorder_dark.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_camcorder_light.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_ff.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_file_dark.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_file_light.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_pause.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_phone_dark.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_phone_light.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_play.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_rewind.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_stop.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_webcam.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_webcams.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_webcam_dark.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\icon_webcam_light.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\loading.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\loading_movie.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\locating.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\logo.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\logo_bottom.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\logo_middle.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\logo_top.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\mobile_btn_highlighted.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\mobile_slide.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\mobile_slide_disabled.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\movie_placeholder.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\ok.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\ok_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\ok_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\player_fast_forward.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\player_fast_forward_disabled.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\player_fill.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\player_pause.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\player_play.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\player_rewind.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\player_rewind_disabled.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\player_rewind_to_start.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\playhead.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\powered_by.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\progress.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\refresh_list_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\refresh_list_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\refresh_list_up.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\restart.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\restart_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\start_capture.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\start_capture_disabled.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\start_capture_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\start_capture_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\start_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\start_over_highlight.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\start_slider.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\stop_capture.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\stop_capture_disabled.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\stop_capture_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\stop_capture_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\stop_slider.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\tab_slide_deselected.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\tape_control.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\text_camcorder.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\text_camcorder_highlight.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\text_file.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\text_file_highlight.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\text_phone.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\text_phone_highlight.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\text_webcam.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\text_webcam_highlight.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\title.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\upload.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\uploading.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\uploading_fill.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\uploading_high.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\uploading_low.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\uploading_medium.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\uploading_thumbnail.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\upload_down.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\upload_from.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\upload_over.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\volume_gray.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\volume_green.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\volume_high.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\volume_low.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\volume_orange.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\volume_red.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\volume_slider.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\waiting_for_email.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\webcams_title.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\webcam_btn_highlighted.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\images\webcam_slide.png (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Publisher\4520\resources\VideoEgg\messages\messages.en-US.bundle (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Updater\updater.ver (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Updater\4665\libcurlve.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\VideoEgg\Updater\4665\updater.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ups.exe (Backdoor.Bot) -> Delete on reboot.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ClickToFindandFixErrors_Intl.ico (Malware.Trace) -> Quarantined and deleted successfully.
mitäs siintä vielä löytyy
hä :S
tällä saadaan
Lataa
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe
HJTInstall.exe
* Tallenna HJTInstall.exe työpöydällesi.
* Tuplaklikkaa HJTInstall.exe -kuvaketta työpöydälläsi.
* Oletuksena se asentaa itsensä hakemistoon C:\Program Files\Trend Micro\HijackThis
* Klikkaa Install
* Asennusohjelma luo HijackThis-kuvakkeen työpöydälle.
* Kun asennus on valmis, se käynnistää HijackThisin
* Klikkaa Do a system scan and save a logfile-painiketta. Ohjelma aloittaa skannauksen ja lokin pitäisi avautua Muistioon.
* Klikkaa ensin "Muokkaa > Valitse kaikki" sitten "Muokkaa > Kopioi" kopioidaksesi koko lokin sisällön.
* Liitä lokin sisältö seuraavaan vastaukseesi.
*ÄLÄ käytä Analyse This-nappulaa, sen löydöt ovat vaarallisia väärinymmärrettyinä.
*ÄLÄ fixaa HijackThis-ohjelmalla vielä mitään. Suurin osa sen löydöistä ovat joko harmittomia tai jopa tarpeellisia.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:53:09, on 9.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\BufferZone\CLIENTGUI.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R3 - URLSearchHook: (no name) - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - (no file)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: (no name) - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - (no file)
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)
O4 - HKLM\..\Run: [ADSL_A2] A2Installed
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [BufferZone] "C:\Program Files\BufferZone\CLIENTGUI.EXE" /STARTUP
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware Reboot] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [BitTorrent] "D:\BitTorrent\BitTorrent.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://locator.cdn.imageservr.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://scan.safety.live.com/resource/download/scanner/wlscbase5059.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1146827168514
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by106fd.bay106.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: arsent - C:\WINDOWS\WINDOW~1\arsent.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Windows Update Manager (UpdateManager) - Unknown owner - C:\WINDOWS\update\updmgr.exe (file missing)
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 10049 bytes
scannaa hjt:llä merkkaa paina Fix checked
R3 - URLSearchHook: (no name) - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: (no name) - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - (no file)
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)
O20 - Winlogon Notify: arsent - C:\WINDOWS\WINDOW~1\arsent.dll (file missing)
===============
Lataa [url=http://www.besttechie.net/tools/mbam-setup.exe][color=red][b]Malwarebytes' Anti-Malware[/b][/color][/url] [b]työpöydällesi[/b].
1. Tuplaklikkaa [b]mbam-setup.exe[/b] ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update [b]Malwarebytes[/b]', [b]Anti-Malware[/b]ja
[b]Launch Malwarebytes[/b]' Anti-Malware ja sen jälkeen klikkaa[b]Finish[/b].
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse [b]Perform full scan[/b] ja klikkaa [b]Scan[/b].
5. Kun skanni on valmis, klikkaa [b]OK[/b] ja sitten [b]Show Results[/b] nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa [b]Remove Selected[/b].
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\[b]log-päiväys.txt[/b]
8. Lähetä lokin sisältö seuraavassa viestissäsi.
R3 - URLSearchHook: (no name) - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O3 - Toolbar: (no name) - {1d1b60fd-b21f-4b9a-8a5f-64e8544828d7} - (no file)
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)
O20 - Winlogon Notify: arsent - C:\WINDOWS\WINDOW~1\arsent.dll (file missing)
^ tota, mitä noi on?
Ton Antimalwaren oon asentanu jo, lues vähän ylöspäi ;)
Sori, tajusin sitteki, eli noi 4 pitää rastittaa tost skannausluettelosta ja sit painaa fix checked
mä meen pullapitkoja vääntään neljällä.
ai että lämmintä pullaa.
Ei tartte tehä mitää muuta enää?
scanna uusi combofix loki
aja se Malwarebytes' Anti-Malware
scannaa uusi hjt:n loki
No perkeles palo pinnat, eilen illalla mese rupes sitten lähettää lisää noita "Sexy :)?" linkkejä, No meni hermot ni sammutin koneen, nyt avasin sen ni tuli työpöydälle sellane musta laatikko taas, ja siinä oli ps.exe tai joku vastaava..... MULLAMENEE HERMOT! meen oikeesti........ ton viruksen tekijän kuha vaan se löytys. se saa niin julman......... et ei mitään rajaa !!
Nyt alan prkl skannaa noit.. ärsyttää jo valmiiks toi skannaus ko kone on viti hidas pas... et rassaa vaan ootella ja ootella.
jooh hidas vai paljos siinä koneessa on sitä keskusmuistia.
Emmää niitä oo klikkaillu enää, näitten 3:n jälkeen, mitkä käskit skannaa jne, menin meseen äsken kun se avautu ittestään käynnistyksessä, siinä se mun mese rupes taas lähettää linkkiä eteenpäin mesekaverille.
.....että mitäs tää juttu nyt hyödyttää mitä teen tässä 3tta päivää?
COMBO
ComboFix 08-06-07.3 - Sini 2008-06-10 17:21:38.5 - NTFSx86
Running from: C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Desktop\CFScript.txt
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
FILE ::
C:\WINDOWS\DC5177176.zip
C:\WINDOWS\is154890.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\geBroMGx.dll
C:\WINDOWS\system32\geBtUmNh.dll
C:\WINDOWS\system32\ljJCuTlK.dll
C:\WINDOWS\system32\mlJbxWmn.dll
C:\WINDOWS\system32\vtUkkHBt.dll
C:\WINDOWS\system32\vtUmNExU.dll
C:\WINDOWS\system32\xGMorBeg.ini
C:\WINDOWS\system32\xGMorBeg.ini2
.
((((((((((((((((((((((((( Files Created from 2008-05-10 to 2008-06-10 )))))))))))))))))))))))))))))))
.
2008-06-10 18:42 . 2008-06-10 18:42 32,768 --a------ C:\WINDOWS\system32\cbXPiJyV.dll
2008-06-10 00:58 . 2008-06-10 00:58 29,342 -r-hs---- C:\WINDOWS\winudmr.exe
2008-06-09 21:51 . 2008-06-09 21:51 d-------- C:\Program Files\Trend Micro
2008-06-09 17:21 . 2008-06-09 17:21 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-09 17:21 . 2008-06-09 17:21 d-------- C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\Malwarebytes
2008-06-09 17:21 . 2008-06-09 17:21 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-06-09 17:21 . 2008-06-05 16:04 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-09 17:21 . 2008-06-05 16:04 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-09 00:36 . 2008-06-09 00:39 d-------- C:\NoLopBackups
2008-06-08 15:31 . 2008-06-08 15:31 d-------- C:\Documents and Settings\Järjestelmänvalvoja
2008-06-08 15:31 . C:\Documents and Settings\Jõrjestelmõnvalvoja\Local Settings
2008-06-07 16:24 . 2008-06-07 16:24 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com
2008-06-07 16:22 . 2008-06-07 16:22 d-------- C:\Program Files\SUPERAntiSpyware
2008-06-07 16:22 . 2008-06-07 16:22 d-------- C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\SUPERAntiSpyware.com
2008-06-07 16:21 . 2008-06-07 16:21 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-22 22:47 . 2008-05-22 22:47 50 --a------ C:\WINDOWS\MegaManager.INI
2008-05-22 20:51 . 2008-05-22 20:51 d-------- C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\MegauploadToolbar
2008-05-14 22:57 . 2008-05-14 22:57 d-------- C:\Program Files\EA GAMES
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-10 15:50 --------- d-----w C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\DNA
2008-06-10 15:42 --------- d-----w C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\BitTorrent
2008-06-07 20:57 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller
2008-06-01 20:26 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-01 20:19 --------- d-----w C:\Program Files\Yahoo!
2008-05-28 18:48 43,373 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_05_27_19_27_04_small.dmp.zip
2008-05-27 16:18 45,404 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_05_27_19_08_02_small.dmp.zip
2008-05-19 16:46 48,677 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_05_18_14_49_33_small.dmp.zip
2008-04-26 11:12 --------- d-----w C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\Nokia Multimedia Player
2008-04-26 11:12 --------- d-----w C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\Nokia
2008-04-22 17:45 --------- d-----w C:\Program Files\WinImage
2008-04-18 08:17 92,160 ----a-w C:\WINDOWS\Internet Logs\xDB3D.tmp
2008-04-16 19:01 --------- d-----w C:\Program Files\BitTorrent
2008-04-16 16:29 --------- d-----w C:\Documents and Settings\Sini.TANJA-ISLO1C8EI\Application Data\PC Suite
2008-04-13 19:34 --------- d-----w C:\Documents and Settings\tanja.TANJA-ISLO1C8EI\Application Data\BitTorrent
2008-04-12 20:08 304,160 ----a-w C:\StiImg.dat
2008-04-12 12:47 --------- d-----w C:\Documents and Settings\tanja.TANJA-ISLO1C8EI\Application Data\Nokia
2008-04-12 12:47 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\PC Suite
2008-04-12 12:46 --------- d-----w C:\Documents and Settings\tanja.TANJA-ISLO1C8EI\Application Data\PC Suite
2008-04-12 12:41 --------- d-----w C:\Program Files\Common Files\PCSuite
2008-04-12 12:41 --------- d-----w C:\Program Files\Common Files\Nokia
2008-04-12 12:40 --------- d-----w C:\Program Files\DIFX
2008-04-12 12:39 --------- d-----w C:\Program Files\PC Connectivity Solution
2008-04-09 11:38 48,286 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_04_08_12_20_48_small.dmp.zip
2008-03-31 15:06 1,685,504 ----a-w C:\WINDOWS\Internet Logs\xDB3C.tmp
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 19:48 13,391,896 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_03_20_21_30_52_full.dmp.zip
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-15 09:32 46,307 ----a-w C:\WINDOWS\Internet Logs\zlclient_2nd_2008_03_14_19_02_06_small.dmp.zip
2007-05-26 09:01 20 ---h--w C:\Documents and Settings\All Users.WINDOWS\Application Data\PKP_DLec.DAT
2005-01-08 18:06 17,144 ----a-w C:\Documents and Settings\sini\Application Data\GDIPFONTCACHEV1.DAT
2007-06-27 09:56 88 --sh--r C:\WINDOWS\system32\[u]0[/u]3B14C14E1.sys
2007-07-31 15:28 8 --sh--r C:\WINDOWS\system32\E1144CB103.dll
2007-06-27 09:57 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((( snapshot@2008-06-08_15.28.42.45 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-08 12:02:20 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-10 14:45:31 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-10 14:11:12 1,950 ----a-w C:\WINDOWS\SoftwareDistribution\EventCache\{DE71EDC0-6FCA-47E9-881E-0A5A39561161}.bin
+ 2004-08-04 07:56:57 18,432 -c--a-w C:\WINDOWS\system32\dllcache\ups.exe
+ 2008-06-10 14:45:53 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_78c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{92a2a84a-04ed-418e-8bae-7dcd55f726cb}]
2008-06-10 19:02 109056 --a------ C:\WINDOWS\system32\jtqcyxtp.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FB6A38B2-EFB1-498C-B7F5-94EAA7EC4663}]
2008-06-10 18:49 349696 --a------ C:\WINDOWS\system32\yayWMFuV.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SxBzBufferZoneOverlay]
@={37ADBD0B-11EC-4A2C-9F93-5C3ACC7994DF}
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SxBzConfidentialOverlay]
@={F594B094-8768-4632-8143-12852EBBD688}
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SxBzForbiddenOverlay]
@={F1A1DA12-E651-4AD0-A1A0-6214546B2F9D}
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SxBzUnknownOverlay]
@={E4FC4B31-8A4F-45E6-BDAC-28F612371FE3}
[HKEY_CLASSES_ROOT\CLSID\{37ADBD0B-11EC-4A2C-9F93-5C3ACC7994DF}]
2006-11-09 16:07 1580032 --a------ C:\WINDOWS\system32\rlshellext.dll
[HKEY_CLASSES_ROOT\CLSID\{F594B094-8768-4632-8143-12852EBBD688}]
2006-11-09 16:07 1580032 --a------ C:\WINDOWS\system32\rlshellext.dll
[HKEY_CLASSES_ROOT\CLSID\{F1A1DA12-E651-4AD0-A1A0-6214546B2F9D}]
2006-11-09 16:07 1580032 --a------ C:\WINDOWS\system32\rlshellext.dll
[HKEY_CLASSES_ROOT\CLSID\{E4FC4B31-8A4F-45E6-BDAC-28F612371FE3}]
2006-11-09 16:07 1580032 --a------ C:\WINDOWS\system32\rlshellext.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:56 15360]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-05-08 23:35 289088]
"BitTorrent"="D:\BitTorrent\BitTorrent.exe" [2008-04-16 22:01 587568]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-05-28 10:33 1506544]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ADSL_A2"="A2Installed" []
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-03-16 11:34 755480]
"SoundMan"="SOUNDMAN.EXE" [2004-01-08 21:54 65536 C:\WINDOWS\SOUNDMAN.EXE]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 21:16 286720]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"cctray"="C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [2007-08-28 10:54 177416]
"CAVRID"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2007-05-03 14:26 230928]
"BufferZone"="C:\Program Files\BufferZone\CLIENTGUI.exe" [2006-11-09 16:07 3274537]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 16:00 79224]
"PCSuiteTrayApplication"="C:\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360]
"Windows Controls Center"="winudmr.exe" [2008-06-10 00:58 29342 C:\WINDOWS\winudmr.exe]
"BM578c6e54"="C:\WINDOWS\system32\aegtabty.dll" [2008-06-10 18:56 100352]
"54bf5dc8"="C:\WINDOWS\system32\rsrmyhhd.dll" [2008-06-10 18:59 92160]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Nokia PC Suite 6\PcSync2.exe" [ ]
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 13:01:04 83360]
NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2006-09-04 20:53:23 118784]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2008-05-13 10:13 77824]
"{03657894-7C44-4EF3-A162-E70D19564373}"= C:\WINDOWS\system32\cbXPiJyV.dll [2008-06-10 18:42 32768]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbXPiJyV]
cbXPiJyV.dll 2008-06-10 18:42 32768 C:\WINDOWS\system32\cbXPiJyV.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\yayWMFuV
[HKLM\~\startupfolder\C:^Documents and Settings^tanja.TANJA-ISLO1C8EI^Start Menu^Programs^Startup^ADSL Diagnostic Tools.LNK]
path=C:\Documents and Settings\tanja.TANJA-ISLO1C8EI\Start Menu\Programs\Startup\ADSL Diagnostic Tools.LNK
backup=C:\WINDOWS\pss\ADSL Diagnostic Tools.LNKStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\idx32]
C:\WINDOWS\System32\idx32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\keyboard]
C:\windows\keyboard16.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft (R) Windows Update Manager]
C:\WINDOWS\update\updmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mousepad]
C:\windows\mousepad16.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 19:24 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\newname]
C:\\newname16.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntivirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\eMule0.47a\\eMule0.47a\\emule.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26702:TCP"= 26702:TCP:BitComet 26702 TCP
"26702:UDP"= 26702:UDP:BitComet 26702 UDP
.
Contents of the 'Scheduled Tasks' folder
"2008-05-21 15:09:29 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-10 18:43:09
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\WINDOWS\system32\VuFMWyay.ini 345 bytes
C:\WINDOWS\system32\cbXPiJyV.dll 32768 bytes executable
C:\WINDOWS\system32\yayWMFuV.dll 349696 bytes executable
scan completed successfully
hidden files: 3
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\cbXPiJyV.dll
PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\rsrmyhhd.dll
-> C:\WINDOWS\system32\aegtabty.dll
-> C:\Program Files\BufferZone\WINBORDER.DLL
-> C:\WINDOWS\system32\yayWMFuV.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe
C:\WINDOWS\system32\PAStiSvc.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-06-10 19:06:40 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-10 16:05:15
ComboFix2.txt 2008-06-08 22:26:40
ComboFix3.txt 2008-06-08 21:09:16
ComboFix4.txt 2008-06-08 19:15:50
ComboFix5.txt 2008-06-08 12:31:25
Pre-Run: 9,235,939,328 bytes free
Post-Run: 9,252,687,872 bytes free
238 --- E O F --- 2008-05-16 21:58:46
________________________________________________
MBAM LOG
Malwarebytes' Anti-Malware 1.15
Tietokantaversio: 842
20:48:18 10.6.2008
mbam-log-6-10-2008 (20-48-03).txt
Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
Tarkistetut kohteet: 137915
Kulunut aika: 1 hour(s), 21 minute(s), 40 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 5
Saastuneita rekisteriavaimia: 6
Saastuneita rekisteriarvoja: 3
Saastuneita rekisterikohteita: 2
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 11
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
C:\WINDOWS\system32\rsrmyhhd.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\yayWMFuV.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\cbXPiJyV.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\urqNhgEt.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\wvUmkiFy.dll (Trojan.Vundo) -> No action taken.
Saastuneita rekisteriavaimia:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fb6a38b2-efb1-498c-b7f5-94eaa7ec4663} (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{fb6a38b2-efb1-498c-b7f5-94eaa7ec4663} (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{f9fa603d-697c-4900-a950-e54f08324a24} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{03657894-7c44-4ef3-a162-e70d19564373} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbxpijyv (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\nmwegbsf.1 (Trojan.FakeAlert) -> No action taken.
Saastuneita rekisteriarvoja:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\54bf5dc8 (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM578c6e54 (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{03657894-7c44-4ef3-a162-e70d19564373} (Trojan.Vundo) -> No action taken.
Saastuneita rekisterikohteita:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\yaywmfuv -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\yaywmfuv -> No action taken.
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
C:\WINDOWS\system32\rsrmyhhd.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\dhhymrsr.ini (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\yayWMFuV.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\VuFMWyay.ini (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\VuFMWyay.ini2 (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{432351C5-73A0-41F6-A792-2E31B491D2A2}\RP8\A0001408.exe (Backdoor.Bot) -> No action taken.
C:\WINDOWS\system32\aegtabty.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\cbXPiJyV.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\urqNhgEt.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\wvUmkiFy.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> No action taken.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:14:25, on 10.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\BufferZone\CLIENTGUI.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\winudmr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: {bc627f55-dcd7-eab8-e814-de40a48a2a29} - {92a2a84a-04ed-418e-8bae-7dcd55f726cb} - C:\WINDOWS\system32\jtqcyxtp.dll
O4 - HKLM\..\Run: [ADSL_A2] A2Installed
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [BufferZone] "C:\Program Files\BufferZone\CLIENTGUI.EXE" /STARTUP
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [BitTorrent] "D:\BitTorrent\BitTorrent.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://locator.cdn.imageservr.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://scan.safety.live.com/resource/download/scanner/wlscbase5059.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1146827168514
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by106fd.bay106.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: urqOIcDv - C:\WINDOWS\SYSTEM32\urqOIcDv.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Windows Update Manager (UpdateManager) - Unknown owner - C:\WINDOWS\update\updmgr.exe (file missing)
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 9748 bytes
älä nyt auvo mitään mese linkejä ja kaverilta tulevia latauksia mesen kautta
********
Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
[quote]
File::
C:\WINDOWS\winudmr.exe
C:\WINDOWS\system32\jtqcyxtp.dll
C:\WINDOWS\SYSTEM32\urqOIcDv.dll
[/quote]
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
[img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
******
scannaa hjt:llä merkkaa paina Fix checked
O2 - BHO: {bc627f55-dcd7-eab8-e814-de40a48a2a29} - {92a2a84a-04ed-418e-8bae-7dcd55f726cb} - C:\WINDOWS\system32\jtqcyxtp.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe
O20 - Winlogon Notify: urqOIcDv - C:\WINDOWS\SYSTEM32\urqOIcDv.dll
=================
Lataa VundoFix.exe
http://www.atribune.org/ccount/click.php?id=4 työpöydällesi.
• Tupla-klikkaa VundoFix.exe ajaaksesi sen.
• Klikkaa Scan for Vundo valintaa.
• Kun skannaus on valmis, klikkaa Fix Vundo valintaa.
• Sinulta kysytään haluatko poistaa filut - klikkaa YES.
• Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
• Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
• Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.
Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:09:03, on 10.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\BufferZone\CLIENTGUI.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ADSL_A2] A2Installed
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [BufferZone] "C:\Program Files\BufferZone\CLIENTGUI.EXE" /STARTUP
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [BitTorrent] "D:\BitTorrent\BitTorrent.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://locator.cdn.imageservr.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://scan.safety.live.com/resource/download/scanner/wlscbase5059.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1146827168514
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by106fd.bay106.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: urqOIcDv - urqOIcDv.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Windows Update Manager (UpdateManager) - Unknown owner - C:\WINDOWS\update\updmgr.exe (file missing)
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 9593 bytes
Vundo skannas, ei löytäny mitään.
Tässä tää uusin Hijack
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:27:56, on 10.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\BufferZone\CLIENTGUI.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ADSL_A2] A2Installed
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [BufferZone] "C:\Program Files\BufferZone\CLIENTGUI.EXE" /STARTUP
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [BitTorrent] "D:\BitTorrent\BitTorrent.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\npjpi160_05.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://locator.cdn.imageservr.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {1754A1BA-A1DF-4F10-B199-AA55AA1A120F} (InstallerBehaviorFactory Class) - https://signup.msn.com/pages/MsnInstC.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://scan.safety.live.com/resource/download/scanner/wlscbase5059.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1146827168514
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9122D757-5A4F-4768-82C5-B4171D8556A7} (PhotoPickConvert Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/PhtPkMSN.cab
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by106fd.bay106.hotmail.msn.com/activex/HMAtchmt.ocx
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Windows Update Manager (UpdateManager) - Unknown owner - C:\WINDOWS\update\updmgr.exe (file missing)
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 9242 bytes
Malwarebytes' Anti-Malware
Malwarebytes' Anti-Malware 1.15
Tietokantaversio: 842
20:08:57 11.6.2008
mbam-log-6-11-2008 (20-08-57).txt
Tarkistustyyppi: Täysi tarkistus (C:\|D:\|)
Tarkistetut kohteet: 138186
Kulunut aika: 1 hour(s), 13 minute(s), 6 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 2
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
HKEY_CLASSES_ROOT\Typelib\{f9fa603d-697c-4900-a950-e54f08324a24} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\nmwegbsf.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)