hjt-log
Logfile of Trend Micro
HijackThis v2.0.2
Scan saved at 20:24:26, on 8/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Anti-Virus\fsrw.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\sistray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://runonce.msn.com/?v=msgrv75
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: &Block this popup - C:\Program Files\F-Secure\Anti-Spyware\blockpopups.htm
O8 - Extra context menu item: Add to Windows &Live Favorites -
http://favorites.live.com/quickadd.aspx
O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure\Anti-Spyware\ieshield.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler
Starter) - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
--
End of file - 6223 bytes
combo-log:
ComboFix 08-07-31.06 - Tiia 2008-08-01 19:33:29.1 - NTFSx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.59 [GMT 3:00]
Running from: C:\Documents and Settings\benyam\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\benyam\Desktop\CFScript.txt
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
c:\windows\msn.com
C:\WINDOWS\system32\blhvkncq.dll
C:\WINDOWS\system32\lphcrsmj0ej3a.exe
C:\WINDOWS\system32\tjtllkbp.dll
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\benyam\Application Data\rhcvsmj0ej3a
C:\Program Files\rhcvsmj0ej3a
C:\WINDOWS\admintxt.txt
C:\WINDOWS\BM171a188f.txt
C:\WINDOWS\BM171a188f.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\B.tmp
C:\WINDOWS\system32\blphcrsmj0ej3a.scr
C:\WINDOWS\system32\C.tmp
C:\WINDOWS\system32\csmvrppe.dll
C:\WINDOWS\system32\D.tmp
C:\WINDOWS\system32\dphrgd.dll
C:\WINDOWS\system32\E.tmp
C:\WINDOWS\system32\F.tmp
C:\WINDOWS\system32\fccdedCu.dll
C:\WINDOWS\system32\fippopwy.dll
C:\WINDOWS\system32\hylfomvu.dll
C:\WINDOWS\system32\iifgFYpP.dll
C:\WINDOWS\system32\ipauhq.dll
C:\WINDOWS\system32\jhpckhcx.ini
C:\WINDOWS\system32\jqmsjeam.ini
C:\WINDOWS\system32\ldhlgw.dll
C:\WINDOWS\system32\lnrluqhy.dll
C:\WINDOWS\system32\lphcrsmj0ej3a.exe
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mwmwotxn.dll
C:\WINDOWS\system32\oahode.dll
C:\WINDOWS\system32\pbklltjt.ini
C:\WINDOWS\system32\phcrsmj0ej3a.bmp
C:\WINDOWS\system32\pphcrsmj0ej3a.exe
C:\WINDOWS\system32\sgutgcfq.dll
C:\WINDOWS\system32\sysrest32.exe
C:\WINDOWS\system32\tacxvwcm.dll
C:\WINDOWS\system32\uajpgekt.dll
C:\WINDOWS\system32\uCdedccf.ini
C:\WINDOWS\system32\uCdedccf.ini2
C:\WINDOWS\system32\vtwylsuy.dll
C:\WINDOWS\system32\vukchd.dll
C:\WINDOWS\system32\wifxqara.dll
C:\WINDOWS\system32\winhoo32.dll
C:\WINDOWS\system32\xpxarpnm.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_SYSREST.SYS
-------\Service_sysrest.sys
((((((((((((((((((((((((( Files Created from 2008-07-01 to 2008-08-01 )))))))))))))))))))))))))))))))
.
2008-08-01 17:41 . 2008-08-01 17:41 <DIR> d-------- C:\Documents and Settings\benyam\Application Data\Malwarebytes
2008-08-01 17:40 . 2008-08-01 17:41 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-01 17:40 . 2008-08-01 17:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-01 17:40 . 2008-07-30 20:07 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-01 17:40 . 2008-07-30 20:07 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-01 16:34 . 2008-08-01 16:34 2,196 --a------ C:\WINDOWS\system32\tmp.reg
2008-08-01 16:31 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-08-01 16:31 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-08-01 16:31 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-08-01 16:31 . 2008-05-23 18:21 81,920 --a------ C:\WINDOWS\system32\404Fix.exe
2008-08-01 16:31 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-08-01 16:31 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-08-01 16:31 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-08-01 15:47 . 2008-08-01 15:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-08-01 14:13 . 2008-08-01 14:13 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-01 14:08 . 2008-08-01 14:13 <DIR> d-------- C:\Program Files\CCleaner
2008-08-01 14:01 . 2008-08-01 14:01 145 --a------ C:\WINDOWS\system32\winver.bat
2008-07-31 11:46 . 2008-07-31 11:46 81,408 --a------ C:\WINDOWS\system32\TJTLLKBP.0LL
2008-07-31 11:43 . 2008-07-31 11:43 89,600 --a------ C:\WINDOWS\system32\BLHVKNCQ.0LL
2008-07-31 05:42 . 2008-07-31 05:42 81,408 --a------ C:\WINDOWS\system32\XCHKCPHJ.0LL
2008-07-30 22:54 . 2008-07-30 22:58 <DIR> d-------- C:\Documents and Settings\benyam\Contacts
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-01 15:32 94,208 ----a-w C:\WINDOWS\system32\92.tmp
2008-08-01 15:32 94,208 ----a-w C:\WINDOWS\system32\90.tmp
2008-08-01 15:32 94,208 ----a-w C:\WINDOWS\system32\8F.tmp
2008-08-01 15:32 94,208 ----a-w C:\WINDOWS\system32\8E.tmp
2008-08-01 15:32 94,208 ----a-w C:\WINDOWS\system32\8D.tmp
2008-08-01 15:32 94,208 ----a-w C:\WINDOWS\system32\8C.tmp
2008-08-01 15:32 94,208 ----a-w C:\WINDOWS\system32\8B.tmp
2008-08-01 15:31 94,208 ----a-w C:\WINDOWS\system32\8A.tmp
2008-08-01 15:31 94,208 ----a-w C:\WINDOWS\system32\87.tmp
2008-08-01 15:31 94,208 ----a-w C:\WINDOWS\system32\78.tmp
2008-08-01 15:31 94,208 ----a-w C:\WINDOWS\system32\70.tmp
2008-08-01 15:31 94,208 ----a-w C:\WINDOWS\system32\66.tmp
2008-08-01 15:31 94,208 ----a-w C:\WINDOWS\system32\65.tmp
2008-08-01 15:31 94,208 ----a-w C:\WINDOWS\system32\56.tmp
2008-08-01 15:30 94,208 ----a-w C:\WINDOWS\system32\53.tmp
2008-08-01 15:30 94,208 ----a-w C:\WINDOWS\system32\50.tmp
2008-08-01 15:30 94,208 ----a-w C:\WINDOWS\system32\4F.tmp
2008-08-01 11:08 --------- d-----w C:\Program Files\Yahoo!
2008-08-01 10:47 94,208 ----a-w C:\WINDOWS\system32\5A.tmp
2008-08-01 10:47 94,208 ----a-w C:\WINDOWS\system32\59.tmp
2008-08-01 10:46 94,208 ----a-w C:\WINDOWS\system32\58.tmp
2008-08-01 10:46 94,208 ----a-w C:\WINDOWS\system32\57.tmp
2008-08-01 10:46 94,208 ----a-w C:\WINDOWS\system32\4E.tmp
2008-08-01 10:46 94,208 ----a-w C:\WINDOWS\system32\4D.tmp
2008-08-01 10:46 94,208 ----a-w C:\WINDOWS\system32\4C.tmp
2008-08-01 10:46 94,208 ----a-w C:\WINDOWS\system32\4A.tmp
2008-08-01 08:55 94,208 ----a-w C:\WINDOWS\system32\136.tmp
2008-08-01 08:55 94,208 ----a-w C:\WINDOWS\system32\10A.tmp
2008-08-01 08:55 94,208 ----a-w C:\WINDOWS\system32\109.tmp
2008-08-01 08:55 94,208 ----a-w C:\WINDOWS\system32\108.tmp
2008-08-01 08:55 94,208 ----a-w C:\WINDOWS\system32\107.tmp
2008-08-01 08:55 94,208 ----a-w C:\WINDOWS\system32\106.tmp
2008-08-01 08:55 94,208 ----a-w C:\WINDOWS\system32\105.tmp
2008-08-01 08:54 94,208 ----a-w C:\WINDOWS\system32\104.tmp
2008-08-01 08:53 94,208 ----a-w C:\WINDOWS\system32\D6.tmp
2008-08-01 08:53 94,208 ----a-w C:\WINDOWS\system32\D5.tmp
2008-08-01 08:53 94,208 ----a-w C:\WINDOWS\system32\D4.tmp
2008-08-01 08:53 94,208 ----a-w C:\WINDOWS\system32\D3.tmp
2008-08-01 08:53 94,208 ----a-w C:\WINDOWS\system32\D2.tmp
2008-08-01 08:53 94,208 ----a-w C:\WINDOWS\system32\D1.tmp
2008-08-01 08:53 94,208 ----a-w C:\WINDOWS\system32\D0.tmp
2008-08-01 08:53 94,208 ----a-w C:\WINDOWS\system32\103.tmp
2008-08-01 08:52 94,208 ----a-w C:\WINDOWS\system32\CF.tmp
2008-08-01 08:52 94,208 ----a-w C:\WINDOWS\system32\CE.tmp
2008-08-01 08:52 94,208 ----a-w C:\WINDOWS\system32\CD.tmp
2008-08-01 08:52 94,208 ----a-w C:\WINDOWS\system32\CC.tmp
2008-08-01 08:52 94,208 ----a-w C:\WINDOWS\system32\CB.tmp
2008-08-01 08:52 94,208 ----a-w C:\WINDOWS\system32\CA.tmp
2008-08-01 06:40 94,208 ----a-w C:\WINDOWS\system32\2A7.tmp
2008-08-01 06:40 94,208 ----a-w C:\WINDOWS\system32\2A6.tmp
2008-08-01 06:40 94,208 ----a-w C:\WINDOWS\system32\2A5.tmp
2008-08-01 06:39 94,208 ----a-w C:\WINDOWS\system32\2A4.tmp
2008-08-01 06:39 94,208 ----a-w C:\WINDOWS\system32\2A3.tmp
2008-08-01 06:39 94,208 ----a-w C:\WINDOWS\system32\2A2.tmp
2008-08-01 06:39 94,208 ----a-w C:\WINDOWS\system32\2A1.tmp
2008-08-01 06:39 94,208 ----a-w C:\WINDOWS\system32\2A0.tmp
2008-08-01 06:39 94,208 ----a-w C:\WINDOWS\system32\29F.tmp
2008-08-01 06:39 94,208 ----a-w C:\WINDOWS\system32\299.tmp
2008-08-01 06:39 94,208 ----a-w C:\WINDOWS\system32\298.tmp
2008-08-01 06:38 94,208 ----a-w C:\WINDOWS\system32\297.tmp
2008-08-01 06:38 94,208 ----a-w C:\WINDOWS\system32\296.tmp
2008-08-01 06:38 94,208 ----a-w C:\WINDOWS\system32\295.tmp
2008-08-01 06:38 94,208 ----a-w C:\WINDOWS\system32\294.tmp
2008-08-01 06:37 94,208 ----a-w C:\WINDOWS\system32\293.tmp
2008-08-01 06:37 94,208 ----a-w C:\WINDOWS\system32\292.tmp
2008-08-01 06:37 94,208 ----a-w C:\WINDOWS\system32\28F.tmp
2008-08-01 06:37 94,208 ----a-w C:\WINDOWS\system32\28E.tmp
2008-08-01 06:36 94,208 ----a-w C:\WINDOWS\system32\28D.tmp
2008-08-01 06:36 94,208 ----a-w C:\WINDOWS\system32\28C.tmp
2008-08-01 06:36 94,208 ----a-w C:\WINDOWS\system32\28B.tmp
2008-08-01 06:36 94,208 ----a-w C:\WINDOWS\system32\28A.tmp
2008-08-01 06:36 94,208 ----a-w C:\WINDOWS\system32\289.tmp
2008-08-01 06:36 94,208 ----a-w C:\WINDOWS\system32\288.tmp
2008-08-01 06:36 94,208 ----a-w C:\WINDOWS\system32\287.tmp
2008-08-01 06:36 94,208 ----a-w C:\WINDOWS\system32\286.tmp
2008-08-01 06:35 94,208 ----a-w C:\WINDOWS\system32\285.tmp
2008-07-31 22:37 94,208 ----a-w C:\WINDOWS\system32\91.tmp
2008-07-31 22:36 94,208 ----a-w C:\WINDOWS\system32\89.tmp
2008-07-31 22:36 94,208 ----a-w C:\WINDOWS\system32\88.tmp
2008-07-31 21:42 94,208 ----a-w C:\WINDOWS\system32\86.tmp
2008-07-31 21:42 94,208 ----a-w C:\WINDOWS\system32\85.tmp
2008-07-31 21:42 94,208 ----a-w C:\WINDOWS\system32\84.tmp
2008-07-31 21:41 94,208 ----a-w C:\WINDOWS\system32\83.tmp
2008-07-31 21:41 94,208 ----a-w C:\WINDOWS\system32\82.tmp
2008-07-31 21:41 94,208 ----a-w C:\WINDOWS\system32\81.tmp
2008-07-31 21:41 94,208 ----a-w C:\WINDOWS\system32\80.tmp
2008-07-31 21:41 94,208 ----a-w C:\WINDOWS\system32\7F.tmp
2008-07-31 21:41 94,208 ----a-w C:\WINDOWS\system32\7E.tmp
2008-07-31 21:41 94,208 ----a-w C:\WINDOWS\system32\7D.tmp
2008-07-31 21:40 94,208 ----a-w C:\WINDOWS\system32\7C.tmp
2008-07-31 21:40 94,208 ----a-w C:\WINDOWS\system32\7B.tmp
2008-07-31 21:40 94,208 ----a-w C:\WINDOWS\system32\7A.tmp
2008-07-31 21:40 94,208 ----a-w C:\WINDOWS\system32\77.tmp
2008-07-31 21:40 94,208 ----a-w C:\WINDOWS\system32\76.tmp
2008-07-31 21:40 94,208 ----a-w C:\WINDOWS\system32\75.tmp
2008-07-31 21:40 94,208 ----a-w C:\WINDOWS\system32\74.tmp
2008-07-31 21:40 94,208 ----a-w C:\WINDOWS\system32\73.tmp
2008-07-31 21:39 94,208 ----a-w C:\WINDOWS\system32\72.tmp
2008-07-31 21:39 94,208 ----a-w C:\WINDOWS\system32\6F.tmp
2008-07-31 21:39 94,208 ----a-w C:\WINDOWS\system32\6E.tmp
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 14:44 196608]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-31 03:45 313472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.EXE" [2005-10-26 04:51 122929]
"F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2004-05-27 11:57 684032]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-02-04 18:31 180269]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 15:24 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 15:14 217088]
"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 13:15 106496]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 17:32 221184]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-12-11 11:56 286720]
"SiSPower"="SiSPower.dll" [2004-09-02 08:47 49152 C:\WINDOWS\system32\SiSPower.dll]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 10:56 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-06-02 17:46:02 113664]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 09:05:26 29696]
F-Secure Automatic Update.lnk - C:\Program Files\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe [2007-02-04 16:24:10 32807]
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2007-02-10 16:02:50 331776]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\Program\\F-Secure Automatic Update.exe"= C:\\Program Files\\F-Secure\\BackWeb\\7681197\\program\\F-Secure Automatic Update.exe
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Java\\jdk1.6.0_10\\jre\\bin\\java.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\WINDOWS\\system32\\winver.exe"=
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2005-10-31 13:01]
R2 BackWeb Plug-in - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2007-02-04 16:24]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2005-08-19 16:37]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2005-10-06 17:30]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2005-08-19 16:37]
S3 MBAMSwissArmy;MBAMSwissArmy;C:\WINDOWS\system32\drivers\mbamswissarmy.sys [2008-07-30 20:07]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ec0e1d3-d26a-11dc-8f62-0013d41582d6}]
\Shell\Auto\command - OSO.exe
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL OSO.exe
.
Contents of the 'Scheduled Tasks' folder
2008-04-21 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 15:57]
2008-08-01 C:\WINDOWS\Tasks\Scheduled scanning task.job
- C:\PROGRA~1\F-Secure\ANTI-V~1\fsav.exe [2005-05-24 17:42]
.
- - - - ORPHANS REMOVED - - - -
BHO-{6FF22309-A6ED-462B-ABEC-877625C012F3} - C:\WINDOWS\system32\xxywuSmJ.dll
HKCU-Run-ares - C:\Program Files\Ares\Ares.exe
HKLM-Run-lphcrsmj0ej3a - C:\WINDOWS\system32\lphcrsmj0ej3a.exe
HKLM-Run-SMrhcvsmj0ej3a - C:\Program Files\rhcvsmj0ej3a\rhcvsmj0ej3a.exe
HKLM-Run-14292b13 - C:\WINDOWS\system32\tjtllkbp.dll
HKLM-Run-BM171a188f - C:\WINDOWS\system32\blhvkncq.dll
HKLM-Run-sysrest32.exe - C:\WINDOWS\system32\sysrest32.exe
ShellExecuteHooks-{6FF22309-A6ED-462B-ABEC-877625C012F3} - C:\WINDOWS\system32\xxywuSmJ.dll
Notify-xxywuSmJ - xxywuSmJ.dll
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by
Gmer,
http://www.gmer.net
Rootkit scan 2008-08-01 19:42:33
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32.exe
C:\Program Files\F-Secure\common\FSMA32.EXE
C:\Program Files\F-Secure\common\FSMB32.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\common\FCH32.EXE
C:\Program Files\F-Secure\common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure\Anti-Virus\FSRW.exe
C:\Program Files\F-Secure\common\FNRB32.exe
C:\Program Files\F-Secure\FWES\program\fsdfwd.exe
C:\Program Files\F-Secure\common\FIH32.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\F-Secure\Anti-Virus\FSAV32.exe
C:\PROGRA~1\F-Secure\ANTI-S~1\FSAW.exe
C:\Program Files\F-Secure\FSGUI\fsguidll.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\SoftwareDistribution\Download\ad744bdeedce85bf37a096f34577ff3a\update\update.exe
.
**************************************************************************
.
Completion time: 2008-08-01 19:51:37 - machine was rebooted [Tiia]
ComboFix-quarantined-files.txt 2008-08-01 16:49:31
Pre-Run: 18,222,579,712 bytes free
Post-Run: 20,623,966,208 bytes free
286 --- E O F --- 2008-05-16 00:03:26
malware-log
Malwarebytes' Anti-Malware 1.24
Database version: 1014
Windows 5.1.2600 Service Pack 2
19:29:55 2008-08-01
mbam-log-8-1-2008 (19-29-44).txt
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 152754
Time elapsed: 28 minute(s), 23 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 2
Registry Keys Infected: 22
Registry Values Infected: 8
Registry Data Items Infected: 4
Folders Infected: 13
Files Infected: 257
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
C:\WINDOWS\system32\fccdedCu.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\winhoo32.dll (Dialer) -> No action taken.
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9e3317a2-b8cd-4864-b8b7-a245cab00238} (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{9e3317a2-b8cd-4864-b8b7-a245cab00238} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5eeefd1f-fce2-4281-a015-73a2b13273e4} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{5eeefd1f-fce2-4281-a015-73a2b13273e4} (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d58e2d81-3eb1-4fce-a6a9-96cda633a3a7} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{d58e2d81-3eb1-4fce-a6a9-96cda633a3a7} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{6ff22309-a6ed-462b-abec-877625c012f3} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6ff22309-a6ed-462b-abec-877625c012f3} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhcvsmj0ej3a (
Rogue.Multiple) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\rhcvsmj0ej3a (Rogue.Multiple) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winhoo32 (Dialer) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSSMGR (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> No action taken.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6ff22309-a6ed-462b-abec-877625c012f3} (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smrhcvsmj0ej3a (Rogue.Multiple) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysrest32.exe (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphcrsmj0ej3a (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> No action taken.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> No action taken.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\fccdedcu -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\fccdedcu -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
Folders Infected:
C:\Program Files\rhcvsmj0ej3a (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008 (Rogue.AntivirusXP2008) -> No action taken.
C:\Documents and Settings\benyam\Application Data\rhcvsmj0ej3a (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\benyam\Application Data\rhcvsmj0ej3a\Quarantine (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\benyam\Application Data\rhcvsmj0ej3a\Quarantine\Autorun (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\benyam\Application Data\rhcvsmj0ej3a\Quarantine\Autorun\HKCU (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\benyam\Application Data\rhcvsmj0ej3a\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\benyam\Application Data\rhcvsmj0ej3a\Quarantine\Autorun\HKLM (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\benyam\Application Data\rhcvsmj0ej3a\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\benyam\Application Data\rhcvsmj0ej3a\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\benyam\Application Data\rhcvsmj0ej3a\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\benyam\Application Data\rhcvsmj0ej3a\Quarantine\BrowserObjects (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\benyam\Application Data\rhcvsmj0ej3a\Quarantine\Packages (Rogue.Multiple) -> No action taken.
Files Infected:
C:\WINDOWS\system32\fccdedCu.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\uCdedccf.ini (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\uCdedccf.ini2 (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\oahode.dll (Trojan.BHO) -> No action taken.
C:\WINDOWS\system32\hylfomvu.dll (Trojan.BHO) -> No action taken.
C:\Documents and Settings\benyam\Local Settings\Temp\BXQLMDCG.0LL (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\benyam\Local Settings\Temporary Internet Files\Content.IE5\CR072PCR\kb456456[1] (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\benyam\Local Settings\Temporary Internet Files\Content.IE5\LDW2GF17\2oxu[1].dll (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\benyam\Local Settings\Temporary Internet Files\Content.IE5\N7D9X5DA\CA1MW3RT (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\benyam\Local Settings\Temporary Internet Files\Content.IE5\NWLDR0GG\kb767887[1] (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\benyam\Local Settings\Temporary Internet Files\Content.IE5\SXAV05AF\kb671231[1] (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP681\A0117831.0LL (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP681\A0117842.0LL (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP681\A0117843.0LL (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP681\A0117844.exe (Trojan.Fakealert) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP681\A0118840.exe (Trojan.Fakealert) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP682\A0118856.exe (Trojan.Fakealert) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP682\A0118860.0LL (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP682\A0118861.0LL (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP682\A0118863.0LL (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP682\A0119856.exe (Trojan.Fakealert) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP682\A0120855.exe (Trojan.Fakealert) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP683\A0120868.exe (Trojan.Fakealert) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP683\A0120880.exe (Trojan.Fakealert) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP683\A0121879.exe (Trojan.Fakealert) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP683\A0122878.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP683\A0122882.exe (Trojan.Fakealert) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP683\A0123880.exe (Trojan.Fakealert) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP683\A0124880.exe (Trojan.Fakealert) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP683\A0125880.exe (Trojan.Fakealert) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP683\A0126880.exe (Trojan.Fakealert) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP683\A0128879.exe (Trojan.Fakealert) -> No action taken.
C:\System Volume Information\_restore{6A7CE58E-E671-46AA-A82B-E36CB700F171}\RP683\A0129881.exe (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\10.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\103.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\104.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\105.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\106.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\107.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\108.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\109.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\10A.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\11.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\12.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\13.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\136.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\14.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\15.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\16.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\17.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\18.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\19.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\1A.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\1B.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\1C.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\1D.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\1E.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\1F.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\20.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\21.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\22.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\23.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\24.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\25.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\26.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\27.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\28.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\285.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\286.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\287.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\288.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\289.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\28A.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\28B.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\28C.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\28D.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\28E.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\28F.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\29.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\292.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\293.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\294.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\295.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\296.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\297.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\298.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\299.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\29F.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\2A.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\2A0.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\2A1.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\2A2.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\2A3.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\2A4.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\2A5.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\2A6.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\2A7.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\2B.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\2C.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\2D.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\2E.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\2F.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\30.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\31.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\32.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\33.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\34.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\35.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\36.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\37.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\38.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\39.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\3A.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\3B.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\3C.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\3D.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\3E.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\3F.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\40.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\41.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\42.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\43.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\44.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\45.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\46.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\47.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\48.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\49.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\4A.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\4B.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\4C.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\4D.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\4E.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\4F.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\50.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\53.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\56.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\57.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\58.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\59.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\5A.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\5B.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\5C.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\5D.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\5E.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\5F.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\60.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\61.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\62.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\63.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\64.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\65.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\66.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\67.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\68.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\69.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\6A.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\6B.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\6C.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\6D.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\6E.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\6F.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\70.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\72.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\73.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\74.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\75.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\76.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\77.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\78.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\7A.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\7B.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\7C.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\7D.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\7E.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\7F.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\80.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\81.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\82.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\83.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\84.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\85.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\86.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\87.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\88.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\89.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\8A.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\8B.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\8C.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\8D.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\8E.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\8F.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\90.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\91.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\92.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\B.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\BLHVKNCQ.0LL (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\C.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\CA.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\CB.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\CC.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\CD.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\CE.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\CF.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\csmvrppe.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\D.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\D0.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\D1.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\D2.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\D3.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\D4.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\D5.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\D6.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\dphrgd.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\E.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\F.tmp (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\fippopwy.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\iifgFYpP.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ipauhq.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ldhlgw.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\lnrluqhy.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\mwmwotxn.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\pphcrsmj0ej3a.exe (Trojan.Fakealert) -> No action taken.
C:\WINDOWS\system32\sgutgcfq.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\tacxvwcm.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\TJTLLKBP.0LL (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\uajpgekt.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\vtwylsuy.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\vukchd.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\wifxqara.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\XCHKCPHJ.0LL (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\xpxarpnm.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\Temp\gos278.tmp (Trojan.Fakealert) -> No action taken.
C:\Program Files\rhcvsmj0ej3a\database.dat (Rogue.Multiple) -> No action taken.
C:\Program Files\rhcvsmj0ej3a\license.txt (Rogue.Multiple) -> No action taken.
C:\Program Files\rhcvsmj0ej3a\MFC71.dll (Rogue.Multiple) -> No action taken.
C:\Program Files\rhcvsmj0ej3a\MFC71ENU.DLL (Rogue.Multiple) -> No action taken.
C:\Program Files\rhcvsmj0ej3a\msvcp71.dll (Rogue.Multiple) -> No action taken.
C:\Program Files\rhcvsmj0ej3a\msvcr71.dll (Rogue.Multiple) -> No action taken.
C:\Program Files\rhcvsmj0ej3a\rhcvsmj0ej3a.exe (Rogue.Multiple) -> No action taken.
C:\Program Files\rhcvsmj0ej3a\rhcvsmj0ej3a.exe.local (Rogue.Multiple) -> No action taken.
C:\Program Files\rhcvsmj0ej3a\Uninstall.exe (Rogue.Multiple) -> No action taken.
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Antivirus XP 2008.lnk (Rogue.AntivirusXP2008) -> No action taken.
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\How to Register
Antivirus XP 2008.lnk (Rogue.AntivirusXP2008) -> No action taken.
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\License Agreement.lnk (Rogue.AntivirusXP2008) -> No action taken.
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Register Antivirus XP 2008.lnk (Rogue.AntivirusXP2008) -> No action taken.
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Uninstall.lnk (Rogue.AntivirusXP2008) -> No action taken.
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008.lnk (Rogue.AntivirusXP) -> No action taken.
C:\WINDOWS\system32\winhoo32.dll (Dialer) -> No action taken.
C:\Documents and Settings\benyam\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.Antivirus2008) -> No action taken.
C:\WINDOWS\system32\sysrest32.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\pskt.ini (Trojan.Vundo) -> No action taken.
C:\WINDOWS\BM171a188f.xml (Trojan.Vundo) -> No action taken.
C:\WINDOWS\BM171a188f.txt (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\blphcrsmj0ej3a.scr (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\lphcrsmj0ej3a.exe (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\phcrsmj0ej3a.bmp (Trojan.FakeAlert) -> No action taken.
Olipa aikaa vievää, kun kone sammuili kesken kaiken. Kiitos avusta jo tähän asti.
Nyt lopuksi kun koitin käynnistää uudelleen, ni kone jumittu, muuten vaikuttaa tilanne jo paremmalta. Huomasin, että mulla ei oo oikeuksia/salasanaa admin-käyttäjätunnukseen, en tiiä onko sillä ollu merkitystä tässä operaatiossa.
