Voisiko joku tarkistaa HJT-logini :)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:19:08, on 8.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avast!\aswUpdSv.exe
C:\Program Files\Avast!\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Avast!\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Avast!\ashDisp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {B43B8819-720D-4646-9E7E-6CC4929FEAEA} - (no file)
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast!\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Windows svchost] ups.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast!\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast!\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast!\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast!\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
HJT-LOGI
3
416
Vastaukset 3
- Fix.Fix
kuten alla
Poista lisää poista sovelutuksesta
SweetIM SweetIM- herzendaalen
ComboFix 08-06-07.3 - ??????? 2008-06-08 16:06:04.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.1648 [GMT 3:00]
Running from: C:\Documents and Settings\Vuorijärvi\Työpöytä\ComboFix.exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Vuorijärvi\new.txt
C:\f.exe
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-08 to 2008-06-08 )))))))))))))))))
.
2008-06-08 15:58 . 2008-06-08 15:58 d-------- C:\Documents and Settings\Vuorijõrvi
2008-06-08 13:54 . 2008-06-08 13:54 2,231 --a------ C:\is154890.exe
2008-06-08 01:16 . 2008-06-08 01:16 d-------- C:\Program Files\Trend Micro
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a------ C:\Documents and Settings\Vuorijärvi\sz.exe
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a------ C:\Documents and Settings\Vuorijärvi\sz.exe
2008-06-06 14:58 . 2008-06-06 20:47 49,156 --a------ C:\sz.exe
2008-06-06 14:48 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Vuorijärvi\sex2.exe
2008-06-06 14:48 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Vuorijärvi\sex2.exe
2008-06-06 14:03 . 2008-06-06 14:48 2,232 --a------ C:\sex2.exe
2008-06-06 00:42 . 2008-06-06 00:42 49,156 --a------ C:\sf.exe
2008-06-06 00:38 . 2008-06-06 01:14 49,156 --a------ C:\Documents and Settings\Vuorijärvi\fs.exe
2008-06-06 00:38 . 2008-06-06 01:14 49,156 --a------ C:\Documents and Settings\Vuorijärvi\fs.exe
2008-06-06 00:23 . 2008-06-06 01:01 49,156 --a------ C:\fs.exe
2008-06-06 00:23 . 2008-06-06 00:23 49,156 --a------ C:\fa.exe
2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\Vuorijärvi\f.exe
2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\Vuorijärvi\f.exe
2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\Vuorijärvi\stp.exe
2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\Vuorijärvi\stp.exe
2008-06-04 13:50 . 2008-06-04 13:50 3,423 --a------ C:\WINDOWS\is154890.exe
2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Vuorijärvi\setupa.exe
2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Vuorijärvi\setupa.exe
2008-06-03 01:01 . 2008-06-03 01:01 104,078 --a------ C:\WINDOWS\sb.exe
2008-06-02 22:30 . 2008-06-02 22:30 97,116 --a------ C:\WINDOWS\DC5177176.zip
2008-06-02 21:23 . 2008-06-02 21:23 96,950 -r-hs---- C:\WINDOWS\mservice.exe
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a------ C:\Documents and Settings\Vuorijärvi\setup1.exe
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a------ C:\Documents and Settings\Vuorijärvi\setup1.exe
2008-05-30 16:55 . 2008-06-04 16:03 3,420 --a------ C:\Documents and Settings\Vuorijärvi\setup.exe
2008-05-30 16:55 . 2008-06-04 16:03 3,420 --a------ C:\Documents and Settings\Vuorijärvi\setup.exe
2008-05-30 00:13 . 2008-05-30 00:13 d-------- C:\Documents and Settings\Vuorijärvi\Application Data\vlc
2008-05-29 23:49 . 2008-05-29 23:49 d-------- C:\Program Files\VideoLAN
2008-05-28 22:56 . 2008-05-28 22:56 d-------- C:\WINDOWS\system32\työpöytä
2008-05-28 19:01 . 2008-05-28 19:02 d-------- C:\Documents and Settings\All Users\Application Data\SweetIM
2008-05-28 00:19 . 2008-05-29 15:14 56,832 -r-hs---- C:\WINDOWS\winudspm.exe
2008-05-24 16:36 . 2008-05-24 16:36 d-------- C:\Program Files\Power Tab Software
2008-05-23 14:57 . 2008-05-23 14:57 d-------- C:\Documents and Settings\Vuorijärvi\Application Data\Template
2008-05-23 14:57 . 2008-05-23 14:57 0 --a------ C:\Documents and Settings\Vuorijärvi\Application Data\wklnhst.dat
2008-05-23 14:53 . 2008-05-23 14:56 d-------- C:\Program Files\Microsoft Works
2008-05-22 00:13 . 2008-05-22 00:13 d-------- C:\Program Files\Windows Media Connect 2
2008-05-22 00:13 . 2004-09-15 15:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-05-22 00:12 . 2008-05-22 00:13 d-------- C:\WINDOWS\system32\drivers\UMDF
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 12:55 --------- d-----w C:\Program Files\Steam
2008-06-04 12:00 --------- d-----w C:\Program Files\DC
2008-05-29 21:13 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\vlc
2008-05-28 19:57 --------- d-----w C:\Program Files\Avast!
2008-05-26 13:36 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\mIRC
2008-05-26 13:22 --------- d-----w C:\Program Files\mIRC
2008-05-04 21:20 --------- d-----w C:\Program Files\Guitar Pro 5
2008-05-03 23:07 --------- d-----w C:\Program Files\GameSpy Arcade
2008-05-03 23:05 --------- d-----w C:\Program Files\Atari
2008-04-10 20:40 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\Winamp
2008-04-09 15:08 --------- d-----w C:\Program Files\MTA San Andreas
2008-04-09 15:07 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-04-09 14:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-09 14:51 --------- d-----w C:\Program Files\Rockstar Games
2008-04-06 20:22 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2007-06-13 13:22 290,110 --sh--r C:\WINDOWS\system32\wplayer.exe
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
"Steam"="c:\program files\steam\steam.exe" [2008-03-28 15:54 1271032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"Windows svchost"="ups.exe" [2004-09-15 15:00 18432 C:\WINDOWS\system32\ups.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Steam\\steamapps\\d4rkki\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Steam\\steamapps\\d4rkki\\counter-strike\\hl.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\Steam\\steamapps\\herzzi\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Steam\\steamapps\\herzzi\\day of defeat source\\hl2.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\DC \\DCPlusPlus.exe"=
"C:\\Program Files\\Steam\\steam.exe"=
"C:\\Program Files\\Steam\\steamapps\\softc\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Program Files\\Atari\\Deer Hunter 2005 Demo\\DH2005Demo.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 16:06:44
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-08 16:07:43
ComboFix-quarantined-files.txt 2008-06-08 13:07:12
ComboFix2.txt 2008-06-08 12:58:34
Pre-Run: 35,931,930,624 tavua vapaana
Post-Run: 35,921,760,256 tavua vapaana
127 --- E O F --- 2008-05-22 21:52:07 - FixFix
herzendaalen kirjoitti:
ComboFix 08-06-07.3 - ??????? 2008-06-08 16:06:04.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.1648 [GMT 3:00]
Running from: C:\Documents and Settings\Vuorijärvi\Työpöytä\ComboFix.exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Vuorijärvi\new.txt
C:\f.exe
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-08 to 2008-06-08 )))))))))))))))))
.
2008-06-08 15:58 . 2008-06-08 15:58 d-------- C:\Documents and Settings\Vuorijõrvi
2008-06-08 13:54 . 2008-06-08 13:54 2,231 --a------ C:\is154890.exe
2008-06-08 01:16 . 2008-06-08 01:16 d-------- C:\Program Files\Trend Micro
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a------ C:\Documents and Settings\Vuorijärvi\sz.exe
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a------ C:\Documents and Settings\Vuorijärvi\sz.exe
2008-06-06 14:58 . 2008-06-06 20:47 49,156 --a------ C:\sz.exe
2008-06-06 14:48 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Vuorijärvi\sex2.exe
2008-06-06 14:48 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Vuorijärvi\sex2.exe
2008-06-06 14:03 . 2008-06-06 14:48 2,232 --a------ C:\sex2.exe
2008-06-06 00:42 . 2008-06-06 00:42 49,156 --a------ C:\sf.exe
2008-06-06 00:38 . 2008-06-06 01:14 49,156 --a------ C:\Documents and Settings\Vuorijärvi\fs.exe
2008-06-06 00:38 . 2008-06-06 01:14 49,156 --a------ C:\Documents and Settings\Vuorijärvi\fs.exe
2008-06-06 00:23 . 2008-06-06 01:01 49,156 --a------ C:\fs.exe
2008-06-06 00:23 . 2008-06-06 00:23 49,156 --a------ C:\fa.exe
2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\Vuorijärvi\f.exe
2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\Vuorijärvi\f.exe
2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\Vuorijärvi\stp.exe
2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\Vuorijärvi\stp.exe
2008-06-04 13:50 . 2008-06-04 13:50 3,423 --a------ C:\WINDOWS\is154890.exe
2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Vuorijärvi\setupa.exe
2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Vuorijärvi\setupa.exe
2008-06-03 01:01 . 2008-06-03 01:01 104,078 --a------ C:\WINDOWS\sb.exe
2008-06-02 22:30 . 2008-06-02 22:30 97,116 --a------ C:\WINDOWS\DC5177176.zip
2008-06-02 21:23 . 2008-06-02 21:23 96,950 -r-hs---- C:\WINDOWS\mservice.exe
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a------ C:\Documents and Settings\Vuorijärvi\setup1.exe
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a------ C:\Documents and Settings\Vuorijärvi\setup1.exe
2008-05-30 16:55 . 2008-06-04 16:03 3,420 --a------ C:\Documents and Settings\Vuorijärvi\setup.exe
2008-05-30 16:55 . 2008-06-04 16:03 3,420 --a------ C:\Documents and Settings\Vuorijärvi\setup.exe
2008-05-30 00:13 . 2008-05-30 00:13 d-------- C:\Documents and Settings\Vuorijärvi\Application Data\vlc
2008-05-29 23:49 . 2008-05-29 23:49 d-------- C:\Program Files\VideoLAN
2008-05-28 22:56 . 2008-05-28 22:56 d-------- C:\WINDOWS\system32\työpöytä
2008-05-28 19:01 . 2008-05-28 19:02 d-------- C:\Documents and Settings\All Users\Application Data\SweetIM
2008-05-28 00:19 . 2008-05-29 15:14 56,832 -r-hs---- C:\WINDOWS\winudspm.exe
2008-05-24 16:36 . 2008-05-24 16:36 d-------- C:\Program Files\Power Tab Software
2008-05-23 14:57 . 2008-05-23 14:57 d-------- C:\Documents and Settings\Vuorijärvi\Application Data\Template
2008-05-23 14:57 . 2008-05-23 14:57 0 --a------ C:\Documents and Settings\Vuorijärvi\Application Data\wklnhst.dat
2008-05-23 14:53 . 2008-05-23 14:56 d-------- C:\Program Files\Microsoft Works
2008-05-22 00:13 . 2008-05-22 00:13 d-------- C:\Program Files\Windows Media Connect 2
2008-05-22 00:13 . 2004-09-15 15:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-05-22 00:12 . 2008-05-22 00:13 d-------- C:\WINDOWS\system32\drivers\UMDF
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 12:55 --------- d-----w C:\Program Files\Steam
2008-06-04 12:00 --------- d-----w C:\Program Files\DC
2008-05-29 21:13 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\vlc
2008-05-28 19:57 --------- d-----w C:\Program Files\Avast!
2008-05-26 13:36 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\mIRC
2008-05-26 13:22 --------- d-----w C:\Program Files\mIRC
2008-05-04 21:20 --------- d-----w C:\Program Files\Guitar Pro 5
2008-05-03 23:07 --------- d-----w C:\Program Files\GameSpy Arcade
2008-05-03 23:05 --------- d-----w C:\Program Files\Atari
2008-04-10 20:40 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\Winamp
2008-04-09 15:08 --------- d-----w C:\Program Files\MTA San Andreas
2008-04-09 15:07 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-04-09 14:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-09 14:51 --------- d-----w C:\Program Files\Rockstar Games
2008-04-06 20:22 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2007-06-13 13:22 290,110 --sh--r C:\WINDOWS\system32\wplayer.exe
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
"Steam"="c:\program files\steam\steam.exe" [2008-03-28 15:54 1271032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"Windows svchost"="ups.exe" [2004-09-15 15:00 18432 C:\WINDOWS\system32\ups.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Steam\\steamapps\\d4rkki\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Steam\\steamapps\\d4rkki\\counter-strike\\hl.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\Steam\\steamapps\\herzzi\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Steam\\steamapps\\herzzi\\day of defeat source\\hl2.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\DC \\DCPlusPlus.exe"=
"C:\\Program Files\\Steam\\steam.exe"=
"C:\\Program Files\\Steam\\steamapps\\softc\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Program Files\\Atari\\Deer Hunter 2005 Demo\\DH2005Demo.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 16:06:44
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-08 16:07:43
ComboFix-quarantined-files.txt 2008-06-08 13:07:12
ComboFix2.txt 2008-06-08 12:58:34
Pre-Run: 35,931,930,624 tavua vapaana
Post-Run: 35,921,760,256 tavua vapaana
127 --- E O F --- 2008-05-22 21:52:07Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
[quote]
File::
C:\is154890.exe
C:\Documents and Settings\Vuorijärvi\sz.exe
C:\sz.exe
C:\Documents and Settings\Vuorijärvi\sex2.exe
C:\sex2.exe
C:\sf.exe
C:\Documents and Settings\Vuorijärvi\fs.exe
C:\fs.exe
C:\Documents and Settings\Vuorijärvi\f.exe
C:\WINDOWS\is154890.exe
C:\WINDOWS\DC5177176.zip
C:\WINDOWS\mservice.exe
C:\Documents and Settings\Vuorijärvi\setup1.exe
C:\Documents and Settings\All Users\Application Data\SweetIM
C:\WINDOWS\winudspm.exe
[/quote]
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
[img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
Ketjusta on poistettu 0 sääntöjenvastaista viestiä.
Luetuimmat keskustelut
- 1241325
Hei, voitko kuunnella
Voisitko auttaa minua selvittämään asioita? En halua ajaa sinua hulluuteen kanssani, en sitoa sinua, en esittää vaatimu1411209Joku porukka lähtenyt täältä
Ihmeen hiljainen on palsta nyt. Yleensä tänne tulvii aloituksia yms, mutta nyt on kyllä erikoisen hiljaista.2331111Costa Rica on tympeän makuinen kahvi
Ostin kahvin hinnan romahduksen kunniaksi Costa Rican "Premium Blendiä". Piti olla sataprosenttista arabialaista. No ain611092Se kun olit pitkästä aikaa silmieni edessä
Oli kyllä sykähdyttävää. Tiedätkö, mikä laittaa minut ikävöimään sinua? Kun palautan mieleeni valtavan ihanan olemuksen,57976- 63881
- 83851
- 65667
Onkin niin, että olet hulluna minuun
mutta et uskalla sitä tuoda ilmi. Salaa haaveilet kiihkeästä suhteesta, vaan siihen se jää, ja syyksi esteet ja muut. S30610- 39565
Hämmentävä hetki: TTK:sta pudonnut Johanna Puhakka lataa pettyneenä: "Sitä ei voi kieltää"
Johanna Puhakka ja Jurijs Jurza Trosenko tippuivat Tanssii Tähtien Kanssa -kisasta. Suositussa viihdeohjelmassa nähtiin14530- 32529
Jälleen näin nainen unta sinusta
Aika usein tulet uniini, enkä tiedä, mitä se tahtoo minulle sanoa. Tällä kertaa en ollut kotonasi, vaan ulkona jossain t28519- 32499
- 65488
- 29469
En haluaisi sanoa tätä
Mutta olet sokea sille, mitä sinulla jo on! Jos minä olisin sinä, pyrkisin tekemään kaikkeni kohentaakseni nykyistä pari39465- 51451
- 24437
Olet komea ja kaikkea
En uskonut kuitenkaan miten laajasti olet kaikkien naisten ihannoinnin kohde. Jälleen kerran. Palsta on hiljainen kun o19423