Voisiko joku tarkistaa HJT-logini :)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:19:08, on 8.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avast!\aswUpdSv.exe
C:\Program Files\Avast!\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Avast!\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Avast!\ashDisp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {B43B8819-720D-4646-9E7E-6CC4929FEAEA} - (no file)
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast!\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Windows svchost] ups.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast!\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast!\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast!\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast!\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
HJT-LOGI
3
370
Vastaukset
- Fix.Fix
kuten alla
Poista lisää poista sovelutuksesta
SweetIM SweetIM- herzendaalen
ComboFix 08-06-07.3 - ??????? 2008-06-08 16:06:04.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.1648 [GMT 3:00]
Running from: C:\Documents and Settings\Vuorijärvi\Työpöytä\ComboFix.exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Vuorijärvi\new.txt
C:\f.exe
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-08 to 2008-06-08 )))))))))))))))))
.
2008-06-08 15:58 . 2008-06-08 15:58 d-------- C:\Documents and Settings\Vuorijõrvi
2008-06-08 13:54 . 2008-06-08 13:54 2,231 --a------ C:\is154890.exe
2008-06-08 01:16 . 2008-06-08 01:16 d-------- C:\Program Files\Trend Micro
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a------ C:\Documents and Settings\Vuorijärvi\sz.exe
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a------ C:\Documents and Settings\Vuorijärvi\sz.exe
2008-06-06 14:58 . 2008-06-06 20:47 49,156 --a------ C:\sz.exe
2008-06-06 14:48 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Vuorijärvi\sex2.exe
2008-06-06 14:48 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Vuorijärvi\sex2.exe
2008-06-06 14:03 . 2008-06-06 14:48 2,232 --a------ C:\sex2.exe
2008-06-06 00:42 . 2008-06-06 00:42 49,156 --a------ C:\sf.exe
2008-06-06 00:38 . 2008-06-06 01:14 49,156 --a------ C:\Documents and Settings\Vuorijärvi\fs.exe
2008-06-06 00:38 . 2008-06-06 01:14 49,156 --a------ C:\Documents and Settings\Vuorijärvi\fs.exe
2008-06-06 00:23 . 2008-06-06 01:01 49,156 --a------ C:\fs.exe
2008-06-06 00:23 . 2008-06-06 00:23 49,156 --a------ C:\fa.exe
2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\Vuorijärvi\f.exe
2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\Vuorijärvi\f.exe
2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\Vuorijärvi\stp.exe
2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\Vuorijärvi\stp.exe
2008-06-04 13:50 . 2008-06-04 13:50 3,423 --a------ C:\WINDOWS\is154890.exe
2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Vuorijärvi\setupa.exe
2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Vuorijärvi\setupa.exe
2008-06-03 01:01 . 2008-06-03 01:01 104,078 --a------ C:\WINDOWS\sb.exe
2008-06-02 22:30 . 2008-06-02 22:30 97,116 --a------ C:\WINDOWS\DC5177176.zip
2008-06-02 21:23 . 2008-06-02 21:23 96,950 -r-hs---- C:\WINDOWS\mservice.exe
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a------ C:\Documents and Settings\Vuorijärvi\setup1.exe
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a------ C:\Documents and Settings\Vuorijärvi\setup1.exe
2008-05-30 16:55 . 2008-06-04 16:03 3,420 --a------ C:\Documents and Settings\Vuorijärvi\setup.exe
2008-05-30 16:55 . 2008-06-04 16:03 3,420 --a------ C:\Documents and Settings\Vuorijärvi\setup.exe
2008-05-30 00:13 . 2008-05-30 00:13 d-------- C:\Documents and Settings\Vuorijärvi\Application Data\vlc
2008-05-29 23:49 . 2008-05-29 23:49 d-------- C:\Program Files\VideoLAN
2008-05-28 22:56 . 2008-05-28 22:56 d-------- C:\WINDOWS\system32\työpöytä
2008-05-28 19:01 . 2008-05-28 19:02 d-------- C:\Documents and Settings\All Users\Application Data\SweetIM
2008-05-28 00:19 . 2008-05-29 15:14 56,832 -r-hs---- C:\WINDOWS\winudspm.exe
2008-05-24 16:36 . 2008-05-24 16:36 d-------- C:\Program Files\Power Tab Software
2008-05-23 14:57 . 2008-05-23 14:57 d-------- C:\Documents and Settings\Vuorijärvi\Application Data\Template
2008-05-23 14:57 . 2008-05-23 14:57 0 --a------ C:\Documents and Settings\Vuorijärvi\Application Data\wklnhst.dat
2008-05-23 14:53 . 2008-05-23 14:56 d-------- C:\Program Files\Microsoft Works
2008-05-22 00:13 . 2008-05-22 00:13 d-------- C:\Program Files\Windows Media Connect 2
2008-05-22 00:13 . 2004-09-15 15:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-05-22 00:12 . 2008-05-22 00:13 d-------- C:\WINDOWS\system32\drivers\UMDF
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 12:55 --------- d-----w C:\Program Files\Steam
2008-06-04 12:00 --------- d-----w C:\Program Files\DC
2008-05-29 21:13 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\vlc
2008-05-28 19:57 --------- d-----w C:\Program Files\Avast!
2008-05-26 13:36 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\mIRC
2008-05-26 13:22 --------- d-----w C:\Program Files\mIRC
2008-05-04 21:20 --------- d-----w C:\Program Files\Guitar Pro 5
2008-05-03 23:07 --------- d-----w C:\Program Files\GameSpy Arcade
2008-05-03 23:05 --------- d-----w C:\Program Files\Atari
2008-04-10 20:40 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\Winamp
2008-04-09 15:08 --------- d-----w C:\Program Files\MTA San Andreas
2008-04-09 15:07 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-04-09 14:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-09 14:51 --------- d-----w C:\Program Files\Rockstar Games
2008-04-06 20:22 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2007-06-13 13:22 290,110 --sh--r C:\WINDOWS\system32\wplayer.exe
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
"Steam"="c:\program files\steam\steam.exe" [2008-03-28 15:54 1271032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"Windows svchost"="ups.exe" [2004-09-15 15:00 18432 C:\WINDOWS\system32\ups.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Steam\\steamapps\\d4rkki\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Steam\\steamapps\\d4rkki\\counter-strike\\hl.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\Steam\\steamapps\\herzzi\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Steam\\steamapps\\herzzi\\day of defeat source\\hl2.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\DC \\DCPlusPlus.exe"=
"C:\\Program Files\\Steam\\steam.exe"=
"C:\\Program Files\\Steam\\steamapps\\softc\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Program Files\\Atari\\Deer Hunter 2005 Demo\\DH2005Demo.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 16:06:44
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-08 16:07:43
ComboFix-quarantined-files.txt 2008-06-08 13:07:12
ComboFix2.txt 2008-06-08 12:58:34
Pre-Run: 35,931,930,624 tavua vapaana
Post-Run: 35,921,760,256 tavua vapaana
127 --- E O F --- 2008-05-22 21:52:07 - FixFix
herzendaalen kirjoitti:
ComboFix 08-06-07.3 - ??????? 2008-06-08 16:06:04.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.1648 [GMT 3:00]
Running from: C:\Documents and Settings\Vuorijärvi\Työpöytä\ComboFix.exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Vuorijärvi\new.txt
C:\f.exe
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-08 to 2008-06-08 )))))))))))))))))
.
2008-06-08 15:58 . 2008-06-08 15:58 d-------- C:\Documents and Settings\Vuorijõrvi
2008-06-08 13:54 . 2008-06-08 13:54 2,231 --a------ C:\is154890.exe
2008-06-08 01:16 . 2008-06-08 01:16 d-------- C:\Program Files\Trend Micro
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a------ C:\Documents and Settings\Vuorijärvi\sz.exe
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a------ C:\Documents and Settings\Vuorijärvi\sz.exe
2008-06-06 14:58 . 2008-06-06 20:47 49,156 --a------ C:\sz.exe
2008-06-06 14:48 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Vuorijärvi\sex2.exe
2008-06-06 14:48 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Vuorijärvi\sex2.exe
2008-06-06 14:03 . 2008-06-06 14:48 2,232 --a------ C:\sex2.exe
2008-06-06 00:42 . 2008-06-06 00:42 49,156 --a------ C:\sf.exe
2008-06-06 00:38 . 2008-06-06 01:14 49,156 --a------ C:\Documents and Settings\Vuorijärvi\fs.exe
2008-06-06 00:38 . 2008-06-06 01:14 49,156 --a------ C:\Documents and Settings\Vuorijärvi\fs.exe
2008-06-06 00:23 . 2008-06-06 01:01 49,156 --a------ C:\fs.exe
2008-06-06 00:23 . 2008-06-06 00:23 49,156 --a------ C:\fa.exe
2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\Vuorijärvi\f.exe
2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\Vuorijärvi\f.exe
2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\Vuorijärvi\stp.exe
2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\Vuorijärvi\stp.exe
2008-06-04 13:50 . 2008-06-04 13:50 3,423 --a------ C:\WINDOWS\is154890.exe
2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Vuorijärvi\setupa.exe
2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Vuorijärvi\setupa.exe
2008-06-03 01:01 . 2008-06-03 01:01 104,078 --a------ C:\WINDOWS\sb.exe
2008-06-02 22:30 . 2008-06-02 22:30 97,116 --a------ C:\WINDOWS\DC5177176.zip
2008-06-02 21:23 . 2008-06-02 21:23 96,950 -r-hs---- C:\WINDOWS\mservice.exe
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a------ C:\Documents and Settings\Vuorijärvi\setup1.exe
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a------ C:\Documents and Settings\Vuorijärvi\setup1.exe
2008-05-30 16:55 . 2008-06-04 16:03 3,420 --a------ C:\Documents and Settings\Vuorijärvi\setup.exe
2008-05-30 16:55 . 2008-06-04 16:03 3,420 --a------ C:\Documents and Settings\Vuorijärvi\setup.exe
2008-05-30 00:13 . 2008-05-30 00:13 d-------- C:\Documents and Settings\Vuorijärvi\Application Data\vlc
2008-05-29 23:49 . 2008-05-29 23:49 d-------- C:\Program Files\VideoLAN
2008-05-28 22:56 . 2008-05-28 22:56 d-------- C:\WINDOWS\system32\työpöytä
2008-05-28 19:01 . 2008-05-28 19:02 d-------- C:\Documents and Settings\All Users\Application Data\SweetIM
2008-05-28 00:19 . 2008-05-29 15:14 56,832 -r-hs---- C:\WINDOWS\winudspm.exe
2008-05-24 16:36 . 2008-05-24 16:36 d-------- C:\Program Files\Power Tab Software
2008-05-23 14:57 . 2008-05-23 14:57 d-------- C:\Documents and Settings\Vuorijärvi\Application Data\Template
2008-05-23 14:57 . 2008-05-23 14:57 0 --a------ C:\Documents and Settings\Vuorijärvi\Application Data\wklnhst.dat
2008-05-23 14:53 . 2008-05-23 14:56 d-------- C:\Program Files\Microsoft Works
2008-05-22 00:13 . 2008-05-22 00:13 d-------- C:\Program Files\Windows Media Connect 2
2008-05-22 00:13 . 2004-09-15 15:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-05-22 00:12 . 2008-05-22 00:13 d-------- C:\WINDOWS\system32\drivers\UMDF
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 12:55 --------- d-----w C:\Program Files\Steam
2008-06-04 12:00 --------- d-----w C:\Program Files\DC
2008-05-29 21:13 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\vlc
2008-05-28 19:57 --------- d-----w C:\Program Files\Avast!
2008-05-26 13:36 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\mIRC
2008-05-26 13:22 --------- d-----w C:\Program Files\mIRC
2008-05-04 21:20 --------- d-----w C:\Program Files\Guitar Pro 5
2008-05-03 23:07 --------- d-----w C:\Program Files\GameSpy Arcade
2008-05-03 23:05 --------- d-----w C:\Program Files\Atari
2008-04-10 20:40 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\Winamp
2008-04-09 15:08 --------- d-----w C:\Program Files\MTA San Andreas
2008-04-09 15:07 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-04-09 14:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-09 14:51 --------- d-----w C:\Program Files\Rockstar Games
2008-04-06 20:22 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2007-06-13 13:22 290,110 --sh--r C:\WINDOWS\system32\wplayer.exe
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
"Steam"="c:\program files\steam\steam.exe" [2008-03-28 15:54 1271032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"Windows svchost"="ups.exe" [2004-09-15 15:00 18432 C:\WINDOWS\system32\ups.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Steam\\steamapps\\d4rkki\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Steam\\steamapps\\d4rkki\\counter-strike\\hl.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\Steam\\steamapps\\herzzi\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Steam\\steamapps\\herzzi\\day of defeat source\\hl2.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\DC \\DCPlusPlus.exe"=
"C:\\Program Files\\Steam\\steam.exe"=
"C:\\Program Files\\Steam\\steamapps\\softc\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Program Files\\Atari\\Deer Hunter 2005 Demo\\DH2005Demo.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 16:06:44
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-08 16:07:43
ComboFix-quarantined-files.txt 2008-06-08 13:07:12
ComboFix2.txt 2008-06-08 12:58:34
Pre-Run: 35,931,930,624 tavua vapaana
Post-Run: 35,921,760,256 tavua vapaana
127 --- E O F --- 2008-05-22 21:52:07Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
[quote]
File::
C:\is154890.exe
C:\Documents and Settings\Vuorijärvi\sz.exe
C:\sz.exe
C:\Documents and Settings\Vuorijärvi\sex2.exe
C:\sex2.exe
C:\sf.exe
C:\Documents and Settings\Vuorijärvi\fs.exe
C:\fs.exe
C:\Documents and Settings\Vuorijärvi\f.exe
C:\WINDOWS\is154890.exe
C:\WINDOWS\DC5177176.zip
C:\WINDOWS\mservice.exe
C:\Documents and Settings\Vuorijärvi\setup1.exe
C:\Documents and Settings\All Users\Application Data\SweetIM
C:\WINDOWS\winudspm.exe
[/quote]
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
[img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
Ketjusta on poistettu 0 sääntöjenvastaista viestiä.
Luetuimmat keskustelut
Trump muka öljyn takia Venezuelaan? Pelkää mustamaalausta
Kertokaapa mistä tuollainen uutisankka on saanut alkunsta? Näyttäkääpä ne alkuperäiset lähteet, minä en löytänyt mitään21618088Kun Arman Alizad puolusti hiihtäjä Vilma Nissilää sanomalla
"älä välitä sekopäistä Vilma", ja kun siitä kerrottiin täällä, niin sekopäinen mukasuvaitsevainen teki siitä valituksen903855Lataus pakkaskelissä
En olisi koskaan ostanut sähköautoa jos olisin tajunnut että ne eivät lataa pakkasissa suurteholatauksella vaan istut tu492245Martinalta vahva viesti
"Suuret unelmat venyttävät sinua, pelottavat vähän ja vievät mukavuusalueen ulkopuolelle. Juuri siellä kasvu tapahtuu. J2861572Miksei Trump ole kiinnostunut Suomen valloittamisesta?
Täällähän on enemmän turvetta kuin Norjalla öljyä. Eikö Ttump ole turvenuija?711533Temutatko ?
Ostatko kiinalaisista verkkokaupoista halpaa tavaraa tai vaatteita ja miksi? Siksi että on kiva ostaa kun halvalla saa?1451463Akateemikko Martti Koskenniemi vertaa Trumpia Putiniin
"-Suomalaisena on syytä olla huolissaan siitä, että Yhdysvallat näin vahvistaa 1800-luvun alkupuolella julistamansa etup1661456Jos mies olet oikeasti...?
Kiinnostunut... Pyydä mut kunnolla treffeille ja laita itsesi likoon. En voi antaa sydäntä jos sinä olet epävarma ja eh1261416Esko Eerikäinen paljastaa järkyttävän muiston lapsuudesta - Isä löytyi alastomana slummista
Esko Eerikäisen tausta on monikulttuurinen, hän muutti vain 10-vuotiaana yksin kotoaan Kolumbiasta isovanhempiensa luo S141334- 811121