1. Tämä sivusto käyttää keksejä (cookie). Jatkamalla sivuston käyttämistä hyväksyt keksien käyttämisen. Lue lisää.

Rundll32 ongelmat/viruspulmat

Viestiketju Virukset ja haittaohjelmat -osiossa. Ketjun avasi jkl75 24.02.2009.

Viestiketjun tila:
Viestiketju on suljettu.
  1. jkl75

    jkl75 Member

    Liittynyt:
    23.02.2009
    Viestejä:
    1
    Kiitokset:
    0
    Pisteet:
    11
    Asensin windows blinds ohjelman joka sekoitti koneen ihan jumiin ja nyt tarvis vähän apua sen korjaamisessa,kyseinen ohjelma on poistettu hetimiten ja mukana on hijack loki ja malvarebytesin lokitiedostot jos niistä joku viisas osaisi neuvoa...edit niin ja sit tulee vielä Combofixin loki ja Sdfixin....

    HIJACK:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 23:24:21, on 23.2.2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Gamesurround Fortissimo 4 mixer\EnMixCPL.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\TUProgSt.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Windows Live\Contacts\wlcomm.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wuauclt.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -

    C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma -

    {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft

    Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} -

    C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} -

    C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE

    C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE

    C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [EnvyHFCPL] C:\Program Files\Gamesurround Fortissimo 4 mixer\EnMixCPL.exe
    O4 - HKLM\..\Run: [MSUpdate] C:\DOCUME~1\Omistaja\LOCALS~1\Temp\pi.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"

    /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User

    'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User

    'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User

    'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User

    'Default user')
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} -

    C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 -

    {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

    Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

    Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683}

    - C:\Program Files\Messenger\msmsgs.exe
    O17 - HKLM\System\CS5\Services\Tcpip\..\{1085DE63-332E-44B5-A5C0-6BAD8A3DD298}:

    NameServer = 217.78.192.22 217.78.192.78
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program

    Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile

    Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program

    Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil

    Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil

    Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil

    Software\Avast4\ashWebSv.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program

    Files\Bonjour\mDNSResponder.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program

    Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. -

    C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -

    C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software -

    C:\WINDOWS\System32\TuneUpDefragService.exe
    O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp

    Software - C:\WINDOWS\System32\TUProgSt.exe

    --
    End of file - 5129 bytes

    MALWAREBYTES:

    Malwarebytes' Anti-Malware 1.34
    Tietokantaversio: 1797
    Windows 5.1.2600 Service Pack 3

    23.2.2009 23:47:53
    mbam-log-2009-02-23 (23-47-53).txt

    Tarkistustyyppi: Täysi tarkistus (C:\|)
    Tarkistetut kohteet: 102516
    Kulunut aika: 19 minute(s), 43 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)


    COMBOFIX:

    ComboFix 09-02-21.01 - Omistaja 2009-02-24 0:12:45.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1035.18.2047.1601 [GMT 2:00]
    Sijainti: c:\ohjelmat\ComboFix.exe
    AV: avast! antivirus 4.8.1335 [VPS 090223-0] *On-access scanning disabled* (Updated)
    * Uusi palautuspiste luotu
    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\pthreadGC2.dll

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2009-01-23 to 2009-02-23 )))))))))))))))))
    .

    2009-02-23 23:12 . 2009-02-23 23:12 <KANSIO> d-------- c:\program files\Malwarebytes' Anti-Malware
    2009-02-23 23:12 . 2009-02-23 23:12 <KANSIO> d-------- c:\documents and settings\Omistaja\Application Data\Malwarebytes
    2009-02-23 23:12 . 2009-02-23 23:12 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-02-23 23:12 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
    2009-02-23 23:12 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
    2009-02-23 22:53 . 2009-02-23 22:53 <KANSIO> d-------- c:\program files\Trend Micro
    2009-02-23 17:51 . 2009-02-23 17:51 <KANSIO> d-------- c:\windows\Sun
    2009-02-23 15:39 . 2009-02-23 15:39 <KANSIO> d-------- c:\program files\Lavasoft
    2009-02-23 15:39 . 2009-02-23 15:49 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
    2009-02-23 15:21 . 2007-08-24 19:45 101,120 -ra------ c:\windows\system32\drivers\ewusbmdm.sys
    2009-02-23 15:21 . 2007-08-24 19:45 24,448 -ra------ c:\windows\system32\drivers\ewdcsc.sys
    2009-02-23 14:16 . 2009-02-23 14:16 2,560 --a------ c:\windows\_MSRSTRT.EXE
    2009-02-23 14:02 . 2007-07-11 15:06 42,672 --------- c:\windows\system32\wbsys.dll
    2009-02-22 02:44 . 2009-02-22 02:44 <KANSIO> d-------- c:\documents and settings\Omistaja\Application Data\gtk-2.0
    2009-02-22 02:37 . 2009-02-22 02:37 <KANSIO> d-------- c:\documents and settings\Omistaja\Application Data\PCF-VLC
    2009-02-22 02:32 . 2009-02-22 02:32 <KANSIO> d-------- c:\documents and settings\Omistaja\Application Data\Participatory Culture Foundation
    2009-02-21 15:45 . 2009-02-21 15:45 <KANSIO> d-------- c:\program files\Common Files\Nero
    2009-02-21 15:45 . 2009-02-21 15:46 <KANSIO> d-------- c:\documents and settings\Omistaja\Application Data\Nero
    2009-02-21 15:45 . 2009-02-21 15:45 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Nero
    2009-02-21 15:44 . 2009-02-21 15:45 <KANSIO> d-------- c:\program files\Nero
    2009-02-20 14:42 . 2009-02-20 14:42 <KANSIO> d-------- c:\documents and settings\Omistaja\Application Data\fretsonfire
    2009-02-20 14:40 . 2009-02-23 16:11 <KANSIO> d-------- c:\program files\Frets on Fire
    2009-02-20 12:53 . 2009-02-20 12:53 <KANSIO> d-------- c:\program files\Deluxe Ski Jump 3
    2009-02-20 10:25 . 2009-02-23 22:34 <KANSIO> d-------- c:\documents and settings\Omistaja\Application Data\dvdcss
    2009-02-19 15:06 . 2009-02-19 15:06 410,984 --a------ c:\windows\system32\deploytk.dll
    2009-02-19 15:06 . 2009-02-19 15:06 73,728 --a------ c:\windows\system32\javacpl.cpl
    2009-02-18 16:37 . 2009-02-18 16:37 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\nView_Profiles
    2009-02-18 14:28 . 2009-02-18 14:28 <KANSIO> d-------- c:\documents and settings\All Users\Application Data\Last.fm
    2009-02-18 14:26 . 2009-02-18 14:26 <KANSIO> d-------- c:\program files\Last.fm
    2009-02-18 06:10 . 2009-02-18 06:10 <KANSIO> d-------- c:\windows\system32\fi-fi
    2009-02-18 06:10 . 2009-02-18 06:10 <KANSIO> d-------- c:\windows\system32\fi
    2009-02-18 06:10 . 2009-02-18 06:10 <KANSIO> d-------- c:\windows\system32\bits
    2009-02-18 06:10 . 2009-02-18 06:10 <KANSIO> d-------- c:\windows\l2schemas
    2009-02-18 06:09 . 2009-02-18 06:10 <KANSIO> d-------- c:\windows\ServicePackFiles
    2009-02-18 06:05 . 2009-02-18 06:05 <KANSIO> d-------- c:\windows\EHome
    2009-02-18 05:46 . 2008-10-16 14:06 268,648 --a------ c:\windows\system32\mucltui.dll
    2009-02-18 05:46 . 2008-10-16 14:06 208,744 --a------ c:\windows\system32\muweb.dll
    2009-02-18 05:46 . 2008-10-16 14:06 27,496 --a------ c:\windows\system32\mucltui.dll.mui
    2009-02-18 03:15 . 2009-02-18 03:15 <KANSIO> d-------- c:\program files\GIMP-2.0
    2009-02-18 03:15 . 2009-02-18 03:31 <KANSIO> d-------- c:\documents and settings\Omistaja\.gimp-2.6
    2009-02-18 03:15 . 2009-02-18 03:15 <KANSIO> d-------- c:\documents and settings\Omistaja\.gegl-0.0
    2009-02-17 17:01 . 2004-09-14 16:06 701,440 --------- c:\windows\system32\drivers\ati2mtag.sys
    2009-02-17 13:15 . 2009-02-23 23:23 <KANSIO> d-------- c:\documents and settings\Omistaja\Tracing
    2009-02-17 13:14 . 2009-02-17 13:14 <KANSIO> d-------- c:\program files\Windows Live SkyDrive
    2009-02-17 13:14 . 2009-02-17 13:15 <KANSIO> d-------- c:\program files\Windows Live
    2009-02-17 13:14 . 2009-02-17 13:14 <KANSIO> d-------- c:\program files\Microsoft
    2009-02-17 12:28 . 2009-02-17 12:28 <KANSIO> d-------- c:\program files\Common Files\Windows Live
    2009-02-16 08:15 . 2009-02-16 08:15 <KANSIO> d-------- c:\program files\Aspyr
    2009-02-16 08:15 . 2007-07-19 18:14 3,727,720 --a------ c:\windows\system32\d3dx9_35.dll
    2009-02-16 08:15 . 2007-04-04 18:53 81,768 --a------ c:\windows\system32\xinput1_3.dll
    2009-02-16 02:21 . 2009-02-16 02:21 <KANSIO> d-------- c:\program files\TimeAdjuster
    2009-02-14 02:52 . 2009-02-14 05:18 <KANSIO> d-------- c:\program files\The KMPlayer
    2009-02-14 02:51 . 2009-02-14 02:51 <KANSIO> d-------- c:\program files\ffdshow
    2009-02-14 02:51 . 2009-02-09 19:56 67,584 --a------ c:\windows\system32\ff_vfw.dll
    2009-02-14 02:51 . 2009-02-09 19:56 50,688 --a------ c:\windows\system32\ff_acm.acm
    2009-02-14 02:51 . 2007-07-10 17:10 547 --a------ c:\windows\system32\ff_vfw.dll.manifest
    2009-02-14 02:50 . 2009-02-14 02:50 <KANSIO> d-------- c:\program files\AC3Filter
    2009-02-14 02:50 . 2008-07-09 10:05 421,888 --a------ c:\windows\system32\ac3filter.acm
    2009-02-13 20:39 . 2009-02-13 20:39 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Wave64 Codec.bmp
    2009-02-13 20:39 . 2009-02-13 20:39 1,224 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Wave64 Codec.dat
    2009-02-13 20:38 . 2009-02-13 20:38 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp mp3 (Fraunhofer IIS) Codec.bmp
    2009-02-13 20:38 . 2009-02-13 20:38 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Midi Decoder.bmp
    2009-02-13 20:38 . 2009-02-13 20:38 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Dalet Codec.bmp
    2009-02-13 20:38 . 2009-02-13 20:38 3,153 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp mp3 (Fraunhofer IIS) Codec.dat
    2009-02-13 20:38 . 2009-02-13 20:38 2,649 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Midi Decoder.dat
    2009-02-13 20:38 . 2009-02-13 20:38 1,206 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Dalet Codec.dat
    2009-02-13 20:37 . 2009-02-16 08:31 <KANSIO> d-------- c:\documents and settings\Omistaja\Application Data\dBpoweramp
    2009-02-13 20:37 . 2009-02-13 20:37 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Mp2 and BwfMp2 codec.bmp
    2009-02-13 20:37 . 2009-02-13 20:37 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp DirectShow Decoder.bmp
    2009-02-13 20:37 . 2009-02-13 20:37 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp CLI Encoder.bmp
    2009-02-13 20:37 . 2009-02-13 20:37 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Aiff Codec.bmp
    2009-02-13 20:37 . 2009-02-13 20:37 3,018 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp CLI Encoder.dat
    2009-02-13 20:37 . 2009-02-13 20:37 2,738 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp DirectShow Decoder.dat
    2009-02-13 20:37 . 2009-02-13 20:37 1,844 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Mp2 and BwfMp2 codec.dat
    2009-02-13 20:37 . 2009-02-13 20:37 1,111 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Aiff Codec.dat
    2009-02-13 20:36 . 2009-02-13 20:36 <KANSIO> d-------- c:\windows\system32\drivers\umdf
    2009-02-13 20:36 . 2009-02-13 20:36 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Windows Media Audio 10 Codec.bmp
    2009-02-13 20:36 . 2009-02-13 20:36 3,400 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Windows Media Audio 10 Codec.dat
    2009-02-13 20:35 . 2009-02-13 20:35 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp WavPack Codec.bmp
    2009-02-13 20:35 . 2009-02-13 20:35 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp TTA Codec.bmp
    2009-02-13 20:35 . 2009-02-13 20:35 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Shorten Codec.bmp
    2009-02-13 20:35 . 2009-02-13 20:38 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Real Audio (Helix) Encoder.bmp
    2009-02-13 20:35 . 2009-02-13 20:39 11,473 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Real Audio (Helix) Encoder.dat
    2009-02-13 20:35 . 2009-02-13 20:35 3,417 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp TTA Codec.dat
    2009-02-13 20:35 . 2009-02-13 20:35 3,411 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Shorten Codec.dat
    2009-02-13 20:35 . 2009-02-13 20:35 3,008 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp WavPack Codec.dat
    2009-02-13 20:34 . 2009-02-13 20:34 88,576 --a------ c:\windows\system32\OptimFROG.dll
    2009-02-13 20:34 . 2009-02-13 20:34 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp OptimFROG Codec.bmp
    2009-02-13 20:34 . 2009-02-13 20:34 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Monkeys Audio Codec.bmp
    2009-02-13 20:34 . 2009-02-13 20:34 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp FLAC Codec.bmp
    2009-02-13 20:34 . 2009-02-13 20:34 3,467 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp OptimFROG Codec.dat
    2009-02-13 20:34 . 2009-02-13 20:34 3,107 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Monkeys Audio Codec.dat
    2009-02-13 20:34 . 2009-02-13 20:34 2,987 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp FLAC Codec.dat
    2009-02-13 20:33 . 2009-02-13 20:33 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp m4a Codec.bmp
    2009-02-13 20:33 . 2009-02-13 20:33 3,625 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp m4a Codec.dat
    2009-02-13 20:32 . 2009-02-13 20:32 <KANSIO> d-------- c:\program files\Illustrate
    2009-02-13 20:32 . 2009-02-16 08:37 <KANSIO> d-------- c:\documents and settings\Omistaja\Application Data\AccurateRip
    2009-02-13 20:32 . 2008-11-03 11:30 408,440 --a------ c:\windows\system32\SpoonUninstall.exe
    2009-02-13 20:32 . 2009-02-13 20:32 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Music Converter.bmp
    2009-02-13 20:32 . 2009-02-13 20:33 33,846 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp DSP Effects.bmp
    2009-02-13 20:32 . 2009-02-13 20:32 14,051 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp Music Converter.dat
    2009-02-13 20:32 . 2009-02-13 20:33 10,099 --a------ c:\windows\system32\SpoonUninstall-dBpoweramp DSP Effects.dat
    2009-02-13 05:18 . 2009-02-13 05:18 <KANSIO> d-------- c:\windows\system32\Lang
    2009-02-13 05:18 . 2009-02-13 05:18 940,794 --a------ c:\windows\system32\LoopyMusic.wav
    2009-02-13 05:18 . 2009-02-13 05:18 146,650 --a------ c:\windows\system32\BuzzingBee.wav
    2009-02-13 05:13 . 2009-02-13 05:13 <KANSIO> d-------- c:\windows\system32\RTCOM
    2009-02-13 05:13 . 2008-07-03 10:51 16,876,032 -ra------ c:\windows\RTHDCPL.EXE
    2009-02-13 05:13 . 2008-06-19 10:27 9,715,200 -ra------ c:\windows\RTLCPL.EXE
    2009-02-13 05:13 . 2008-07-03 11:03 4,745,216 -ra------ c:\windows\system32\drivers\RtkHDAud.sys
    2009-02-13 05:13 . 2008-06-19 10:42 2,808,832 -ra------ c:\windows\ALCWZRD.EXE
    2009-02-13 05:13 . 2007-06-28 10:44 2,165,760 -ra------ c:\windows\MicCal.exe
    2009-02-13 05:13 . 2007-11-20 12:15 1,826,816 -ra------ c:\windows\SkyTel.exe
    2009-02-13 05:13 . 2008-04-02 03:27 1,196,032 -ra------ c:\windows\RtlUpd.exe
    2009-02-13 05:13 . 2008-06-19 10:24 278,528 -ra------ c:\windows\system32\ALSNDMGR.CPL
    2009-02-13 05:13 . 2008-03-13 08:52 266,240 -ra------ c:\windows\system32\RTSndMgr.CPL
    2009-02-13 05:13 . 2008-06-18 12:01 77,824 -ra------ c:\windows\SOUNDMAN.EXE
    2009-02-13 05:13 . 2008-06-19 10:20 57,344 -ra------ c:\windows\ALCMTR.EXE
    2009-02-13 02:03 . 2009-02-13 02:03 <KANSIO> d---s---- c:\documents and settings\Omistaja\UserData
    2009-02-13 01:54 . 2009-02-23 17:37 <KANSIO> d-------- c:\program files\PAFPoker
    2009-02-12 21:26 . 2009-02-12 21:26 <KANSIO> d-------- c:\documents and settings\Omistaja\Application Data\Media Player Classic
    2009-02-12 21:12 . 2009-02-12 22:39 <KANSIO> d-------- c:\documents and settings\Omistaja\Application Data\vlc
    2009-02-12 20:58 . 2004-10-15 09:17 575,424 -ra------ c:\windows\system32\drivers\Envy24HF.sys
    2009-02-12 20:57 . 2009-02-12 20:58 <KANSIO> d-------- c:\program files\Gamesurround Fortissimo 4 mixer
    2009-02-12 19:57 . 2009-02-12 19:57 13,646 --a------ c:\windows\system32\wpa.bak
    2009-02-12 19:48 . 2008-06-14 19:34 272,128 --------- c:\windows\system32\drivers\bthport.sys

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-02-23 13:21 --------- d-----w c:\program files\Mobile Partner
    2009-02-19 13:06 --------- d-----w c:\program files\Java
    2009-02-12 20:39 --------- d-----w c:\documents and settings\Omistaja\Application Data\vlc
    2009-02-12 15:45 --------- d--h--w c:\program files\InstallShield Installation Information
    2009-02-12 15:45 --------- d-----w c:\program files\AMD
    2009-02-12 15:44 --------- d-----w c:\documents and settings\Omistaja\Application Data\InstallShield
    2009-02-12 15:41 --------- d-----w c:\program files\mutilang
    2009-02-12 15:31 --------- d-----w c:\program files\microsoft frontpage
    2009-02-12 15:31 --------- d-----w c:\program files\Common Files\Java
    2009-02-06 16:52 49,504 ----a-w c:\windows\system32\sirenacm.dll
    2008-12-10 07:45 70,936 ----a-w c:\windows\system32\PhysXLoader.dll
    2008-12-04 07:28 24,344 ----a-w c:\windows\system32\PhysXDevice.dll
    2008-11-26 06:55 288,024 ----a-w c:\windows\system32\PhysXCplUI.exe
    2008-11-25 06:38 288,024 ----a-w c:\windows\system32\PhysXCompatCplUI.exe
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-19 136600]
    "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-01-15 86016]
    "EnvyHFCPL"="c:\program files\Gamesurround Fortissimo 4 mixer\EnMixCPL.exe" [2004-10-14 3893248]
    "nwiz"="nwiz.exe" [2009-01-15 c:\windows\system32\nwiz.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.ac3filter"= ac3filter.acm
    "msacm.avis"= ff_acm.acm

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "c:\\Program Files\\Aspyr\\Guitar Hero III\\GH3.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

    R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-02-12 114768]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-02-12 20560]
    R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [2009-02-12 603904]
    R3 Envy24HFS;Gamesurround Fortissimo 4 Audio Controller WDM;c:\windows\system32\drivers\Envy24HF.sys [2009-02-12 575424]

    --- Muut muistissa olevat ajurit/palvelut ---

    *Deregistered* - MBAMSwissArmy

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    UxTuneUp

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{285b7ae1-f91b-11dd-8803-ae5577a90e47}]
    \Shell\AutoRun\command - I:\AutoRun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{285b7ae4-f91b-11dd-8803-ae5577a90e47}]
    \Shell\AutoRun\command - I:\AutoRun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c04fdf5a-01ac-11de-ae68-0021859e75a1}]
    \Shell\AutoRun\command - D:\AutoRun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ff7f9336-01aa-11de-ae67-0021859e75a1}]
    \Shell\AutoRun\command - D:\AutoRun.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{97973A9C-AD14-9AE6-076F-450CC8F92160}]
    c:\docume~1\Omistaja\LOCALS~1\Temp\pi.exe
    .
    'Ajoitetut tehtävät'-kansion sisältö

    2009-02-23 c:\windows\Tasks\1-Click Maintenance.job
    - c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 21:36]

    2009-02-23 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
    .
    .
    ------- Täydentävä tarkistus -------
    .
    FF - ProfilePath - c:\documents and settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\fy1qhbj3.default\
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-02-24 00:13:28
    Windows 5.1.2600 Service Pack 3 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************
    .
    --------------------- LUKITUT REKISTERIAVAIMET ---------------------

    [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\�•€|ÿÿÿÿ"•€|þ»Ów*]
    "b049C053C7D38EE4AB9A00CB3B5D2472"="C?\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\PUBPLACE.HTT"
    .
    Valmistumisajankohta: 2009-02-24 0:13:58
    ComboFix-quarantined-files.txt 2009-02-23 22:13:56

    Ennen ajoa: 52 646 924 288 tavua vapaana
    Ajon jälkeen: 52,686,188,544 tavua vapaana

    WindowsXP-KB310994-SP2-Home-BootDisk-FIN.EXE
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect /usepmtimer

    Current=4 Default=4 Failed=3 LastKnownGood=5 Sets=1,2,3,4,5

    SDFIX:

    SDFix: Version 1.240
    Run by Omistaja on ti 24.02.2009 at 00:31

    Microsoft Windows XP [versio 5.1.2600]
    Running From: C:\Documents and Settings\Omistaja\Omat tiedostot\SDFix

    Checking Services :


    Restoring Default Security Values
    Restoring Default Hosts File

    Rebooting


    Checking Files :

    No Trojan Files Found






    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-02-24 00:45:56
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    scanning hidden registry entries ...

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0


    Remaining Services :




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
    "C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
    "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent"
    "C:\\Program Files\\Aspyr\\Guitar Hero III\\GH3.exe"="C:\\Program Files\\Aspyr\\Guitar Hero III\\GH3.exe:*:Disabled:Guitar Hero III"
    "C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="C:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe:*:Enabled:Windows Live Call"
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

    Remaining Files :



    Files with Hidden Attributes :

    Fri 13 Feb 2009 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

    Finished!



     
    Viimeksi muokattu: 24.02.2009
    jkl75, 24.02.2009
    #1
  2.  
Viestiketjun tila:
Viestiketju on suljettu.

Jaa tämä sivu