Voisiko joku tarkistaa HJT-logini :)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:19:08, on 8.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Avast!\aswUpdSv.exe
C:\Program Files\Avast!\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Avast!\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Avast!\ashDisp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: SweetIM ToolbarURLSearchHook Class - {EEE6C35D-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {B43B8819-720D-4646-9E7E-6CC4929FEAEA} - (no file)
O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast!\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Windows svchost] ups.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Avast!\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Avast!\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Avast!\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Avast!\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
HJT-LOGI
3
416
Vastaukset 3
- Fix.Fix
kuten alla
Poista lisää poista sovelutuksesta
SweetIM SweetIM- herzendaalen
ComboFix 08-06-07.3 - ??????? 2008-06-08 16:06:04.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.1648 [GMT 3:00]
Running from: C:\Documents and Settings\Vuorijärvi\Työpöytä\ComboFix.exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Vuorijärvi\new.txt
C:\f.exe
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-08 to 2008-06-08 )))))))))))))))))
.
2008-06-08 15:58 . 2008-06-08 15:58 d-------- C:\Documents and Settings\Vuorijõrvi
2008-06-08 13:54 . 2008-06-08 13:54 2,231 --a------ C:\is154890.exe
2008-06-08 01:16 . 2008-06-08 01:16 d-------- C:\Program Files\Trend Micro
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a------ C:\Documents and Settings\Vuorijärvi\sz.exe
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a------ C:\Documents and Settings\Vuorijärvi\sz.exe
2008-06-06 14:58 . 2008-06-06 20:47 49,156 --a------ C:\sz.exe
2008-06-06 14:48 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Vuorijärvi\sex2.exe
2008-06-06 14:48 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Vuorijärvi\sex2.exe
2008-06-06 14:03 . 2008-06-06 14:48 2,232 --a------ C:\sex2.exe
2008-06-06 00:42 . 2008-06-06 00:42 49,156 --a------ C:\sf.exe
2008-06-06 00:38 . 2008-06-06 01:14 49,156 --a------ C:\Documents and Settings\Vuorijärvi\fs.exe
2008-06-06 00:38 . 2008-06-06 01:14 49,156 --a------ C:\Documents and Settings\Vuorijärvi\fs.exe
2008-06-06 00:23 . 2008-06-06 01:01 49,156 --a------ C:\fs.exe
2008-06-06 00:23 . 2008-06-06 00:23 49,156 --a------ C:\fa.exe
2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\Vuorijärvi\f.exe
2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\Vuorijärvi\f.exe
2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\Vuorijärvi\stp.exe
2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\Vuorijärvi\stp.exe
2008-06-04 13:50 . 2008-06-04 13:50 3,423 --a------ C:\WINDOWS\is154890.exe
2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Vuorijärvi\setupa.exe
2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Vuorijärvi\setupa.exe
2008-06-03 01:01 . 2008-06-03 01:01 104,078 --a------ C:\WINDOWS\sb.exe
2008-06-02 22:30 . 2008-06-02 22:30 97,116 --a------ C:\WINDOWS\DC5177176.zip
2008-06-02 21:23 . 2008-06-02 21:23 96,950 -r-hs---- C:\WINDOWS\mservice.exe
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a------ C:\Documents and Settings\Vuorijärvi\setup1.exe
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a------ C:\Documents and Settings\Vuorijärvi\setup1.exe
2008-05-30 16:55 . 2008-06-04 16:03 3,420 --a------ C:\Documents and Settings\Vuorijärvi\setup.exe
2008-05-30 16:55 . 2008-06-04 16:03 3,420 --a------ C:\Documents and Settings\Vuorijärvi\setup.exe
2008-05-30 00:13 . 2008-05-30 00:13 d-------- C:\Documents and Settings\Vuorijärvi\Application Data\vlc
2008-05-29 23:49 . 2008-05-29 23:49 d-------- C:\Program Files\VideoLAN
2008-05-28 22:56 . 2008-05-28 22:56 d-------- C:\WINDOWS\system32\työpöytä
2008-05-28 19:01 . 2008-05-28 19:02 d-------- C:\Documents and Settings\All Users\Application Data\SweetIM
2008-05-28 00:19 . 2008-05-29 15:14 56,832 -r-hs---- C:\WINDOWS\winudspm.exe
2008-05-24 16:36 . 2008-05-24 16:36 d-------- C:\Program Files\Power Tab Software
2008-05-23 14:57 . 2008-05-23 14:57 d-------- C:\Documents and Settings\Vuorijärvi\Application Data\Template
2008-05-23 14:57 . 2008-05-23 14:57 0 --a------ C:\Documents and Settings\Vuorijärvi\Application Data\wklnhst.dat
2008-05-23 14:53 . 2008-05-23 14:56 d-------- C:\Program Files\Microsoft Works
2008-05-22 00:13 . 2008-05-22 00:13 d-------- C:\Program Files\Windows Media Connect 2
2008-05-22 00:13 . 2004-09-15 15:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-05-22 00:12 . 2008-05-22 00:13 d-------- C:\WINDOWS\system32\drivers\UMDF
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 12:55 --------- d-----w C:\Program Files\Steam
2008-06-04 12:00 --------- d-----w C:\Program Files\DC
2008-05-29 21:13 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\vlc
2008-05-28 19:57 --------- d-----w C:\Program Files\Avast!
2008-05-26 13:36 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\mIRC
2008-05-26 13:22 --------- d-----w C:\Program Files\mIRC
2008-05-04 21:20 --------- d-----w C:\Program Files\Guitar Pro 5
2008-05-03 23:07 --------- d-----w C:\Program Files\GameSpy Arcade
2008-05-03 23:05 --------- d-----w C:\Program Files\Atari
2008-04-10 20:40 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\Winamp
2008-04-09 15:08 --------- d-----w C:\Program Files\MTA San Andreas
2008-04-09 15:07 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-04-09 14:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-09 14:51 --------- d-----w C:\Program Files\Rockstar Games
2008-04-06 20:22 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2007-06-13 13:22 290,110 --sh--r C:\WINDOWS\system32\wplayer.exe
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
"Steam"="c:\program files\steam\steam.exe" [2008-03-28 15:54 1271032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"Windows svchost"="ups.exe" [2004-09-15 15:00 18432 C:\WINDOWS\system32\ups.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Steam\\steamapps\\d4rkki\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Steam\\steamapps\\d4rkki\\counter-strike\\hl.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\Steam\\steamapps\\herzzi\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Steam\\steamapps\\herzzi\\day of defeat source\\hl2.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\DC \\DCPlusPlus.exe"=
"C:\\Program Files\\Steam\\steam.exe"=
"C:\\Program Files\\Steam\\steamapps\\softc\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Program Files\\Atari\\Deer Hunter 2005 Demo\\DH2005Demo.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 16:06:44
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-08 16:07:43
ComboFix-quarantined-files.txt 2008-06-08 13:07:12
ComboFix2.txt 2008-06-08 12:58:34
Pre-Run: 35,931,930,624 tavua vapaana
Post-Run: 35,921,760,256 tavua vapaana
127 --- E O F --- 2008-05-22 21:52:07 - FixFix
herzendaalen kirjoitti:
ComboFix 08-06-07.3 - ??????? 2008-06-08 16:06:04.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.1648 [GMT 3:00]
Running from: C:\Documents and Settings\Vuorijärvi\Työpöytä\ComboFix.exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Vuorijärvi\new.txt
C:\f.exe
.
((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-08 to 2008-06-08 )))))))))))))))))
.
2008-06-08 15:58 . 2008-06-08 15:58 d-------- C:\Documents and Settings\Vuorijõrvi
2008-06-08 13:54 . 2008-06-08 13:54 2,231 --a------ C:\is154890.exe
2008-06-08 01:16 . 2008-06-08 01:16 d-------- C:\Program Files\Trend Micro
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a------ C:\Documents and Settings\Vuorijärvi\sz.exe
2008-06-06 15:03 . 2008-06-06 20:39 49,156 --a------ C:\Documents and Settings\Vuorijärvi\sz.exe
2008-06-06 14:58 . 2008-06-06 20:47 49,156 --a------ C:\sz.exe
2008-06-06 14:48 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Vuorijärvi\sex2.exe
2008-06-06 14:48 . 2008-06-06 14:48 2,232 --a------ C:\Documents and Settings\Vuorijärvi\sex2.exe
2008-06-06 14:03 . 2008-06-06 14:48 2,232 --a------ C:\sex2.exe
2008-06-06 00:42 . 2008-06-06 00:42 49,156 --a------ C:\sf.exe
2008-06-06 00:38 . 2008-06-06 01:14 49,156 --a------ C:\Documents and Settings\Vuorijärvi\fs.exe
2008-06-06 00:38 . 2008-06-06 01:14 49,156 --a------ C:\Documents and Settings\Vuorijärvi\fs.exe
2008-06-06 00:23 . 2008-06-06 01:01 49,156 --a------ C:\fs.exe
2008-06-06 00:23 . 2008-06-06 00:23 49,156 --a------ C:\fa.exe
2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\Vuorijärvi\f.exe
2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\Vuorijärvi\f.exe
2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\Vuorijärvi\stp.exe
2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\Vuorijärvi\stp.exe
2008-06-04 13:50 . 2008-06-04 13:50 3,423 --a------ C:\WINDOWS\is154890.exe
2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Vuorijärvi\setupa.exe
2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\Vuorijärvi\setupa.exe
2008-06-03 01:01 . 2008-06-03 01:01 104,078 --a------ C:\WINDOWS\sb.exe
2008-06-02 22:30 . 2008-06-02 22:30 97,116 --a------ C:\WINDOWS\DC5177176.zip
2008-06-02 21:23 . 2008-06-02 21:23 96,950 -r-hs---- C:\WINDOWS\mservice.exe
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a------ C:\Documents and Settings\Vuorijärvi\setup1.exe
2008-05-31 18:53 . 2008-05-31 20:38 86,512 --a------ C:\Documents and Settings\Vuorijärvi\setup1.exe
2008-05-30 16:55 . 2008-06-04 16:03 3,420 --a------ C:\Documents and Settings\Vuorijärvi\setup.exe
2008-05-30 16:55 . 2008-06-04 16:03 3,420 --a------ C:\Documents and Settings\Vuorijärvi\setup.exe
2008-05-30 00:13 . 2008-05-30 00:13 d-------- C:\Documents and Settings\Vuorijärvi\Application Data\vlc
2008-05-29 23:49 . 2008-05-29 23:49 d-------- C:\Program Files\VideoLAN
2008-05-28 22:56 . 2008-05-28 22:56 d-------- C:\WINDOWS\system32\työpöytä
2008-05-28 19:01 . 2008-05-28 19:02 d-------- C:\Documents and Settings\All Users\Application Data\SweetIM
2008-05-28 00:19 . 2008-05-29 15:14 56,832 -r-hs---- C:\WINDOWS\winudspm.exe
2008-05-24 16:36 . 2008-05-24 16:36 d-------- C:\Program Files\Power Tab Software
2008-05-23 14:57 . 2008-05-23 14:57 d-------- C:\Documents and Settings\Vuorijärvi\Application Data\Template
2008-05-23 14:57 . 2008-05-23 14:57 0 --a------ C:\Documents and Settings\Vuorijärvi\Application Data\wklnhst.dat
2008-05-23 14:53 . 2008-05-23 14:56 d-------- C:\Program Files\Microsoft Works
2008-05-22 00:13 . 2008-05-22 00:13 d-------- C:\Program Files\Windows Media Connect 2
2008-05-22 00:13 . 2004-09-15 15:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-05-22 00:12 . 2008-05-22 00:13 d-------- C:\WINDOWS\system32\drivers\UMDF
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-08 12:55 --------- d-----w C:\Program Files\Steam
2008-06-04 12:00 --------- d-----w C:\Program Files\DC
2008-05-29 21:13 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\vlc
2008-05-28 19:57 --------- d-----w C:\Program Files\Avast!
2008-05-26 13:36 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\mIRC
2008-05-26 13:22 --------- d-----w C:\Program Files\mIRC
2008-05-04 21:20 --------- d-----w C:\Program Files\Guitar Pro 5
2008-05-03 23:07 --------- d-----w C:\Program Files\GameSpy Arcade
2008-05-03 23:05 --------- d-----w C:\Program Files\Atari
2008-04-10 20:40 --------- d-----w C:\Documents and Settings\Vuorijärvi\Application Data\Winamp
2008-04-09 15:08 --------- d-----w C:\Program Files\MTA San Andreas
2008-04-09 15:07 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-04-09 14:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-09 14:51 --------- d-----w C:\Program Files\Rockstar Games
2008-04-06 20:22 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2007-06-13 13:22 290,110 --sh--r C:\WINDOWS\system32\wplayer.exe
.
(((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
"Steam"="c:\program files\steam\steam.exe" [2008-03-28 15:54 1271032]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"Windows svchost"="ups.exe" [2004-09-15 15:00 18432 C:\WINDOWS\system32\ups.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 15:00 15360]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Steam\\steamapps\\d4rkki\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Steam\\steamapps\\d4rkki\\counter-strike\\hl.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\Steam\\steamapps\\herzzi\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Steam\\steamapps\\herzzi\\day of defeat source\\hl2.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\DC \\DCPlusPlus.exe"=
"C:\\Program Files\\Steam\\steam.exe"=
"C:\\Program Files\\Steam\\steamapps\\softc\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\GameSpy Arcade\\Aphex.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Program Files\\Atari\\Deer Hunter 2005 Demo\\DH2005Demo.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 16:06:44
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-06-08 16:07:43
ComboFix-quarantined-files.txt 2008-06-08 13:07:12
ComboFix2.txt 2008-06-08 12:58:34
Pre-Run: 35,931,930,624 tavua vapaana
Post-Run: 35,921,760,256 tavua vapaana
127 --- E O F --- 2008-05-22 21:52:07Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:
[quote]
File::
C:\is154890.exe
C:\Documents and Settings\Vuorijärvi\sz.exe
C:\sz.exe
C:\Documents and Settings\Vuorijärvi\sex2.exe
C:\sex2.exe
C:\sf.exe
C:\Documents and Settings\Vuorijärvi\fs.exe
C:\fs.exe
C:\Documents and Settings\Vuorijärvi\f.exe
C:\WINDOWS\is154890.exe
C:\WINDOWS\DC5177176.zip
C:\WINDOWS\mservice.exe
C:\Documents and Settings\Vuorijärvi\setup1.exe
C:\Documents and Settings\All Users\Application Data\SweetIM
C:\WINDOWS\winudspm.exe
[/quote]
Tallenna se nimellä CFScript.txt
Sitten raahaa CFScript ComboFix.exeen kuten alla.
[img]http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif[/img]
Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.
Ketjusta on poistettu 0 sääntöjenvastaista viestiä.
Luetuimmat keskustelut
Ampuminen kylpylässä
Onko vornasen timbe käynyt hiukan kylpemässä vai mikä tämä ampumatapaus on kylpylässä? Tuntuu aika villi meno olevan naa811924Kemijärvellä vesionnettomuus
Pitkänsillan ja taiteilijanniemen välillä nähty henkilön painuvan veden alle. Mitä on tapahtunut? Onko vesihiisi taas as361241Hei, voitko kuunnella
Voisitko auttaa minua selvittämään asioita? En halua ajaa sinua hulluuteen kanssani, en sitoa sinua, en esittää vaatimu134964Joku porukka lähtenyt täältä
Ihmeen hiljainen on palsta nyt. Yleensä tänne tulvii aloituksia yms, mutta nyt on kyllä erikoisen hiljaista.200879- 90764
- 70737
Olipa yllätys
Kuten hyvin moni tiesi/arvasi että valetta alusta loppuun toi *olemme ystäviä* satu. Instassaan käsi kädessä kuva kertoo210674- 67647
On todella ikävää
Todella ikävää, että asiat ovat menneet tällaisiksi. Tämä ei ollut missään vaiheessa tarkoitukseni. Olen tehnyt virheit79628- 64584
- 35581
Se kun olit pitkästä aikaa silmieni edessä
Oli kyllä sykähdyttävää. Tiedätkö, mikä laittaa minut ikävöimään sinua? Kun palautan mieleeni valtavan ihanan olemuksen,34566- 36524
- 55517
Oletteko koskaan torjuneet kaivattuanne?
Minä olen, kun en silloin tajunnut vielä ihastuneeni. Yritin paikata tapahtunutta, mutta ei onnistunut enää.25467Kai sä mies ymmärrät..
..ettet jättänyt vaihtoahtoa. Tottakai toivon vielä, että pystyisit toimimaan niin että asiat korjaantuisivat. Vahvast28442- 33433
- 40427
- 35424
Hämmentävä hetki: TTK:sta pudonnut Johanna Puhakka lataa pettyneenä: "Sitä ei voi kieltää"
Johanna Puhakka ja Jurijs Jurza Trosenko tippuivat Tanssii Tähtien Kanssa -kisasta. Suositussa viihdeohjelmassa nähtiin13419