Voisiko joku tarkistaa HJT-logini :)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:19:08, on 8.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avast!\aswUpdSv.exe
C:\Program Files\Avast!\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Avast!\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Avast!\ashDisp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {B43B8819-720D-4646-9E7E-6CC4929FEAEA} - (no file)
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast!\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Windows svchost] ups.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast!\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast!\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast!\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast!\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
HJT-LOGI
3
410
Vastaukset
- Fix.Fix
kuten alla
Poista lisää poista sovelutuksesta
SweetIM SweetIM- herzendaalen
ComboFix 08-06-07.3 - ??????? 2008-06-08 16:06:04.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.1648 [GMT 3:00]
Running from: C:\Documents and Settings\Vuorijärvi\Työpöytä\ComboFix.exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Vuorijärvi\new.txt
C:\f.exe
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-08 to 2008-06-08 )))))))))))))))))
.
2008-06-08 15:58 . 2008-06-08 15:58 d-------- C:\Documents and Settings\Vuorijõrvi
2008-06-08 13:54 . 2008-06-08 13:54 2,231 --a------ C:\is154890.exe
2008-06-08 01:16 . 2008-06-08 01:16 d-------- C:\Program Files\Trend Micro
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a------ C:\Documents and Settings\Vuorijärvi\sz.exe
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a------ C:\Documents and Settings\Vuorijärvi\sz.exe
2008-06-06 14:58 . 2008-06-06 20:47 49,156 --a------ C:\sz.exe
2008-06-06 14:48 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Vuorijärvi\sex2.exe
2008-06-06 14:48 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Vuorijärvi\sex2.exe
2008-06-06 14:03 . 2008-06-06 14:48 2,232 --a------ C:\sex2.exe
2008-06-06 00:42 . 2008-06-06 00:42 49,156 --a------ C:\sf.exe
2008-06-06 00:38 . 2008-06-06 01:14 49,156 --a------ C:\Documents and Settings\Vuorijärvi\fs.exe
2008-06-06 00:38 . 2008-06-06 01:14 49,156 --a------ C:\Documents and Settings\Vuorijärvi\fs.exe
2008-06-06 00:23 . 2008-06-06 01:01 49,156 --a------ C:\fs.exe
2008-06-06 00:23 . 2008-06-06 00:23 49,156 --a------ C:\fa.exe
2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\Vuorijärvi\f.exe
2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\Vuorijärvi\f.exe
2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\Vuorijärvi\stp.exe
2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\Vuorijärvi\stp.exe
2008-06-04 13:50 . 2008-06-04 13:50 3,423 --a------ C:\WINDOWS\is154890.exe
2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Vuorijärvi\setupa.exe
2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Vuorijärvi\setupa.exe
2008-06-03 01:01 . 2008-06-03 01:01 104,078 --a------ C:\WINDOWS\sb.exe
2008-06-02 22:30 . 2008-06-02 22:30 97,116 --a------ C:\WINDOWS\DC5177176.zip
2008-06-02 21:23 . 2008-06-02 21:23 96,950 -r-hs---- C:\WINDOWS\mservice.exe
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a------ C:\Documents and Settings\Vuorijärvi\setup1.exe
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a------ C:\Documents and Settings\Vuorijärvi\setup1.exe
2008-05-30 16:55 . 2008-06-04 16:03 3,420 --a------ C:\Documents and Settings\Vuorijärvi\setup.exe
2008-05-30 16:55 . 2008-06-04 16:03 3,420 --a------ C:\Documents and Settings\Vuorijärvi\setup.exe
2008-05-30 00:13 . 2008-05-30 00:13 d-------- C:\Documents and Settings\Vuorijärvi\Application Data\vlc
2008-05-29 23:49 . 2008-05-29 23:49 d-------- C:\Program Files\VideoLAN
2008-05-28 22:56 . 2008-05-28 22:56 d-------- C:\WINDOWS\system32\työpöytä
2008-05-28 19:01 . 2008-05-28 19:02 d-------- C:\Documents and Settings\All Users\Application Data\SweetIM
2008-05-28 00:19 . 2008-05-29 15:14 56,832 -r-hs---- C:\WINDOWS\winudspm.exe
2008-05-24 16:36 . 2008-05-24 16:36 d-------- C:\Program Files\Power Tab Software
2008-05-23 14:57 . 2008-05-23 14:57 d-------- C:\Documents and Settings\Vuorijärvi\Application Data\Template
2008-05-23 14:57 . 2008-05-23 14:57 0 --a------ C:\Documents and Settings\Vuorijärvi\Application Data\wklnhst.dat
2008-05-23 14:53 . 2008-05-23 14:56 d-------- C:\Program Files\Microsoft Works
2008-05-22 00:13 . 2008-05-22 00:13 d-------- C:\Program Files\Windows Media Connect 2
2008-05-22 00:13 . 2004-09-15 15:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-05-22 00:12 . 2008-05-22 00:13 d-------- C:\WINDOWS\system32\drivers\UMDF
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 12:55 --------- d-----w C:\Program Files\Steam
2008-06-04 12:00 --------- d-----w C:\Program Files\DC
2008-05-29 21:13 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\vlc
2008-05-28 19:57 --------- d-----w C:\Program Files\Avast!
2008-05-26 13:36 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\mIRC
2008-05-26 13:22 --------- d-----w C:\Program Files\mIRC
2008-05-04 21:20 --------- d-----w C:\Program Files\Guitar Pro 5
2008-05-03 23:07 --------- d-----w C:\Program Files\GameSpy Arcade
2008-05-03 23:05 --------- d-----w C:\Program Files\Atari
2008-04-10 20:40 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\Winamp
2008-04-09 15:08 --------- d-----w C:\Program Files\MTA San Andreas
2008-04-09 15:07 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-04-09 14:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-09 14:51 --------- d-----w C:\Program Files\Rockstar Games
2008-04-06 20:22 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2007-06-13 13:22 290,110 --sh--r C:\WINDOWS\system32\wplayer.exe
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
"Steam"="c:\program files\steam\steam.exe" [2008-03-28 15:54 1271032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"Windows svchost"="ups.exe" [2004-09-15 15:00 18432 C:\WINDOWS\system32\ups.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Steam\\steamapps\\d4rkki\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Steam\\steamapps\\d4rkki\\counter-strike\\hl.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\Steam\\steamapps\\herzzi\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Steam\\steamapps\\herzzi\\day of defeat source\\hl2.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\DC \\DCPlusPlus.exe"=
"C:\\Program Files\\Steam\\steam.exe"=
"C:\\Program Files\\Steam\\steamapps\\softc\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Program Files\\Atari\\Deer Hunter 2005 Demo\\DH2005Demo.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 16:06:44
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-08 16:07:43
ComboFix-quarantined-files.txt 2008-06-08 13:07:12
ComboFix2.txt 2008-06-08 12:58:34
Pre-Run: 35,931,930,624 tavua vapaana
Post-Run: 35,921,760,256 tavua vapaana
127 --- E O F --- 2008-05-22 21:52:07 - FixFix
herzendaalen kirjoitti:
ComboFix 08-06-07.3 - ??????? 2008-06-08 16:06:04.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.1648 [GMT 3:00]
Running from: C:\Documents and Settings\Vuorijärvi\Työpöytä\ComboFix.exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Vuorijärvi\new.txt
C:\f.exe
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-08 to 2008-06-08 )))))))))))))))))
.
2008-06-08 15:58 . 2008-06-08 15:58 d-------- C:\Documents and Settings\Vuorijõrvi
2008-06-08 13:54 . 2008-06-08 13:54 2,231 --a------ C:\is154890.exe
2008-06-08 01:16 . 2008-06-08 01:16 d-------- C:\Program Files\Trend Micro
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a------ C:\Documents and Settings\Vuorijärvi\sz.exe
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a------ C:\Documents and Settings\Vuorijärvi\sz.exe
2008-06-06 14:58 . 2008-06-06 20:47 49,156 --a------ C:\sz.exe
2008-06-06 14:48 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Vuorijärvi\sex2.exe
2008-06-06 14:48 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Vuorijärvi\sex2.exe
2008-06-06 14:03 . 2008-06-06 14:48 2,232 --a------ C:\sex2.exe
2008-06-06 00:42 . 2008-06-06 00:42 49,156 --a------ C:\sf.exe
2008-06-06 00:38 . 2008-06-06 01:14 49,156 --a------ C:\Documents and Settings\Vuorijärvi\fs.exe
2008-06-06 00:38 . 2008-06-06 01:14 49,156 --a------ C:\Documents and Settings\Vuorijärvi\fs.exe
2008-06-06 00:23 . 2008-06-06 01:01 49,156 --a------ C:\fs.exe
2008-06-06 00:23 . 2008-06-06 00:23 49,156 --a------ C:\fa.exe
2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\Vuorijärvi\f.exe
2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\Vuorijärvi\f.exe
2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\Vuorijärvi\stp.exe
2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\Vuorijärvi\stp.exe
2008-06-04 13:50 . 2008-06-04 13:50 3,423 --a------ C:\WINDOWS\is154890.exe
2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Vuorijärvi\setupa.exe
2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Vuorijärvi\setupa.exe
2008-06-03 01:01 . 2008-06-03 01:01 104,078 --a------ C:\WINDOWS\sb.exe
2008-06-02 22:30 . 2008-06-02 22:30 97,116 --a------ C:\WINDOWS\DC5177176.zip
2008-06-02 21:23 . 2008-06-02 21:23 96,950 -r-hs---- C:\WINDOWS\mservice.exe
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a------ C:\Documents and Settings\Vuorijärvi\setup1.exe
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a------ C:\Documents and Settings\Vuorijärvi\setup1.exe
2008-05-30 16:55 . 2008-06-04 16:03 3,420 --a------ C:\Documents and Settings\Vuorijärvi\setup.exe
2008-05-30 16:55 . 2008-06-04 16:03 3,420 --a------ C:\Documents and Settings\Vuorijärvi\setup.exe
2008-05-30 00:13 . 2008-05-30 00:13 d-------- C:\Documents and Settings\Vuorijärvi\Application Data\vlc
2008-05-29 23:49 . 2008-05-29 23:49 d-------- C:\Program Files\VideoLAN
2008-05-28 22:56 . 2008-05-28 22:56 d-------- C:\WINDOWS\system32\työpöytä
2008-05-28 19:01 . 2008-05-28 19:02 d-------- C:\Documents and Settings\All Users\Application Data\SweetIM
2008-05-28 00:19 . 2008-05-29 15:14 56,832 -r-hs---- C:\WINDOWS\winudspm.exe
2008-05-24 16:36 . 2008-05-24 16:36 d-------- C:\Program Files\Power Tab Software
2008-05-23 14:57 . 2008-05-23 14:57 d-------- C:\Documents and Settings\Vuorijärvi\Application Data\Template
2008-05-23 14:57 . 2008-05-23 14:57 0 --a------ C:\Documents and Settings\Vuorijärvi\Application Data\wklnhst.dat
2008-05-23 14:53 . 2008-05-23 14:56 d-------- C:\Program Files\Microsoft Works
2008-05-22 00:13 . 2008-05-22 00:13 d-------- C:\Program Files\Windows Media Connect 2
2008-05-22 00:13 . 2004-09-15 15:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-05-22 00:12 . 2008-05-22 00:13 d-------- C:\WINDOWS\system32\drivers\UMDF
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 12:55 --------- d-----w C:\Program Files\Steam
2008-06-04 12:00 --------- d-----w C:\Program Files\DC
2008-05-29 21:13 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\vlc
2008-05-28 19:57 --------- d-----w C:\Program Files\Avast!
2008-05-26 13:36 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\mIRC
2008-05-26 13:22 --------- d-----w C:\Program Files\mIRC
2008-05-04 21:20 --------- d-----w C:\Program Files\Guitar Pro 5
2008-05-03 23:07 --------- d-----w C:\Program Files\GameSpy Arcade
2008-05-03 23:05 --------- d-----w C:\Program Files\Atari
2008-04-10 20:40 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\Winamp
2008-04-09 15:08 --------- d-----w C:\Program Files\MTA San Andreas
2008-04-09 15:07 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-04-09 14:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-09 14:51 --------- d-----w C:\Program Files\Rockstar Games
2008-04-06 20:22 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2007-06-13 13:22 290,110 --sh--r C:\WINDOWS\system32\wplayer.exe
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
"Steam"="c:\program files\steam\steam.exe" [2008-03-28 15:54 1271032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"Windows svchost"="ups.exe" [2004-09-15 15:00 18432 C:\WINDOWS\system32\ups.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Steam\\steamapps\\d4rkki\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Steam\\steamapps\\d4rkki\\counter-strike\\hl.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\Steam\\steamapps\\herzzi\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Steam\\steamapps\\herzzi\\day of defeat source\\hl2.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\DC \\DCPlusPlus.exe"=
"C:\\Program Files\\Steam\\steam.exe"=
"C:\\Program Files\\Steam\\steamapps\\softc\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Program Files\\Atari\\Deer Hunter 2005 Demo\\DH2005Demo.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 16:06:44
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-08 16:07:43
ComboFix-quarantined-files.txt 2008-06-08 13:07:12
ComboFix2.txt 2008-06-08 12:58:34
Pre-Run: 35,931,930,624 tavua vapaana
Post-Run: 35,921,760,256 tavua vapaana
127 --- E O F --- 2008-05-22 21:52:07Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
[quote]
File::
C:\is154890.exe
C:\Documents and Settings\Vuorijärvi\sz.exe
C:\sz.exe
C:\Documents and Settings\Vuorijärvi\sex2.exe
C:\sex2.exe
C:\sf.exe
C:\Documents and Settings\Vuorijärvi\fs.exe
C:\fs.exe
C:\Documents and Settings\Vuorijärvi\f.exe
C:\WINDOWS\is154890.exe
C:\WINDOWS\DC5177176.zip
C:\WINDOWS\mservice.exe
C:\Documents and Settings\Vuorijärvi\setup1.exe
C:\Documents and Settings\All Users\Application Data\SweetIM
C:\WINDOWS\winudspm.exe
[/quote]
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
[img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
Ketjusta on poistettu 0 sääntöjenvastaista viestiä.
Luetuimmat keskustelut
Vihamielisyys naisia kohtaan on jo yllättävän suuri ongelma
Esiintyy laajemmassa mittakaavassa, mitä vain tällä palstalla. Mistä tuo ilmiö nyt oikein johtuu, ja saa alkuvoimansa?3631944Odotan sitä hetkeä
kun nähdään taas. Tiedän, että sinäkin odotat. Kun se päivä koittaa, katseesi hakee minua. Ehkä arkailemme toisiamme väh751304Olen melko vakuuttunut
etten tule olemaan koskaan täysin onnellinen ilman sinua. En uskonut, että näin kävisi kenenkään kanssa. Kunnes sain kok831297- 1341167
- 841043
- 90936
- 48853
Postimerkki kirjeeseen ja kortiin maksaa jo 3 euroa!
https://yle.fi/a/74-20229241 Kyllä tämä on järjetön hinta, Posti tuhoaa itsensä tällä hinnalla, täytyyhän Postin "Herro118843- 48790
Sitä saattaa vähän hölmöillä
rakkauspäissään, jos tunteita on enemmän kuin osaa käsitellä. Alkuhölmöilyt on söpöä ja sallittavaa.60746