Backdoor:win32/rbot.gen ei lähde koneelta(Hjt-logi)

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi qiac 21.04.2008.

  1. qiac

    qiac Member

    Liittynyt:
    21.04.2008
    Viestejä:
    12
    Kiitokset:
    0
    Pisteet:
    11
    Hei

    Windowsin haittaohjelmien postotyökalu löytää viruksen Backdoor:win32/rbot.gen koneeltani ja onnistuu poistamaan sen, mutta jos ajan työkälun uudestaan myöhemmin sama virus löytyy joka kerta. Norman antivirus, Ad-aware tai windown defender eivät kyseistä virusta löydä. Eli jos joku osaisi katsoa ja auttaa Hjt-login kautta.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:46:12, on 21.4.2008
    Platform: Windows Vista SP1 (WinNT 6.00.1905)
    MSIE: Internet Explorer v7.00 (7.00.6001.18000)
    Boot mode: Normal

    Running processes:
    C:\Windows\System32\smss.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\csrss.exe
    C:\Windows\system32\services.exe
    C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\winlogon.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\Ati2evxx.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Norman\Npm\bin\ELOGSVC.EXE
    C:\Program Files\Norman\Npm\Bin\Zanda.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Windows\system32\Ati2evxx.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
    C:\Program Files\C&E\OSD\osd.exe
    C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
    C:\Windows\system32\taskeng.exe
    C:\Windows\system32\PnkBstrA.exe
    C:\Windows\system32\svchost.exe
    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    C:\Windows\system32\svchost.exe
    C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe
    C:\Program Files\Norman\Npm\Bin\Zlh.exe
    C:\Windows\System32\svchost.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\Microsoft IntelliType Pro\itype.exe
    C:\Program Files\Microsoft IntelliPoint\ipoint.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
    C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    C:\Program Files\Norman\Nvc\bin\nvcoas.exe
    C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
    C:\Program Files\Norman\Nvc\BIN\NIP.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\NetLimiter 2 Pro\NLClient.exe
    C:\Program Files\Windows Sidebar\sidebar.exe
    C:\Program Files\Norman\Nvc\bin\cclaw.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Windows\system32\svehost.exe
    C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    C:\Pelit\Steam\Steam.exe
    C:\Program Files\Common Files\Steam\SteamService.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Windows\system32\conime.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Windows\system32\wbem\wmiprvse.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe
    O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe
    O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
    O4 - HKLM\..\Run: [IaNvSrv] C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe
    O4 - HKLM\..\Run: [OSD] C:\Program Files\C&E\OSD\osd.exe
    O4 - HKLM\..\Run: [recinfo825] c:\RecInfo\RecInfo.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [recinfo] RecInfo.exe
    O4 - HKLM\..\Run: [Norman ZANDA] C:\Program Files\Norman\Npm\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
    O4 - HKLM\..\Run: [Microsoft Updates] svehost.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\RunServices: [Microsoft Updates] svehost.exe
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [fsc-reg] C:\ProgramData\fsc-reg\fscreg.exe 20080326
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe"
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'Paikallinen palvelu')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'Verkkopalvelu')
    O8 - Extra context menu item: V&ie Microsoft Exceliin - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Lähetä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: Läh&etä OneNoteen - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O13 - Gopher Prefix:
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Norman eLogger service 6 (eLoggerSvc6) - Norman ASA - C:\Program Files\Norman\Npm\bin\ELOGSVC.EXE
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
    O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\Program Files\Norman\Npm\bin\NJEEVES.EXE
    O23 - Service: Norman ZANDA - Norman ASA - C:\Program Files\Norman\Npm\Bin\Zanda.exe
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Program Files\Norman\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman ASA - C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: OsdService - Unknown owner - C:\Program Files\C&E\OSD\OsdService\OsdService.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
    O23 - Service: Fujitsu Siemens Computers Diagnostic Testhandler (TestHandler) - Fujitsu Siemens Computers - C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe

    --
    End of file - 10158 bytes
     
    qiac, 21.04.2008
    #1
  2.  
  3. Hujo

    Hujo Guest

    scannaa hjt:llä merkkaa paina Fix checked

    O4 - HKLM\..\Run: [Microsoft Updates] svehost.exe

    =============

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, 21.04.2008
    #2
  4. qiac

    qiac Member

    Liittynyt:
    21.04.2008
    Viestejä:
    12
    Kiitokset:
    0
    Pisteet:
    11
    Täss combofix loki

    ComboFix 08-04-20.5 - --- 2008-04-21 16:49:06.1 - NTFSx86
    Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1035.18.965 [GMT 3:00]
    Running from: C:\Users\---\Desktop\ComboFix.exe
    * Created a new restore point
    * Resident AV is active

    .

    (((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Windows\system32\drivers\npf.sys
    C:\Windows\system32\packet.dll
    C:\Windows\system32\svehost.exe
    C:\Windows\system32\wpcap.dll

    .
    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-03-21 to 2008-04-21 )))))))))))))))))
    .

    2008-04-21 15:29 . 2008-04-21 15:29 <KANSIO> d-------- C:\Windows\Sun
    2008-04-20 18:11 . 2008-04-20 18:11 <KANSIO> d-------- C:\Program Files\Trend Micro
    2008-04-20 12:01 . 2008-04-20 12:27 <KANSIO> d-------- C:\Users\All Users\Spybot - Search & Destroy
    2008-04-20 12:01 . 2008-04-20 12:27 <KANSIO> d-------- C:\ProgramData\Spybot - Search & Destroy
    2008-04-20 12:01 . 2008-04-20 12:01 <KANSIO> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-04-19 18:27 . 2008-04-19 18:27 <KANSIO> d-------- C:\PerfLogs
    2008-04-19 18:13 . 2008-04-19 17:44 152,576 --a------ C:\Windows\System32\SPWizUI.dll
    2008-04-19 18:13 . 2008-04-19 17:44 47,560 --a------ C:\Windows\System32\SPReview.exe
    2008-04-19 18:01 . 2008-01-18 23:33 193,024 --a------ C:\Windows\System32\recdisc.exe
    2008-04-19 18:01 . 2008-01-18 23:36 6,656 --a------ C:\Windows\System32\sdspres.dll
    2008-04-19 18:00 . 2008-01-18 23:33 599,552 --a------ C:\Windows\System32\vsp1cln.exe
    2008-04-19 18:00 . 2008-01-18 23:36 142,336 --a------ C:\Windows\System32\spp.dll
    2008-04-19 18:00 . 2008-01-18 23:36 28,160 --a------ C:\Windows\System32\sxproxy.dll
    2008-04-19 17:56 . 2008-01-18 23:34 6,103,040 --a------ C:\Windows\System32\chtbrkr.dll
    2008-04-19 17:52 . 2008-01-18 23:33 44,032 --a------ C:\Windows\System32\cbsra.exe
    2008-04-19 17:44 . 2008-04-19 18:15 196,608 --a------ C:\Windows\SPInstall.etl
    2008-04-09 12:24 . 2008-02-22 05:50 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
    2008-04-09 12:24 . 2008-02-22 08:01 826,880 --a------ C:\Windows\System32\wininet.dll
    2008-04-09 12:24 . 2008-02-22 07:57 295,936 --a------ C:\Windows\System32\gdi32.dll
    2008-04-04 11:32 . 2008-04-21 14:15 54,156 --ah----- C:\Windows\QTFont.qfn
    2008-04-04 11:32 . 2008-04-04 11:32 1,409 --a------ C:\Windows\QTFont.for
    2008-04-04 11:31 . 2008-04-04 11:32 <KANSIO> d-------- C:\Program Files\iTunes
    2008-04-04 11:31 . 2008-04-04 11:31 <KANSIO> d-------- C:\Program Files\iPod
    2008-04-04 11:30 . 2008-04-04 11:31 <KANSIO> d-------- C:\Program Files\QuickTime
    2008-03-31 16:15 . 2008-04-06 16:51 <KANSIO> d-------- C:\Program Files\Common Files\Steam
    2008-03-30 22:33 . 2008-03-30 22:53 82,774 --a------ C:\Windows\Uninstall Jade Empire.exe
    2008-03-29 13:59 . 2008-03-29 13:59 283 --a------ C:\Windows\game.ini
    2008-03-28 23:37 . 2008-03-28 23:37 90,112 --a------ C:\Windows\System32\QuickTimeVR.qtx
    2008-03-28 23:37 . 2008-03-28 23:37 57,344 --a------ C:\Windows\System32\QuickTime.qts
    2008-03-25 23:09 . 2008-04-21 15:29 <KANSIO> d-------- C:\Users\---\e-Safekey

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-04-21 12:21 --------- d-----w C:\Program Files\Java
    2008-04-21 11:15 --------- d---a-w C:\ProgramData\TEMP
    2008-04-21 11:15 --------- d-----w C:\Program Files\Norman
    2008-04-20 15:18 --------- d-----w C:\Users\---\AppData\Roaming\uTorrent
    2008-04-20 14:52 --------- d-----w C:\Program Files\uTorrent
    2008-04-20 14:51 --------- d-----w C:\Program Files\RevConnect
    2008-04-19 15:35 174 --sha-w C:\Program Files\desktop.ini
    2008-04-19 15:28 --------- d-----w C:\Program Files\Windows Sidebar
    2008-04-19 15:28 --------- d-----w C:\Program Files\Windows Photo Gallery
    2008-04-19 15:28 --------- d-----w C:\Program Files\Windows Mail
    2008-04-19 15:28 --------- d-----w C:\Program Files\Windows Defender
    2008-04-19 15:28 --------- d-----w C:\Program Files\Windows Calendar
    2008-04-19 15:20 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
    2008-04-19 15:19 82,432 ----a-w C:\Windows\System32\axaltocm.dll
    2008-04-14 14:25 --------- d-----w C:\Users\---\AppData\Roaming\ImgBurn
    2008-04-09 10:27 --------- d-----w C:\ProgramData\Microsoft Help
    2008-04-04 11:42 --------- d-----w C:\Program Files\Opera
    2008-03-30 18:56 --------- d-----w C:\Users\---\AppData\Roaming\Bioshock
    2008-03-30 18:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-03-30 18:31 --------- d-----w C:\ProgramData\Media Center Programs
    2008-03-30 18:31 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-03-13 00:13 43,520 ----a-w C:\Windows\System32\CmdLineExt03.dll
    2008-03-12 23:52 --------- d-----w C:\Users\---\AppData\Roaming\BSplayer PRO
    2008-03-12 23:52 --------- d-----w C:\Program Files\Webteh
    2008-03-12 13:37 --------- d-----w C:\Program Files\Common Files\Adobe
    2008-03-09 11:43 --------- d-----w C:\ProgramData\Trymedia
    2008-03-02 11:20 --------- d-----w C:\Program Files\ImgBurn
    2008-02-29 07:14 19,000 ----a-w C:\Windows\System32\kd1394.dll
    2008-02-29 07:11 988,216 ----a-w C:\Windows\System32\winload.exe
    2008-02-29 07:11 927,288 ----a-w C:\Windows\System32\winresume.exe
    2008-02-29 06:53 46,592 ----a-w C:\Windows\System32\setbcdlocale.dll
    2008-02-29 06:53 40,960 ----a-w C:\Windows\System32\srclient.dll
    2008-02-29 06:53 378,368 ----a-w C:\Windows\System32\srcore.dll
    2008-02-29 06:35 6,656 ----a-w C:\Windows\System32\kbd106n.dll
    2008-02-29 04:21 2,032,128 ----a-w C:\Windows\System32\win32k.sys
    2008-02-29 04:12 318,464 ----a-w C:\Windows\System32\rstrui.exe
    2008-02-29 04:12 14,848 ----a-w C:\Windows\System32\srdelayed.exe
    2008-02-23 00:21 --------- d-----w C:\Users\---\AppData\Roaming\Sports Interactive
    2008-02-23 00:04 --------- d--h--w C:\Program Files\Zero G Registry
    2008-02-22 05:05 615,992 ----a-w C:\Windows\System32\ci.dll
    2008-02-14 01:03 48,640 ----a-w C:\Windows\System32\davclnt.dll
    2008-01-31 21:53 86,016 ----a-w C:\Windows\System32\OpenAL32.dll
    2008-01-31 21:53 262,144 ----a-w C:\Windows\System32\wrap_oal.dll
    2008-01-29 09:02 107,368 ----a-w C:\Windows\System32\GEARAspi.dll
    2008-01-27 12:19 7,680 ----a-w C:\Windows\System32\ff_vfw.dll
    2007-12-27 19:30 22,328 ----a-w C:\Users\---\AppData\Roaming\PnkBstrK.sys
    .

    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-18 23:33 1233920]
    "fsc-reg"="C:\ProgramData\fsc-reg\fscreg.exe" [2007-11-08 12:05 470288]
    "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-18 23:33 125952]
    "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2007-12-19 23:13 486856]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2008-01-18 23:38 1008184]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-05-10 18:10 4468736 C:\Windows\RtHDVCpl.exe]
    "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 19:31 630784]
    "JMB36X IDE Setup"="C:\Windows\RaidTool\xInsIDE.exe" [2007-03-20 15:36 36864]
    "IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-07-24 19:02 174616]
    "IaNvSrv"="C:\Program Files\Intel\Intel Matrix Storage Manager\OROM\IaNvSrv\IaNvSrv.exe" [2007-07-24 19:02 33304]
    "OSD"="C:\Program Files\C&E\OSD\osd.exe" [2007-09-21 03:32 561152]
    "recinfo825"="c:\RecInfo\RecInfo.exe" [2007-10-23 15:52 2764800]
    "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-02-26 21:46 153136]
    "recinfo"="RecInfo.exe" []
    "Norman ZANDA"="C:\Program Files\Norman\Npm\bin\ZLH.exe" [2007-08-09 15:40 183352]
    "itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-11-21 18:08 813912]
    "IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-08-31 13:01 1037736]
    "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 08:00 33648]
    "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35 90112]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
    "Microsoft Updates"="svehost.exe" []

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.mkdmp3enc"= C:\PROGRA~1\CYBERL~1\PowerDV\Kernel\Burner\MKDMP3Enc.ACM
    "msacm.avis"= ff_acm.acm

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3384487556-148120472-1223521730-1000]
    "EnableNotificationsRef"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\AuthorizedApplications\List]
    "C:\\Program Files\\FlashFXP\\FlashFXP.exe"= C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "{6125539A-503A-42BE-AE68-86F16A9BCFE0}"= C:\Program Files\CyberLink\PowerDV\PowerDV.exe:CyberLink PowerDV
    "TCP Query User{88C2A457-0B1A-4E5C-8CEB-D085F3720854}C:\\pelit\\star wars kotor ii\\swupdate.exe"= UDP:C:\pelit\star wars kotor ii\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program
    "UDP Query User{AE0FC0F9-B5C5-44B4-80AF-3FE28D266DDF}C:\\pelit\\star wars kotor ii\\swupdate.exe"= TCP:C:\pelit\star wars kotor ii\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program
    "TCP Query User{3D51B28A-E0CE-495E-B237-D9A64F4D474A}C:\\pelit\\star wars knights of the old republic ii\\swupdate.exe"= UDP:C:\pelit\star wars knights of the old republic ii\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program
    "UDP Query User{7245988E-0613-4C0A-84B8-5E2DA5A3FEBF}C:\\pelit\\star wars knights of the old republic ii\\swupdate.exe"= TCP:C:\pelit\star wars knights of the old republic ii\swupdate.exe:Star Wars: Knights of the Old Republic II: The Sith Lords Update Program
    "{981F8CCC-9397-4440-97B8-EEF1F9750B85}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
    "{243A47F9-EEB9-470B-B802-E217C2FB31BD}"= UDP:C:\Windows\System32\PnkBstrA.exe:pnkBstrA
    "{FFDC794A-D149-42DD-832C-CEA76D740C45}"= TCP:C:\Windows\System32\PnkBstrA.exe:pnkBstrA
    "{F5F7DB5F-5887-47AC-A3BE-A10A426AB547}"= UDP:C:\Windows\System32\PnkBstrB.exe:pnkBstrB
    "{34E382AC-C132-45F5-9A2C-214ED3DE7914}"= TCP:C:\Windows\System32\PnkBstrB.exe:pnkBstrB
    "{4FD2FEA0-A9AA-4C6C-A9A1-E4B4364F1513}"= UDP:C:\Pelit\Crysis\Bin32\Crysis.exe:Crysis_32
    "{5CF798ED-3246-4855-8291-4D8AE66C55FA}"= TCP:C:\Pelit\Crysis\Bin32\Crysis.exe:Crysis_32
    "{581A5A30-EF36-4EE1-A69A-BE326294772B}"= UDP:C:\Pelit\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
    "{C16E025A-33CB-426C-B6AA-8A1CA8A74149}"= TCP:C:\Pelit\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
    "{46E2844A-799F-42B7-B275-76AFBA56955A}"= UDP:C:\Pelit\World in Conflict\wic.exe:World in Conflict
    "{8AF01BA4-6E45-452C-A113-00AD8536BF3A}"= TCP:C:\Pelit\World in Conflict\wic.exe:World in Conflict
    "{E5944370-2B21-412D-B80B-6F6EE162F8A9}"= UDP:C:\Pelit\World in Conflict\wic_online.exe:World in Conflict - Online Only
    "{D964305E-922C-4EFD-8935-700707F82784}"= TCP:C:\Pelit\World in Conflict\wic_online.exe:World in Conflict - Online Only
    "{78011E16-A9D3-47F8-940B-6E6DD28C1C5D}"= UDP:C:\Pelit\World in Conflict\wic_ds.exe:World in Conflict - Dedicated Server
    "{CE78C257-E6C8-4AB1-9869-74AB26FDCC26}"= TCP:C:\Pelit\World in Conflict\wic_ds.exe:World in Conflict - Dedicated Server
    "TCP Query User{00ABFFE4-C070-43EF-A377-1CD1286EE363}C:\\program files\\revconnect\\dcplusplus.exe"= UDP:C:\program files\revconnect\dcplusplus.exe:DC++
    "UDP Query User{AA400803-B8E1-4E87-AF8D-0E863604114B}C:\\program files\\revconnect\\dcplusplus.exe"= TCP:C:\program files\revconnect\dcplusplus.exe:DC++
    "TCP Query User{03197276-B259-4475-95F8-C0A348CA37FA}C:\\program files\\utorrent\\utorrent.exe"= UDP:C:\program files\utorrent\utorrent.exe:uTorrent
    "UDP Query User{8E78009F-8A04-4EE5-ADEF-749E607345ED}C:\\program files\\utorrent\\utorrent.exe"= TCP:C:\program files\utorrent\utorrent.exe:uTorrent
    "{17ED6893-9D31-4F8B-BA30-0D67FF9A5E06}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
    "{71A8EFCF-7817-4768-AF1A-7AAA43661BEA}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
    "{F45715B0-422B-4E69-999D-FB20017425B8}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
    "{0BEE21E2-F40C-4D0D-ABA2-F8F5B4156E6B}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
    "{C9A4E229-B740-4C57-81D8-35C4206B30F3}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
    "{8CEC2074-0A09-4CEC-88E9-C6051BE2E598}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{77B6CCC6-B607-4F88-B471-060A5D9938C7}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
    "{7A69BB66-2226-4BA5-B899-2F1972231A68}"= UDP:C:\Pelit\Football Manager 2008\fm.exe:Football Manager 2008
    "{EE616DB0-8327-424E-BF11-83C572CE2ECF}"= TCP:C:\Pelit\Football Manager 2008\fm.exe:Football Manager 2008
    "{A6B5F5C9-EEC8-4D68-8C5C-FA3C48438E06}"= UDP:C:\Pelit\Call of Duty 4\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
    "{1C38AEC0-50E8-4343-8713-24E588619A1C}"= TCP:C:\Pelit\Call of Duty 4\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
    "TCP Query User{32E3E24D-7D08-4300-93EC-5C609D744547}C:\\pelit\\steam\\steamapps\\---\\counter-strike source\\hl2.exe"= UDP:C:\pelit\steam\steamapps\---\counter-strike source\hl2.exe:hl2
    "UDP Query User{F7B9EE97-78E8-48AF-BEDC-A64156E61A6B}C:\\pelit\\steam\\steamapps\\---\\counter-strike source\\hl2.exe"= TCP:C:\pelit\steam\steamapps\---\counter-strike source\hl2.exe:hl2
    "{F1746358-C31E-4454-B85C-249B9391C573}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
    "{16626BB1-F893-45E6-A3F5-6E0D8ABF7284}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
    "TCP Query User{2B763924-4728-48E8-A8F4-E9EEA2F59CBD}C:\\pelit\\steam\\steamapps\\---\\counter-strike source\\hl2.exe"= UDP:C:\pelit\steam\steamapps\---\counter-strike source\hl2.exe:hl2
    "UDP Query User{C03AA628-38A6-4F39-942B-8C15A364F9B9}C:\\pelit\\steam\\steamapps\\---\\counter-strike source\\hl2.exe"= TCP:C:\pelit\steam\steamapps\---\counter-strike source\hl2.exe:hl2

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
    "C:\\Program Files\\FlashFXP\\FlashFXP.exe"= C:\Program Files\FlashFXP\FlashFXP.exe:*:Enabled:FlashFXP v3

    R0 iaNvStor;Intel(R) Turbo Memory Controller;C:\Windows\system32\DRIVERS\iaNvStor.sys [2007-07-09 14:28]
    R0 Si3531;SiI-3531 SATA Controller;C:\Windows\system32\DRIVERS\Si3531.sys [2007-01-30 11:31]
    R1 nltdi;nltdi;C:\Windows\system32\drivers\nltdi.sys [2007-04-23 14:03]
    R2 Ndiskio;Ndiskio;C:\Program Files\Norman\Nse\bin\NDISKIO.SYS [2007-01-02 10:55]
    R2 TestHandler;Fujitsu Siemens Computers Diagnostic Testhandler;C:\firststeps\OnlineDiagnostic\TestManager\TestHandler.exe [2006-12-08 21:52]
    R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-12-04 23:08]
    R3 CEBFilter;CEBFilter;C:\Program Files\C&E\OSD\OsdService\cebuffer.sys [2007-09-05 03:20]
    R3 CEIO;CEIO;C:\Program Files\C&E\OSD\OsdService\ceio.sys [2007-09-01 03:18]
    R3 cKBFilter;cKBFilter;C:\Program Files\C&E\OSD\OsdService\kbfiltr.sys [2007-09-01 01:22]
    R3 itecir;ITECIR Infrared Receiver;C:\Windows\system32\DRIVERS\itecir.sys [2007-04-04 06:57]
    R3 NvcMFlt;NvcMFlt;C:\Windows\system32\DRIVERS\nvcv32mf.sys [2008-02-11 15:56]
    R3 nvcoas;Norman Virus Control on-access component;C:\Program Files\Norman\Nvc\bin\nvcoas.exe [2007-12-12 12:45]
    R3 NVCScheduler;Norman Virus Control Scheduler;C:\Program Files\Norman\Nvc\BIN\NVCSCHED.EXE [2007-05-23 14:23]
    R3 Steam Client Service;Steam Client Service;C:\Program Files\Common Files\Steam\SteamService.exe [2008-04-06 16:50]
    S2 OsdService;OsdService;C:\Program Files\C&E\OSD\OsdService\OsdService.exe [2007-09-04 04:01]
    S3 nvcfsr;nvcfsr;C:\Program Files\Norman\Nvc\bin\nvcfsr.sys [2007-01-09 16:25]
    S3 nvcoafl4;nvcoafl4;C:\Program Files\Norman\Nvc\bin\nvcoafl4.sys [2007-01-09 16:25]
    S3 nvcoaft4;nvcoaft4;C:\Program Files\Norman\Nvc\bin\nvcoaft4.sys [2007-01-09 16:25]
    S3 nvcoarc4;nvcoarc4;C:\Program Files\Norman\Nvc\bin\nvcoarc4.sys [2007-01-09 16:25]
    S4 nvrd32;NVIDIA nForce RAID Driver;C:\Windows\system32\drivers\nvrd32.sys [2007-07-02 18:37]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bthsvcs REG_MULTI_SZ BthServ

    *Newly Created Service* - CATCHME
    .
    **************************************************************************

    catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-21 16:52:18
    Windows 6.0.6001 Service Pack 1 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-04-21 16:55:31
    ComboFix-quarantined-files.txt 2008-04-21 13:55:12

    Pre-Run: 43,506,573,312 tavua vapaana
    Post-Run: 43,264,151,552 tavua vapaana

    220 --- E O F --- 2008-04-17 20:41:00
     
    Viimeksi muokattu: 22.04.2008
    qiac, 21.04.2008
    #3
  5. Hujo

    Hujo Guest

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.
     
    Hujo, 21.04.2008
    #4
  6. qiac

    qiac Member

    Liittynyt:
    21.04.2008
    Viestejä:
    12
    Kiitokset:
    0
    Pisteet:
    11
    Malwarebytes ei löytänyt mitään, eikä windowsin haittaohjelmien poistotyökalu enää löytänyt kyseistä viirusta joten luultavasti se lähti koneelta, joten kiitokset avusta. Tuossa nyt on vielä tuo Malwarebytesin logi

    Malwarebytes' Anti-Malware 1.11
    Tietokantaversio: 665

    Tarkistustyyppi: Täysi tarkistus (C:\|D:\|E:\|)
    Tarkistetut kohteet: 220547
    Kulunut aika: 1 hour(s), 29 minute(s), 17 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 0

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    (Haitallisia kohteita ei löydetty)
     
    qiac, 21.04.2008
    #5
  7. Hujo

    Hujo Guest

    ok..
     
    Hujo, 21.04.2008
    #6

Jaa tämä sivu