Voisiko joku tarkistaa HJT-logini :)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:19:08, on 8.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avast!\aswUpdSv.exe
C:\Program Files\Avast!\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Avast!\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Avast!\ashDisp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {B43B8819-720D-4646-9E7E-6CC4929FEAEA} - (no file)
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast!\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Windows svchost] ups.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast!\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast!\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast!\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast!\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
HJT-LOGI
3
280
Vastaukset
- Fix.Fix
kuten alla
Poista lisää poista sovelutuksesta
SweetIM SweetIM- herzendaalen
ComboFix 08-06-07.3 - ??????? 2008-06-08 16:06:04.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.1648 [GMT 3:00]
Running from: C:\Documents and Settings\Vuorijärvi\Työpöytä\ComboFix.exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Vuorijärvi\new.txt
C:\f.exe
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-08 to 2008-06-08 )))))))))))))))))
.
2008-06-08 15:58 . 2008-06-08 15:58 d-------- C:\Documents and Settings\Vuorijõrvi
2008-06-08 13:54 . 2008-06-08 13:54 2,231 --a------ C:\is154890.exe
2008-06-08 01:16 . 2008-06-08 01:16 d-------- C:\Program Files\Trend Micro
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a------ C:\Documents and Settings\Vuorijärvi\sz.exe
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a------ C:\Documents and Settings\Vuorijärvi\sz.exe
2008-06-06 14:58 . 2008-06-06 20:47 49,156 --a------ C:\sz.exe
2008-06-06 14:48 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Vuorijärvi\sex2.exe
2008-06-06 14:48 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Vuorijärvi\sex2.exe
2008-06-06 14:03 . 2008-06-06 14:48 2,232 --a------ C:\sex2.exe
2008-06-06 00:42 . 2008-06-06 00:42 49,156 --a------ C:\sf.exe
2008-06-06 00:38 . 2008-06-06 01:14 49,156 --a------ C:\Documents and Settings\Vuorijärvi\fs.exe
2008-06-06 00:38 . 2008-06-06 01:14 49,156 --a------ C:\Documents and Settings\Vuorijärvi\fs.exe
2008-06-06 00:23 . 2008-06-06 01:01 49,156 --a------ C:\fs.exe
2008-06-06 00:23 . 2008-06-06 00:23 49,156 --a------ C:\fa.exe
2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\Vuorijärvi\f.exe
2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\Vuorijärvi\f.exe
2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\Vuorijärvi\stp.exe
2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\Vuorijärvi\stp.exe
2008-06-04 13:50 . 2008-06-04 13:50 3,423 --a------ C:\WINDOWS\is154890.exe
2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Vuorijärvi\setupa.exe
2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Vuorijärvi\setupa.exe
2008-06-03 01:01 . 2008-06-03 01:01 104,078 --a------ C:\WINDOWS\sb.exe
2008-06-02 22:30 . 2008-06-02 22:30 97,116 --a------ C:\WINDOWS\DC5177176.zip
2008-06-02 21:23 . 2008-06-02 21:23 96,950 -r-hs---- C:\WINDOWS\mservice.exe
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a------ C:\Documents and Settings\Vuorijärvi\setup1.exe
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a------ C:\Documents and Settings\Vuorijärvi\setup1.exe
2008-05-30 16:55 . 2008-06-04 16:03 3,420 --a------ C:\Documents and Settings\Vuorijärvi\setup.exe
2008-05-30 16:55 . 2008-06-04 16:03 3,420 --a------ C:\Documents and Settings\Vuorijärvi\setup.exe
2008-05-30 00:13 . 2008-05-30 00:13 d-------- C:\Documents and Settings\Vuorijärvi\Application Data\vlc
2008-05-29 23:49 . 2008-05-29 23:49 d-------- C:\Program Files\VideoLAN
2008-05-28 22:56 . 2008-05-28 22:56 d-------- C:\WINDOWS\system32\työpöytä
2008-05-28 19:01 . 2008-05-28 19:02 d-------- C:\Documents and Settings\All Users\Application Data\SweetIM
2008-05-28 00:19 . 2008-05-29 15:14 56,832 -r-hs---- C:\WINDOWS\winudspm.exe
2008-05-24 16:36 . 2008-05-24 16:36 d-------- C:\Program Files\Power Tab Software
2008-05-23 14:57 . 2008-05-23 14:57 d-------- C:\Documents and Settings\Vuorijärvi\Application Data\Template
2008-05-23 14:57 . 2008-05-23 14:57 0 --a------ C:\Documents and Settings\Vuorijärvi\Application Data\wklnhst.dat
2008-05-23 14:53 . 2008-05-23 14:56 d-------- C:\Program Files\Microsoft Works
2008-05-22 00:13 . 2008-05-22 00:13 d-------- C:\Program Files\Windows Media Connect 2
2008-05-22 00:13 . 2004-09-15 15:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-05-22 00:12 . 2008-05-22 00:13 d-------- C:\WINDOWS\system32\drivers\UMDF
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 12:55 --------- d-----w C:\Program Files\Steam
2008-06-04 12:00 --------- d-----w C:\Program Files\DC
2008-05-29 21:13 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\vlc
2008-05-28 19:57 --------- d-----w C:\Program Files\Avast!
2008-05-26 13:36 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\mIRC
2008-05-26 13:22 --------- d-----w C:\Program Files\mIRC
2008-05-04 21:20 --------- d-----w C:\Program Files\Guitar Pro 5
2008-05-03 23:07 --------- d-----w C:\Program Files\GameSpy Arcade
2008-05-03 23:05 --------- d-----w C:\Program Files\Atari
2008-04-10 20:40 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\Winamp
2008-04-09 15:08 --------- d-----w C:\Program Files\MTA San Andreas
2008-04-09 15:07 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-04-09 14:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-09 14:51 --------- d-----w C:\Program Files\Rockstar Games
2008-04-06 20:22 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2007-06-13 13:22 290,110 --sh--r C:\WINDOWS\system32\wplayer.exe
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
"Steam"="c:\program files\steam\steam.exe" [2008-03-28 15:54 1271032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"Windows svchost"="ups.exe" [2004-09-15 15:00 18432 C:\WINDOWS\system32\ups.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Steam\\steamapps\\d4rkki\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Steam\\steamapps\\d4rkki\\counter-strike\\hl.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\Steam\\steamapps\\herzzi\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Steam\\steamapps\\herzzi\\day of defeat source\\hl2.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\DC \\DCPlusPlus.exe"=
"C:\\Program Files\\Steam\\steam.exe"=
"C:\\Program Files\\Steam\\steamapps\\softc\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Program Files\\Atari\\Deer Hunter 2005 Demo\\DH2005Demo.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 16:06:44
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-08 16:07:43
ComboFix-quarantined-files.txt 2008-06-08 13:07:12
ComboFix2.txt 2008-06-08 12:58:34
Pre-Run: 35,931,930,624 tavua vapaana
Post-Run: 35,921,760,256 tavua vapaana
127 --- E O F --- 2008-05-22 21:52:07 - FixFix
herzendaalen kirjoitti:
ComboFix 08-06-07.3 - ??????? 2008-06-08 16:06:04.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.1648 [GMT 3:00]
Running from: C:\Documents and Settings\Vuorijärvi\Työpöytä\ComboFix.exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Vuorijärvi\new.txt
C:\f.exe
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-08 to 2008-06-08 )))))))))))))))))
.
2008-06-08 15:58 . 2008-06-08 15:58 d-------- C:\Documents and Settings\Vuorijõrvi
2008-06-08 13:54 . 2008-06-08 13:54 2,231 --a------ C:\is154890.exe
2008-06-08 01:16 . 2008-06-08 01:16 d-------- C:\Program Files\Trend Micro
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a------ C:\Documents and Settings\Vuorijärvi\sz.exe
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a------ C:\Documents and Settings\Vuorijärvi\sz.exe
2008-06-06 14:58 . 2008-06-06 20:47 49,156 --a------ C:\sz.exe
2008-06-06 14:48 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Vuorijärvi\sex2.exe
2008-06-06 14:48 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Vuorijärvi\sex2.exe
2008-06-06 14:03 . 2008-06-06 14:48 2,232 --a------ C:\sex2.exe
2008-06-06 00:42 . 2008-06-06 00:42 49,156 --a------ C:\sf.exe
2008-06-06 00:38 . 2008-06-06 01:14 49,156 --a------ C:\Documents and Settings\Vuorijärvi\fs.exe
2008-06-06 00:38 . 2008-06-06 01:14 49,156 --a------ C:\Documents and Settings\Vuorijärvi\fs.exe
2008-06-06 00:23 . 2008-06-06 01:01 49,156 --a------ C:\fs.exe
2008-06-06 00:23 . 2008-06-06 00:23 49,156 --a------ C:\fa.exe
2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\Vuorijärvi\f.exe
2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\Vuorijärvi\f.exe
2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\Vuorijärvi\stp.exe
2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\Vuorijärvi\stp.exe
2008-06-04 13:50 . 2008-06-04 13:50 3,423 --a------ C:\WINDOWS\is154890.exe
2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Vuorijärvi\setupa.exe
2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Vuorijärvi\setupa.exe
2008-06-03 01:01 . 2008-06-03 01:01 104,078 --a------ C:\WINDOWS\sb.exe
2008-06-02 22:30 . 2008-06-02 22:30 97,116 --a------ C:\WINDOWS\DC5177176.zip
2008-06-02 21:23 . 2008-06-02 21:23 96,950 -r-hs---- C:\WINDOWS\mservice.exe
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a------ C:\Documents and Settings\Vuorijärvi\setup1.exe
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a------ C:\Documents and Settings\Vuorijärvi\setup1.exe
2008-05-30 16:55 . 2008-06-04 16:03 3,420 --a------ C:\Documents and Settings\Vuorijärvi\setup.exe
2008-05-30 16:55 . 2008-06-04 16:03 3,420 --a------ C:\Documents and Settings\Vuorijärvi\setup.exe
2008-05-30 00:13 . 2008-05-30 00:13 d-------- C:\Documents and Settings\Vuorijärvi\Application Data\vlc
2008-05-29 23:49 . 2008-05-29 23:49 d-------- C:\Program Files\VideoLAN
2008-05-28 22:56 . 2008-05-28 22:56 d-------- C:\WINDOWS\system32\työpöytä
2008-05-28 19:01 . 2008-05-28 19:02 d-------- C:\Documents and Settings\All Users\Application Data\SweetIM
2008-05-28 00:19 . 2008-05-29 15:14 56,832 -r-hs---- C:\WINDOWS\winudspm.exe
2008-05-24 16:36 . 2008-05-24 16:36 d-------- C:\Program Files\Power Tab Software
2008-05-23 14:57 . 2008-05-23 14:57 d-------- C:\Documents and Settings\Vuorijärvi\Application Data\Template
2008-05-23 14:57 . 2008-05-23 14:57 0 --a------ C:\Documents and Settings\Vuorijärvi\Application Data\wklnhst.dat
2008-05-23 14:53 . 2008-05-23 14:56 d-------- C:\Program Files\Microsoft Works
2008-05-22 00:13 . 2008-05-22 00:13 d-------- C:\Program Files\Windows Media Connect 2
2008-05-22 00:13 . 2004-09-15 15:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-05-22 00:12 . 2008-05-22 00:13 d-------- C:\WINDOWS\system32\drivers\UMDF
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 12:55 --------- d-----w C:\Program Files\Steam
2008-06-04 12:00 --------- d-----w C:\Program Files\DC
2008-05-29 21:13 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\vlc
2008-05-28 19:57 --------- d-----w C:\Program Files\Avast!
2008-05-26 13:36 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\mIRC
2008-05-26 13:22 --------- d-----w C:\Program Files\mIRC
2008-05-04 21:20 --------- d-----w C:\Program Files\Guitar Pro 5
2008-05-03 23:07 --------- d-----w C:\Program Files\GameSpy Arcade
2008-05-03 23:05 --------- d-----w C:\Program Files\Atari
2008-04-10 20:40 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\Winamp
2008-04-09 15:08 --------- d-----w C:\Program Files\MTA San Andreas
2008-04-09 15:07 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-04-09 14:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-09 14:51 --------- d-----w C:\Program Files\Rockstar Games
2008-04-06 20:22 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2007-06-13 13:22 290,110 --sh--r C:\WINDOWS\system32\wplayer.exe
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
"Steam"="c:\program files\steam\steam.exe" [2008-03-28 15:54 1271032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"Windows svchost"="ups.exe" [2004-09-15 15:00 18432 C:\WINDOWS\system32\ups.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Steam\\steamapps\\d4rkki\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Steam\\steamapps\\d4rkki\\counter-strike\\hl.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\Steam\\steamapps\\herzzi\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Steam\\steamapps\\herzzi\\day of defeat source\\hl2.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\DC \\DCPlusPlus.exe"=
"C:\\Program Files\\Steam\\steam.exe"=
"C:\\Program Files\\Steam\\steamapps\\softc\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Program Files\\Atari\\Deer Hunter 2005 Demo\\DH2005Demo.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 16:06:44
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-08 16:07:43
ComboFix-quarantined-files.txt 2008-06-08 13:07:12
ComboFix2.txt 2008-06-08 12:58:34
Pre-Run: 35,931,930,624 tavua vapaana
Post-Run: 35,921,760,256 tavua vapaana
127 --- E O F --- 2008-05-22 21:52:07Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
[quote]
File::
C:\is154890.exe
C:\Documents and Settings\Vuorijärvi\sz.exe
C:\sz.exe
C:\Documents and Settings\Vuorijärvi\sex2.exe
C:\sex2.exe
C:\sf.exe
C:\Documents and Settings\Vuorijärvi\fs.exe
C:\fs.exe
C:\Documents and Settings\Vuorijärvi\f.exe
C:\WINDOWS\is154890.exe
C:\WINDOWS\DC5177176.zip
C:\WINDOWS\mservice.exe
C:\Documents and Settings\Vuorijärvi\setup1.exe
C:\Documents and Settings\All Users\Application Data\SweetIM
C:\WINDOWS\winudspm.exe
[/quote]
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
[img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
Ketjusta on poistettu 0 sääntöjenvastaista viestiä.
Luetuimmat keskustelut
Milloin viimeksi näit ikäväsi kohteen?
Oliko helppo tunnistaa hänet? Millaisia tunteita tuo näkeminen herätti sinussa?721394En tiedä..
Yhtään minkälainen miesmaku sinulla on. itse arvioin sinua moneenkin otteeseen ja joka kerta päädyin samaan lopputulokse1061237- 1131175
Kirjoita nainen meistä jotain tänne
tai minusta, ihan mitä haluat. Niinkin voi kirjoittaa, etteivät muut tunnista, esim. meidän kahdenkeskisistä jutuista. K741099Paras olisi vain unohtaa
Tuleekohan tähän meidän tilanteeseen ikinä mitään selvyyttä. Epätoivo iskee taas, enkä jaksaisi enää odottaa. Kohta lop69967IS viikonloppu 18-19.5.2024.
Laatija Toni Pitkälä on itse laatinut ja kuvittanut 3- arvoista ristikkonsa. Nihkeästi tuntuu löytyvän ensimmäisiä var76772Oliko vähä sometettu taas vai?
Tuli aiva liika nopiaa traktorin perä vastahan. https://www.iltalehti.fi/kotimaa/a/2b3857b3-f2c6-424e-8051-506c7525223a9722Kristityn megahyökkäys idän palstoilla on kauhistuttava
Terroristikristityn megahyökkäys joka puolella on kauhistuttava, hänen viesteissään on järjetön määrä vihaa. Hän on idän374717- 41711
- 53676