ComboFix 08-06-20.4 - Heidi 2008-06-28 1:58:54.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.76 [GMT 3:00]
Running from: C:\Documents and Settings\Heidi\Työpöytä\ComboFix.exe
Command switches used :: C:\Documents and Settings\Heidi\Työpöytä\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\dci.exe
C:\Documents and Settings\Heidi\f.exe
C:\Documents and Settings\Heidi\fs.exe
C:\fs.exe
C:\sexy.com
.
(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\dci.exe
C:\Documents and Settings\Heidi\f.exe
C:\Documents and Settings\Heidi\fs.exe
C:\sexy.com
.
((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-05-27 to 2008-06-27 )))))))))))))))))
.
C:\ComboFix\CreateC00.bat .
2008-06-25 13:20 . 2008-06-25 13:20 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-06-21 19:41 . 2008-06-21 19:41 <KANSIO> d-------- C:\Program Files\ffdshow
2008-06-21 19:00 . 2006-10-04 17:06 1,197,294 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-06-21 19:00 . 2006-10-04 17:06 764,868 -----c--- C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-06-21 19:00 . 2006-10-04 17:06 217,118 -----c--- C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-06-21 18:58 . 2008-06-21 18:58 <KANSIO> d-------- C:\Program Files\Windows Media Connect 2
2008-06-21 18:49 . 2008-06-21 18:49 <KANSIO> d-------- C:\WINDOWS\system32\LogFiles
2008-06-21 18:49 . 2008-06-21 18:52 <KANSIO> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-06-20 20:54 . 2008-06-20 20:54 <KANSIO> d-------- C:\Documents and Settings\Heidi\Application Data\Apple Computer
2008-06-20 18:50 . 2008-06-20 18:50 <KANSIO> d-------- C:\Program Files\uTorrent
2008-06-20 18:50 . 2008-06-24 00:52 <KANSIO> d-------- C:\Documents and Settings\Heidi\Application Data\uTorrent
2008-06-20 08:53 . 2008-06-20 08:54 <KANSIO> d-------- C:\Program Files\Unlocker
2008-06-16 17:46 . 2008-06-16 17:46 <KANSIO> d-------- C:\Documents and Settings\Heidi\Application Data\Malwarebytes
2008-06-16 17:46 . 2008-06-16 17:46 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-06-16 17:46 . 2008-06-19 17:48 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-16 17:46 . 2008-06-19 17:47 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-16 17:45 . 2008-06-25 05:47 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-16 17:30 . 2008-06-16 17:30 <KANSIO> d--h----- C:\WINDOWS\PIF
2008-06-15 03:06 . 2008-06-23 03:06 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-06-14 21:12 . 2008-06-14 20:59 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-01 17:57 . 2008-06-01 17:57 <KANSIO> d-------- C:\Program Files\COMODO
2008-06-01 17:57 . 2008-06-01 17:57 <KANSIO> d-------- C:\Documents and Settings\Heidi\Application Data\Comodo
2008-06-01 17:57 . 2008-06-01 19:58 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\comodo
2008-06-01 17:57 . 2008-06-01 17:57 143,104 --a------ C:\WINDOWS\system32\guard32.dll
2008-06-01 17:57 . 2008-06-01 17:57 87,056 --a------ C:\WINDOWS\system32\drivers\cmdguard.sys
2008-06-01 17:57 . 2008-06-01 17:57 24,208 --a------ C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-05-30 14:14 . 2008-05-31 03:50 959 --a------ C:\rollback.ini
2008-05-30 04:07 . 2008-05-30 14:02 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\MailFrontier
2008-05-30 04:07 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2008-05-30 04:07 . 2008-05-30 04:23 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-05-30 04:05 . 2008-05-31 14:00 <KANSIO> d-------- C:\WINDOWS\system32\ZoneLabs
2008-05-30 04:04 . 2008-05-31 14:00 <KANSIO> d-------- C:\WINDOWS\Internet Logs
2008-05-30 03:39 . 2008-05-30 05:26 <KANSIO> d-------- C:\Program Files\Panda Security
2008-05-29 20:42 . 2008-05-29 20:42 <KANSIO> d-------- C:\WINDOWS\ERUNT
2008-05-29 15:55 . 2008-05-29 15:56 <KANSIO> d-------- C:\WINDOWS\system32\NtmsData
2008-05-29 01:43 . 2008-05-29 01:43 229 --a------ C:\WINDOWS\system32\fff.bat
2008-05-28 22:04 . 2008-05-28 22:04 <KANSIO> d-------- C:\fsaua.data
2008-05-28 19:26 . 2008-06-28 01:46 <KANSIO> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-05-28 18:07 . 2008-05-29 01:46 <KANSIO> d-------- C:\WINDOWS\SxsCaPendDel
.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-14 17:59 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-09 22:16 --------- d-----w C:\Documents and Settings\Heidi\Application Data\Creative
2008-05-29 00:23 --------- d-----w C:\Program Files\Windows Live
2008-05-28 22:38 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2007-12-15 00:47 20,816 ----a-w C:\Documents and Settings\Heidi\Application Data\GDIPFONTCACHEV1.DAT
1998-04-26 21:00 570,128 ----a-w C:\Program Files\Common Files\DAO350.DLL
.
((((((((((((((((((((((((((((( snapshot@2008-06-25_14.31.29.29 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-25 10:07:39 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-27 23:09:18 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-27 23:09:26 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_59c.dat
.
(((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 02:12 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-01-30 18:01 81920]
"Promon.exe"="PROMon.exe" [2002-03-25 13:36 73728 C:\WINDOWS\system32\PROMon.exe]
"NeroCheck"="C:\WINDOWS\System32\\NeroCheck.exe" [2001-07-09 21:50 155648]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-10-23 20:51 233472]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-06-25 12:24 49152]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-07-29 02:43 188416]
"DeviceDiscovery"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2003-05-21 19:37 229437]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-06-15 17:12 1655552]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-01-30 18:01 81920]
"Promon.exe"="PROMon.exe" [2002-03-25 13:36 73728 C:\WINDOWS\system32\PROMon.exe]
"NeroCheck"="C:\WINDOWS\System32\\NeroCheck.exe" [2001-07-09 21:50 155648]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-10-23 20:51 233472]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-06-25 12:24 49152]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-07-29 02:43 188416]
"DeviceDiscovery"="C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2003-05-21 19:37 229437]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-06-15 17:12 1655552]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-15 02:12 15360]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-24 00:18 443968]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-06-01 17:57]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-06-01 17:57]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
*Newly Created Service* - NMSCFG
.
'Ajoitetut teht„v„t'-kansion sis„lt”
"2008-06-19 17:45:53 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by
Gmer,
http://www.gmer.net
Rootkit scan 2008-06-28 02:10:35
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\NMSSvc.Exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Completion time: 2008-06-28 2:22:05 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-27 23:21:26
ComboFix2.txt 2008-06-25 11:31:56
Pre-Run: 26,794,119,168 tavua vapaana
Post-Run: 27,179,429,888 tavua vapaana
152 --- E O F --- 2008-06-23 00:06:56
Malwarebytes' Anti-Malware 1.18
Tietokantaversio: 895
3:28:18 28.6.2008
mbam-log-6-28-2008 (03-28-18).txt
Tarkistustyyppi: Täysi tarkistus (C:\|)
Tarkistetut kohteet: 132316
Kulunut aika: 59 minute(s), 30 second(s)
Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0
Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)
Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)
Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)
Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)
Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)
Logfile of Trend Micro
HijackThis v2.0.2
Scan saved at 3:34:22, on 28.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\NMSSvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\WINDOWS\system32\PROMon.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [Promon.exe] PROMon.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - .DEFAULT User Startup: asetusXP.lnk = winXPreg\asetusXP.cmd (User 'Default user')
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 -
Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (
QuickTime Object) -
http://a1540.g.akamai.net/7/1540/52/2006...ex/qtplugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
http://by18fd.bay18.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/windowsupdat...b?1161941977184
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} -
http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftupd...b?1161948747765
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma
Image Uploader 3.0 Control) - https://ssl.extrafilm.org/upload/activex/ImageUploader3.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) -
http://support.f-secure.com/ols/fscax.cab
O23 - Service:
avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service:
COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) NMS (NMSSvc) -
Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
--
End of file - 6357 bytes
