1. Tämä sivusto käyttää keksejä (cookie). Jatkamalla sivuston käyttämistä hyväksyt keksien käyttämisen. Lue lisää.

Combofix herjaa "Findstr: Ei voi avata tiedostoa temp01

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi smake 21.12.2008.

  1. smake

    smake Member

    Liittynyt:
    07.08.2007
    Viestejä:
    12
    Kiitokset:
    0
    Pisteet:
    11
    Eli bittorrent kikkailujen aikaan saannoksena tullut (Ask toolbar) oli sitkeässä...enkä sano varmaksi että poistinko jotain vahigossa. Miksi tuo Combofix herjaa???

    ComboFix 08-12-20.03 - Omistaja 2008-12-21 2:20:48.121 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1035.18.1023.668 [GMT 2:00]
    Sijainti: c:\documents and settings\Omistaja\Työpöytä\ComboFix.exe
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-11-21 to 2008-12-21 )))))))))))))))))
    .

    2008-12-21 01:44 . 2008-12-21 01:44 579,072 --a--c--- c:\windows\system32\dllcache\user32.dll
    2008-12-21 01:19 . 2008-12-21 02:18 <KANSIO> d-------- c:\program files\Mozilla Firefox 3.1 Beta 2
    2008-12-20 22:46 . 2008-12-20 22:46 4,724 --a------ c:\windows\system32\PerfStringBackup.TMP
    2008-12-20 22:36 . 2008-12-20 22:36 <KANSIO> d-------- c:\program files\A-Link
    2008-12-20 21:37 . 2008-12-20 21:37 <KANSIO> d-------- c:\program files\Common Files\Java(2)
    2008-12-20 21:37 . 2008-12-20 21:37 <KANSIO> d-------- c:\program files\Common Files\Java
    2008-12-20 21:36 . 2008-12-20 21:36 <KANSIO> d-------- c:\program files\TurnTool
    2008-12-20 21:36 . 2008-12-20 21:36 <KANSIO> d-------- c:\program files\DScaler5
    2008-12-20 21:34 . 2008-12-20 21:36 <KANSIO> d--hs---- C:\RECYCLER(13)
    2008-12-20 18:40 . 2008-12-20 21:37 <KANSIO> d-ahs---- C:\cmdcons(3)
    2008-12-20 14:54 . 2008-12-20 21:59 <KANSIO> d--hs---- C:\RECYCLER(12)
    2008-12-20 12:23 . 2008-12-20 21:59 <KANSIO> d-------- c:\documents and settings\Omistaja\Application Data\BitTorrent
    2008-12-20 12:22 . 2008-12-20 21:59 <KANSIO> d-------- c:\documents and settings\Omistaja\Application Data\DNA
    2008-12-17 21:08 . 2008-10-24 13:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
    2008-12-17 21:08 . 2008-10-15 18:37 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
    2008-12-17 21:01 . 2008-12-20 22:00 <KANSIO> d-------- C:\cmdcons(2)
    2008-12-17 20:38 . 2008-09-04 19:16 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
    2008-12-17 20:02 . 2008-12-20 22:20 <KANSIO> d--hs---- C:\RECYCLER(11)
    2008-12-17 19:30 . 2007-10-24 01:47 282,112 --a------ c:\windows\system32\TBDA5.tmp

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-12-21 00:16 --------- d-----w c:\documents and settings\Omistaja\Application Data\OpenOffice.org2
    2008-12-20 21:36 97,928 ----a-w c:\windows\system32\drivers\avgldx86.sys.prepare
    2008-12-20 21:36 26,824 ----a-w c:\windows\system32\drivers\avgmfx86.sys.prepare
    2008-12-20 20:53 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
    2008-12-20 20:22 --------- d-----w c:\program files\PartyGaming
    2008-12-20 19:36 --------- d--h--w c:\program files\InstallShield Installation Information
    2008-12-20 10:32 --------- d-----w c:\program files\eMule
    2008-12-17 19:15 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
    2008-12-17 19:15 --------- d-----w c:\program files\SpywareBlaster
    2008-12-03 17:52 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
    2008-12-03 17:52 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
    2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
    2008-10-23 12:38 286,720 ----a-w c:\windows\system32\gdi32.dll
    2008-10-23 12:38 286,720 ----a-w c:\windows\system32\gdi32(2)(3).dll
    2008-10-16 12:13 202,776 ----a-w c:\windows\system32\wuweb.dll
    2008-10-16 12:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
    2008-10-16 12:12 561,688 ----a-w c:\windows\system32\wuapi.dll
    2008-10-16 12:12 323,608 ----a-w c:\windows\system32\wucltui.dll
    2008-10-16 12:09 92,696 ----a-w c:\windows\system32\cdm.dll
    2008-10-16 12:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
    2008-10-16 12:09 43,544 ----a-w c:\windows\system32\wups2.dll
    2008-10-16 12:08 34,328 ----a-w c:\windows\system32\wups.dll
    2008-10-16 12:06 268,648 ----a-w c:\windows\system32\mucltui.dll
    2008-10-16 12:06 208,744 ----a-w c:\windows\system32\muweb.dll
    2008-10-16 01:01 666,112 ----a-w c:\windows\system32\wininet.dll
    2008-10-16 01:01 666,112 ----a-w c:\windows\system32\wininet(3)(2).dll
    2008-10-16 01:01 619,008 ----a-w c:\windows\system32\urlmon(3)(2).dll
    2008-10-15 16:37 337,408 ----a-w c:\windows\system32\netapi32(2)(2).dll
    2008-10-03 10:03 247,326 ----a-w c:\windows\system32\strmdll.dll
    2008-09-30 14:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CnxDslTaskBar"="c:\program files\A-Link\RoadRunner 32\CnxDslTb.exe" [2004-02-24 462848]
    "SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2002-07-13 106496]
    "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-03-03 335872]
    "HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-06-25 49152]
    "HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-10-23 233472]
    "HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-07-28 188416]
    "DeviceDiscovery"="c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe" [2003-05-21 229437]
    "SoundMan"="SOUNDMAN.EXE" [2004-01-09 c:\windows\SOUNDMAN.EXE]
    "ATIModeChange"="Ati2mdxx.exe" [2001-09-05 c:\windows\system32\Ati2mdxx.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

    c:\documents and settings\Omistaja\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 393216]

    c:\documents and settings\All Users\K„ynnist„-valikko\Ohjelmat\K„ynnistys\
    BTTray.lnk - c:\program files\Bluetooth\Bluetooth-ohjelmisto\BTTray.exe [2005-09-19 581693]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\eMule\\emule.exe"=
    "c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
    "c:\\WINDOWS\\system32\\dpnsvr.exe"=

    R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-05-29 96520]
    R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-05-29 902424]
    R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-05-29 282904]
    R2 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-05-29 75272]
    R3 CnxEtP;A-Link RoadRunner 32 USB ADSL LAN Adapter Filter Driver;c:\windows\system32\DRIVERS\CnxEtP.sys [2007-10-28 60288]
    R3 CnxEtU;A-Link RoadRunner 32 USB ADSL Device Driver;c:\windows\system32\DRIVERS\CnxEtU.sys [2007-10-28 646400]
    R3 CnxTgN;A-Link RoadRunner 32 USB ADSL LAN Adapter Driver;c:\windows\system32\DRIVERS\CnxTgN.sys [2007-10-28 103622]
    R3 CONAN;CONAN;c:\windows\system32\drivers\o2mmb.sys [2007-10-28 190465]
    R3 MbxStby;MbxStby;c:\windows\system32\drivers\MbxStby.sys [2007-10-28 5817]
    S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys [2008-08-15 38496]
    .
    .
    ------- Täydentävä tarkistus -------
    .
    uStart Page = hxxp://www.yle.fi/
    IE: Lähetä &Bluetooth-laitteeseen - c:\program files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
    FF - ProfilePath - c:\documents and settings\Omistaja\Application Data\Mozilla\Firefox\Profiles\40aworiy.default\
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - www.yle.fi
    FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101761&gct=&gc=1&q=
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-12-21 02:22:46
    Windows 5.1.2600 Service Pack 3 NTFS

    tarkistaa piilotettuja prosesseja ...

    tarkistaa piilotettuja käynnistysarvoja ...

    tarkistaa piilotettuja tiedostoja ...

    tarkistus on valmis
    piilotetut tiedostot: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\vsdatant]
    "ImagePath"=""
    .
    Valmistumisajankohta: 2008-12-21 2:24:02
    ComboFix-quarantined-files.txt 2008-12-21 00:23:43

    Ennen ajoa: 29 429 366 784 tavua vapaana
    Ajon jälkeen: 29,418,041,344 tavua vapaana

    130 --- E O F --- 2008-12-20 23:39:28

    ________________






    catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-12-21 01:52:59
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    scanning hidden registry entries ...

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
    "TracesProcessed"=dword:0000003e
    "TracesSuccessful"=dword:00000007

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0

    ___________________








    Logfile of random's system information tool 1.05 (written by random/random)
    Run by Omistaja at 2008-12-21 02:31:47
    Microsoft Windows XP Home Edition Service Pack 3
    System drive C: has 28 GB (49%) free of 57 GB
    Total RAM: 1023 MB (62% free)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 2:31:56, on 21.12.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\A-Link\RoadRunner 32\CnxDslTb.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\BTTray.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
    C:\WINDOWS\explorer.exe
    C:\Documents and Settings\Omistaja\Työpöytä\RSIT.exe
    C:\Program Files\Trend Micro\HijackThis\Omistaja.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yle.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\A-Link\RoadRunner 32\CnxDslTb.exe"
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
    O4 - Global Startup: BTTray.lnk = ?
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1193539921796
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

    --
    End of file - 4950 bytes

    ======Registry dump======

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "CnxDslTaskBar"=C:\Program Files\A-Link\RoadRunner 32\CnxDslTb.exe [2004-02-24 462848]
    "SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2004-01-09 65536]
    "SiSUSBRG"=C:\WINDOWS\SiSUSBrg.exe [2002-07-13 106496]
    "ATIModeChange"=C:\WINDOWS\system32\Ati2mdxx.exe [2001-09-05 28672]
    "ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe [2004-03-03 335872]
    "HP Software Update"=C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe [2003-06-25 49152]
    "HP Component Manager"=C:\Program Files\HP\hpcoretech\hpcmpmgr.exe [2003-10-23 233472]
    "HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe [2003-07-28 188416]
    "DeviceDiscovery"=C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-05-21 229437]

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

    C:\Documents and Settings\All Users\Käynnistä-valikko\Ohjelmat\Käynnistys
    BTTray.lnk - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\BTTray.exe

    C:\Documents and Settings\Omistaja\Käynnistä-valikko\Ohjelmat\Käynnistys
    OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
    Ati2evxx.dll []

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
    "dontdisplaylastusername"=0
    "legalnoticecaption"=
    "legalnoticetext"=
    "shutdownwithoutlogon"=1
    "undockwithoutlogon"=1

    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoDrives"=0
    "NoDriveAutoRun"=67108863
    "NoDriveTypeAutoRun"=323

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
    "NoDriveTypeAutoRun"=
    "NoDrives"=
    "NoDriveAutoRun"=

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
    "C:\Program Files\Windows Media Player\wmplayer.exe"="C:\Program Files\Windows Media Player\wmplayer.exe:*:Enabled:Windows Media Player"
    "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "C:\Program Files\AVG\AVG8\avgupd.exe"="C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe"
    "C:\Program Files\AVG\AVG8\avgemc.exe"="C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe"
    "C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:*:Disabled:Microsoft DirectPlay8 Server"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"

    ======List of files/folders created in the last 1 months======

    2008-12-21 02:31:47 ----D---- C:\rsit
    2008-12-21 02:25:01 ----SHD---- C:\RECYCLER
    2008-12-21 02:24:05 ----D---- C:\WINDOWS\temp
    2008-12-21 02:24:04 ----A---- C:\ComboFix.txt
    2008-12-21 02:20:21 ----A---- C:\WINDOWS\zip.exe
    2008-12-21 02:20:21 ----A---- C:\WINDOWS\VFIND.exe
    2008-12-21 02:20:21 ----A---- C:\WINDOWS\SWXCACLS.exe
    2008-12-21 02:20:21 ----A---- C:\WINDOWS\SWSC.exe
    2008-12-21 02:20:21 ----A---- C:\WINDOWS\SWREG.exe
    2008-12-21 02:20:21 ----A---- C:\WINDOWS\sed.exe
    2008-12-21 02:20:21 ----A---- C:\WINDOWS\NIRCMD.exe
    2008-12-21 02:20:21 ----A---- C:\WINDOWS\grep.exe
    2008-12-21 02:20:21 ----A---- C:\WINDOWS\fdsv.exe
    2008-12-21 02:20:17 ----D---- C:\Qoobox
    2008-12-21 01:24:04 ----RASHD---- C:\cmdcons
    2008-12-21 01:19:06 ----D---- C:\Program Files\Mozilla Firefox 3.1 Beta 2
    2008-12-21 01:07:33 ----N---- C:\WINDOWS\SchedLgU.Txt
    2008-12-20 22:46:21 ----A---- C:\WINDOWS\system32\PerfStringBackup.TMP
    2008-12-20 22:36:43 ----D---- C:\Program Files\A-Link
    2008-12-20 22:23:30 ----D---- C:\Program Files\Common Files\Services
    2008-12-20 21:37:08 ----D---- C:\Program Files\Common Files\Java(2)
    2008-12-20 21:37:08 ----D---- C:\Program Files\Common Files\Java
    2008-12-20 21:36:56 ----D---- C:\Program Files\DScaler5
    2008-12-20 21:36:55 ----D---- C:\Program Files\TurnTool
    2008-12-20 21:34:31 ----SHD---- C:\RECYCLER(13)
    2008-12-20 18:40:36 ----ASHD---- C:\cmdcons(3)
    2008-12-20 14:54:33 ----SHD---- C:\RECYCLER(12)
    2008-12-20 12:23:03 ----D---- C:\Documents and Settings\Omistaja\Application Data\BitTorrent
    2008-12-20 12:22:41 ----D---- C:\Documents and Settings\Omistaja\Application Data\DNA
    2008-12-18 00:40:23 ----HDC---- C:\WINDOWS\$NtUninstallKB960714$
    2008-12-17 21:01:26 ----A---- C:\Boot.bak
    2008-12-17 21:01:15 ----D---- C:\cmdcons(2)
    2008-12-17 20:02:17 ----SHD---- C:\RECYCLER(11)
    2008-12-17 19:51:22 ----DC---- C:\WINDOWS\ie7
    2008-12-17 19:51:08 ----DC---- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
    2008-12-17 19:50:52 ----DC---- C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
    2008-12-17 19:30:30 ----A---- C:\WINDOWS\system32\TBDA5.tmp
    2008-12-12 03:10:00 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
    2008-12-12 03:09:46 ----HDC---- C:\WINDOWS\$NtUninstallKB958215$
    2008-12-12 03:08:07 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
    2008-12-12 03:08:01 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
    2008-12-12 03:07:53 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$

    ======List of files/folders modified in the last 1 months======

    2008-12-21 02:24:06 ----D---- C:\WINDOWS\system32
    2008-12-21 02:24:05 ----D---- C:\WINDOWS
    2008-12-21 02:22:48 ----A---- C:\WINDOWS\system.ini
    2008-12-21 02:22:07 ----D---- C:\WINDOWS\system32\drivers
    2008-12-21 02:22:05 ----D---- C:\WINDOWS\AppPatch
    2008-12-21 02:22:05 ----D---- C:\Program Files\Common Files
    2008-12-21 02:16:20 ----D---- C:\Documents and Settings\Omistaja\Application Data\OpenOffice.org2
    2008-12-21 02:10:22 ----D---- C:\Documents and Settings
    2008-12-21 01:56:08 ----D---- C:\WINDOWS\Debug
    2008-12-21 01:52:51 ----D---- C:\WINDOWS\Prefetch
    2008-12-21 01:44:28 ----RSHDC---- C:\WINDOWS\system32\dllcache
    2008-12-21 01:39:28 ----HD---- C:\WINDOWS\inf
    2008-12-21 01:39:21 ----D---- C:\WINDOWS\system32\CatRoot2
    2008-12-21 01:37:02 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
    2008-12-21 01:36:54 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
    2008-12-21 01:36:36 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
    2008-12-21 01:36:26 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
    2008-12-21 01:35:24 ----SHD---- C:\WINDOWS\Installer
    2008-12-21 01:35:24 ----HD---- C:\Config.Msi
    2008-12-21 01:35:23 ----D---- C:\WINDOWS\WinSxS
    2008-12-21 01:31:07 ----D---- C:\WINDOWS\erdnt
    2008-12-21 01:24:11 ----RASH---- C:\boot.ini
    2008-12-21 01:19:06 ----RD---- C:\Program Files
    2008-12-20 23:36:49 ----A---- C:\WINDOWS\system32\avgrsstx.dll.prepare
    2008-12-20 22:53:18 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
    2008-12-20 22:49:01 ----D---- C:\WINDOWS\system32\CatRoot
    2008-12-20 22:42:17 ----D---- C:\WINDOWS\system32\config
    2008-12-20 22:42:03 ----D---- C:\WINDOWS\system32\wbem
    2008-12-20 22:42:03 ----D---- C:\WINDOWS\Registration
    2008-12-20 22:41:26 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
    2008-12-20 22:41:21 ----HDC---- C:\WINDOWS\$NtUninstallKB956390$
    2008-12-20 22:41:00 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
    2008-12-20 22:41:00 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
    2008-12-20 22:40:59 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
    2008-12-20 22:36:44 ----SHD---- C:\RECYCLER(5)
    2008-12-20 22:36:18 ----SHD---- C:\RECYCLER(9)
    2008-12-20 22:33:38 ----SHD---- C:\RECYCLER(10)
    2008-12-20 22:22:10 ----D---- C:\Program Files\PartyGaming
    2008-12-20 22:20:09 ----HD---- C:\WINDOWS\$hf_mig$
    2008-12-20 22:20:07 ----D---- C:\Program Files\Internet Explorer
    2008-12-20 21:36:50 ----D---- C:\Program Files\Common Files\Microsoft Shared
    2008-12-20 21:36:47 ----HD---- C:\Program Files\InstallShield Installation Information
    2008-12-20 19:55:53 ----D---- C:\WINDOWS\Help
    2008-12-20 12:32:02 ----D---- C:\Program Files\eMule
    2008-12-17 21:15:49 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
    2008-12-17 21:15:45 ----D---- C:\Program Files\SpywareBlaster
    2008-12-17 20:35:58 ----RSD---- C:\WINDOWS\assembly
    2008-12-17 19:53:14 ----D---- C:\WINDOWS\system32\fi-fi
    2008-12-17 19:53:03 ----D---- C:\WINDOWS\Media
    2008-12-12 19:03:17 ----A---- C:\WINDOWS\system32\mshtml.dll
    2008-12-09 15:24:38 ----A---- C:\WINDOWS\system32\MRT.exe

    ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R1 AFS2K;AFS2k; C:\WINDOWS\system32\drivers\AFS2K.sys [2007-10-28 82380]
    R1 AmdK8;AMD Athlon64 Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2003-11-07 37888]
    R1 AvgLdx86;AVG AVI Loader Driver x86; C:\WINDOWS\System32\Drivers\avgldx86.sys [2008-05-29 96520]
    R1 AvgMfx86;AVG On-access Scanner Minifilter Driver x86; C:\WINDOWS\System32\Drivers\avgmfx86.sys [2008-05-29 26184]
    R1 wpsdrvnt;wpsdrvnt; \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys []
    R2 AvgTdiX;AVG8 Network Redirector; C:\WINDOWS\System32\Drivers\avgtdix.sys [2008-05-29 75272]
    R2 BTSERIAL;Bluetooth Serial Driver; \??\C:\WINDOWS\system32\drivers\btserial.sys []
    R2 BTSLBCSP;Bluetooth Port Client Driver; \??\C:\WINDOWS\system32\drivers\btslbcsp.sys []
    R2 irda;IrDA-protokolla; C:\WINDOWS\System32\DRIVERS\irda.sys [2008-04-13 88192]
    R2 wg3n;SyGate for NT, wg3n; C:\WINDOWS\SYSTEM32\Drivers\wg3n.sys [2004-10-16 14568]
    R2 wg4n;SyGate for NT, wg4n; C:\WINDOWS\SYSTEM32\Drivers\wg4n.sys [2004-10-16 14568]
    R2 wg5n;SyGate for NT, wg5n; C:\WINDOWS\SYSTEM32\Drivers\wg5n.sys [2004-10-16 14568]
    R2 wg6n;SyGate for NT, wg6n; C:\WINDOWS\SYSTEM32\Drivers\wg6n.sys [2004-10-16 14568]
    R3 ALCXSENS;Service for WDM 3D Audio Driver; C:\WINDOWS\system32\drivers\ALCXSENS.SYS [2003-12-12 391424]
    R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-01-10 601100]
    R3 Arp1394;1394 ARP -asiakasprotokolla; C:\WINDOWS\System32\DRIVERS\arp1394.sys [2008-04-13 60800]
    R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2004-03-03 679936]
    R3 BTKRNL;Bluetooth-väyläluetteloija; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2005-09-20 1342122]
    R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\WINDOWS\System32\DRIVERS\CmBatt.sys [2008-04-13 13952]
    R3 CnxEtP;A-Link RoadRunner 32 USB ADSL LAN Adapter Filter Driver; C:\WINDOWS\System32\DRIVERS\CnxEtP.sys [2004-01-29 60288]
    R3 CnxEtU;A-Link RoadRunner 32 USB ADSL Device Driver; C:\WINDOWS\System32\DRIVERS\CnxEtU.sys [2004-01-29 646400]
    R3 CnxTgN;A-Link RoadRunner 32 USB ADSL LAN Adapter Driver; C:\WINDOWS\System32\DRIVERS\CnxTgN.sys [2004-02-24 103622]
    R3 CONAN;CONAN; C:\WINDOWS\system32\drivers\o2mmb.sys [2003-10-28 190465]
    R3 hidusb;Microsoft HID -luokkaohjain; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
    R3 MbxStby;MbxStby; C:\WINDOWS\system32\drivers\MbxStby.sys [2003-08-26 5817]
    R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-18 16128]
    R3 mouhid;Hiiren HID-ohjain; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2003-04-25 12160]
    R3 Mtlmnt5;Mtlmnt5; C:\WINDOWS\system32\DRIVERS\Mtlmnt5.sys [2003-10-29 226288]
    R3 NIC1394;1394-verkko-ohjain; C:\WINDOWS\System32\DRIVERS\nic1394.sys [2008-04-13 61824]
    R3 NSCIRDA;NSC-infrapunalaiteohjain; C:\WINDOWS\System32\DRIVERS\nscirda.sys [2008-04-13 28672]
    R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\System32\DRIVERS\rasirda.sys [2001-08-17 19584]
    R3 SISNIC;SiS PCI Fast Ethernet Adapter Driver; C:\WINDOWS\System32\DRIVERS\sisnic.sys [2004-08-04 32768]
    R3 Slntamr;SmartLink AMR_PCI Driver; C:\WINDOWS\system32\DRIVERS\slntamr.sys [2003-11-09 566256]
    R3 SlWdmSup;SlWdmSup; C:\WINDOWS\system32\DRIVERS\SlWdmSup.sys [2003-10-29 15712]
    R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2008-04-13 30208]
    R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
    R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2008-04-13 17152]
    S1 kbdhid;Näppäimistön HID-ohjain; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
    S3 btaudio;Bluetooth-äänilaite; C:\WINDOWS\system32\drivers\btaudio.sys [2005-09-20 401664]
    S3 BTDriver;Bluetooth-näennäistietoliikenneohjain; C:\WINDOWS\system32\DRIVERS\btport.sys [2005-09-19 30363]
    S3 BTWDNDIS;Bluetooth-lähiverkkopalvelin; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2005-09-19 148040]
    S3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2005-09-19 56648]
    S3 catchme;catchme; \??\C:\ComboFix\catchme.sys []
    S3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
    S3 Mtlstrm;Mtlstrm; C:\WINDOWS\system32\DRIVERS\Mtlstrm.sys [2003-11-05 1299976]
    S3 NtMtlFax;NtMtlFax; C:\WINDOWS\system32\DRIVERS\NtMtlFax.sys [2003-10-29 180368]
    S3 SlNtHal;SlNtHal; C:\WINDOWS\system32\DRIVERS\Slnthal.sys [2003-10-29 87656]
    S3 usbprint;Microsoft USB PRINTER -luokka; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
    S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
    S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
    S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
    S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
    S4 vsdatant;vsdatant; C:\WINDOWS\system32\drivers\vsdatant.sys []

    ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

    R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-05-29 611664]
    R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2004-03-03 397312]
    R2 avg8emc;AVG8 E-mail Scanner; C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-05-29 902424]
    R2 avg8wd;AVG8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-05-29 282904]
    R2 btwdins;Bluetooth Service; C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe [2005-09-19 258103]
    R2 Irmon;Infrapunavalvonta; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
    R2 SmcService;Sygate Personal Firewall; C:\Program Files\Sygate\SPF\smc.exe [2004-10-16 2577632]
    S2 SLService;SmartLinkService; C:\WINDOWS\system32\slserv.exe [2003-10-29 45056]
    S3 aspnet_state;ASP.NET-tilapalvelu; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-04-13 33632]
    S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-04-13 68952]
    S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2006-10-20 36864]
    S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
    S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2006-10-30 741376]
    S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
    S3 WMPNetworkSvc;Windows Media Playerin verkkojakamispalvelu; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-11-15 913920]
    S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
    S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2006-10-30 122880]

    -----------------EOF-----------------


    ________________

    Tuossa Combofix, SDFiks ja RSIT logit
    MBAM ja AVG skannaus boottaa koneen, mutta se on lähempänä ominaisuutta kuin vikaa (suora lainaus myyjältä)...

    Kiitokset jo etukäteen :)
     
    smake, 21.12.2008
    #1
  2.  
  3. smake

    smake Member

    Liittynyt:
    07.08.2007
    Viestejä:
    12
    Kiitokset:
    0
    Pisteet:
    11
    Hjt unehtu...

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 2:56:51, on 21.12.2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgemc.exe
    C:\Program Files\A-Link\RoadRunner 32\CnxDslTb.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
    C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\BTTray.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
    C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
    C:\WINDOWS\explorer.exe
    C:\Program Files\Mozilla Firefox 3.1 Beta 2\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yle.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\A-Link\RoadRunner 32\CnxDslTb.exe"
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
    O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
    O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
    O4 - Global Startup: BTTray.lnk = ?
    O8 - Extra context menu item: Lähetä &Bluetooth-laitteeseen - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie_ctx.htm
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\btsendto_ie.htm
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1193539921796
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
    O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Bluetooth\Bluetooth-ohjelmisto\bin\btwdins.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

    --
    End of file - 4955 bytes
     
    smake, 21.12.2008
    #2
  4. Hujo

    Hujo Guest

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi

    ===============

    Scannaa koneesi Kaspersky Online Scannerin

    Ohjelman käynnistyessä kysytään sallitaanko ActiveX -komponentin asentamisen Kasperskyltä, klikkaa Kyllä.
    " Ohjelma käynnistyy ja aloittaa viimeisimpien tunnistetiedostojen lataamisen.
    " Kun skanneri on asennettu ja tunnistetiedot ladattu, klikkaa Next.
    " Klikkaa nyt asetuksia, Scan Settings
    " Tarkista asetuksista, että seuraavat ovat valittuina:
    o Scan using the following Anti-Virus database:
    + Extended (Jos valittavissa, muuten valitse Standard)
    o Scan Options:
    + Scan Archives
    + Scan Mail Bases
    " Klikkaa OK
    " Nyt valitse "select a target to scan" otsikon alta Oma Tietokone, My Computer
    " Skannaus vie aikaa, joten ole kärsivällinen. Kun skannaus on valmis saat ilmoituksen, jos koneesi on saastunut.
    " Klikkaa nyt Save as Text-painiketta.
    " Tallenna tiedosto työpöydällesi.
    " Mikäli haluat jatkaa asian käsittelyä foorumissa niin kopioi tiedoston sisältö viestiisi.
     
    Moderaattorin viimeksi muokkaama: 22.12.2008
    Hujo, 22.12.2008
    #3
  5. smake

    smake Member

    Liittynyt:
    07.08.2007
    Viestejä:
    12
    Kiitokset:
    0
    Pisteet:
    11
    Monday, December 22, 2008
    Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
    Kaspersky Online Scanner 7 version: 7.0.25.0
    Program database last update: Monday, December 22, 2008 17:03:33
    Records in database: 1500983
    Scan settings
    Scan using the following database extended
    Scan archives yes
    Scan mail databases yes
    Scan area My Computer
    C:\
    D:\
    Scan statistics
    Files scanned 110300
    Threat name 0
    Infected objects 0
    Suspicious objects 0
    Duration of the scan 01:45:51

    No malware has been detected. The scan area is clean.
    The selected area was scanned.

    ____________________



    Malwarebytes' Anti-Malware 1.31
    Tietokantaversio: 1535
    Windows 5.1.2600 Service Pack 3

    23.12.2008 13:02:32
    mbam-log-2008-12-23 (13-02-32).txt

    Tarkistustyyppi: Pikatarkistus
    Tarkistetut kohteet: 46516
    Kulunut aika: 6 minute(s), 27 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)


    Tuossa logit, mbam sammuttaa koneen itestään siksi en saa täydestä tarkistuksesta raporttia...kone toimii muuten ihan ok, mutta ComboFix herjaa edelleen?
     
    smake, 23.12.2008
    #4

Jaa tämä sivu