Hijackthis-logini tarkistusta, joku?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:49:32, on 9.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\QuickTime\QTTask.exe
C:\iTunes\iTunesHelper.exe
C:\WINDOWS\winudspm.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\winudmr.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\AntiVir PersonalEdition Classic\update.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\Program Files\Last.fm\LastFM.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Music Manager\OD2State.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ig?hl=fi
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://elisa.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;<local>;*.local
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe
O4 - HKLM\..\Run: [BMa727cb6e] Rundll32.exe "C:\WINDOWS\system32\rewvifwi.dll",s
O4 - HKLM\..\Run: [a414f8f2] rundll32.exe "C:\WINDOWS\system32\ooycjevh.dll",b
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Tuki - {43D2E5C2-7C6F-4FA0-8E99-3710D39419E3} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Service - {4B8A4CEF-46CE-442D-914B-6EEDAA0B0757} - http://service.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: SMS - {51AEE4AD-ED6C-477D-986F-BA295C34AE49} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: SMS-viesti - {87AC75E3-B87C-41A0-9944-DE3843486312} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Support - {9A8D9E17-C866-4C12-A4A3-96B579D0CEA8} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Palvelut - {FB431587-8135-49D9-8BBD-446412BB777F} - http://service.kolumbus.fi/ (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 6889 bytes

 

1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

 

Kiitos, tällästä nyt:

--------



ComboFix 08-06-09.7 - Aira&Pekka 2008-06-10 14:48:31.2 - NTFSx86
Running from: C:\Documents and Settings\Aira&Pekka\My Documents\Downloads\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\eKnpAcdd.ini
C:\WINDOWS\system32\eKnpAcdd.ini2
C:\WINDOWS\system32\iafwnetn.dll
C:\WINDOWS\system32\uevcrkby.ini
C:\WINDOWS\system32\ybkrcveu.dll
.
---- Previous Run -------
.
C:\bot.exe
C:\Documents and Settings\Aira&Pekka\Application Data\macromedia\Flash Player\#SharedObjects\4R6GMKYF\iforex.com
C:\Documents and Settings\Aira&Pekka\Application Data\macromedia\Flash Player\#SharedObjects\4R6GMKYF\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
C:\Documents and Settings\Aira&Pekka\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
C:\Documents and Settings\Aira&Pekka\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
C:\WINDOWS\BMa727cb6e.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\service.exe
C:\WINDOWS\system32\aaxwnqyd.exe
C:\WINDOWS\system32\aqbkkela.ini
C:\WINDOWS\system32\benomatf.ini
C:\WINDOWS\system32\bxuvuccj.exe
C:\WINDOWS\system32\cbyqwtnq.dll
C:\WINDOWS\system32\dlmsadux.exe
C:\WINDOWS\system32\efcCuVoo.dll
C:\WINDOWS\system32\eKnpAcdd.ini
C:\WINDOWS\system32\eKnpAcdd.ini2
C:\WINDOWS\system32\gfhpiqmc.dll
C:\WINDOWS\system32\hhrfofjy.dll
C:\WINDOWS\system32\hvejcyoo.ini
C:\WINDOWS\system32\kgukcatm.dll
C:\WINDOWS\system32\kkfotyfl.dll
C:\WINDOWS\system32\knelrrml.ini
C:\WINDOWS\system32\lfytofkk.ini
C:\WINDOWS\system32\lmrrlenk.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nnnlmJDW.dll
C:\WINDOWS\system32\ooycjevh.dll
C:\WINDOWS\system32\opnmJDUn.dll
C:\WINDOWS\system32\rewvifwi.dll
C:\WINDOWS\system32\ssqPiffE.dll
C:\WINDOWS\system32\tgpxfrnf.dll
C:\WINDOWS\system32\vljnvqvt.dll
C:\WINDOWS\system32\vnxdcabl.exe
C:\WINDOWS\system32\wsyacstx.dll
C:\WINDOWS\system32\vtUlMfGy.dll
C:\WINDOWS\system32\xyxpqbgc.ini
C:\WINDOWS\system32\yjfofrhh.ini
C:\WINDOWS\system32\yrwixtwm.exe

.
((((((((((((((((((((((((( Files Created from 2008-05-10 to 2008-06-10 )))))))))))))))))))))))))))))))
.

2008-06-10 14:41 . 2008-06-10 14:41 0 --a------ C:\WINDOWS\BMa727cb6e.xml
2008-06-09 21:53 . 2008-06-10 14:50 2,232 --a------ C:\mzda.exe
2008-06-09 21:48 . 2008-06-09 21:48 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-09 20:58 . 2008-06-09 20:58 <DIR> d-------- C:\Documents and Settings\Aira&Pekka\Application Data\MSNInstaller
2008-06-09 19:35 . 2008-06-09 19:35 29,342 --a------ C:\gf.exe
2008-06-09 18:59 . 2008-06-09 18:59 29,342 --a------ C:\gpf.exe
2008-06-09 15:35 . 2008-06-09 15:35 29,342 -r-hs---- C:\WINDOWS\winudmr.exe
2008-06-09 15:35 . 2008-06-09 15:35 29,342 --a------ C:\pf.exe
2008-06-09 15:35 . 2008-06-10 14:40 2,232 --a------ C:\ps.exe
2008-06-08 16:28 . 2008-06-08 16:55 2,231 --a------ C:\hszs.exe
2008-06-08 16:27 . 2008-06-08 19:00 2,229 --a------ C:\is154890.exe
2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
2008-06-03 20:34 . 2008-06-03 20:34 <DIR> d-------- C:\Documents and Settings\Aira&Pekka\Application Data\Grisoft
2008-06-03 20:29 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-06-03 20:28 . 2008-06-03 20:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-06-03 20:17 . 2008-06-03 22:58 86,548 --a------ C:\Documents and Settings\Aira&Pekka\setupa.exe
2008-06-03 18:53 . 2008-06-03 23:05 86,548 --a------ C:\ssetup.exe
2008-06-01 20:46 . 2008-06-01 20:46 86,502 --a------ C:\sexy.com
2008-06-01 20:07 . 2008-06-01 20:07 <DIR> d--h----- C:\WINDOWS\PIF
2008-06-01 17:36 . 2008-06-03 21:13 4,217 --a------ C:\WINDOWS\is154890.exe
2008-05-29 20:18 . 2008-05-29 20:18 86,340 --a------ C:\img.com
2008-05-29 19:38 . 2008-05-29 19:38 40,960 --a------ C:\dsdc.exe
2008-05-29 19:25 . 2008-05-29 20:28 60,132 --a------ C:\ddc.exe
2008-05-29 15:14 . 2008-05-29 15:14 56,832 --a------ C:\fa.com
2008-05-29 15:14 . 2008-05-29 15:17 40,960 --a------ C:\d.exe
2008-05-29 15:07 . 2008-05-29 15:07 59,392 --a------ C:\WINDOWS\system32\nnnkKATl.dll
2008-05-28 17:28 . 2008-05-28 17:28 380,416 --a------ C:\WINDOWS\system32\ddcApnKe.dll
2008-05-27 20:38 . 2008-05-27 20:38 40,960 --a------ C:\dchi.exe
2008-05-27 20:30 . 2008-05-29 15:14 56,832 -r-hs---- C:\WINDOWS\winudspm.exe
2008-05-27 20:30 . 2008-05-27 21:55 40,960 --a------ C:\dci.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-10 11:42 --------- d-----w C:\Documents and Settings\Aira&Pekka\Application Data\OpenOffice.org2
2008-06-09 17:55 --------- d-----w C:\Program Files\Sony
2008-05-29 17:00 --------- d-----w C:\Program Files\Creative
2008-05-29 16:52 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-20 10:17 --------- d-----w C:\Program Files\Last.fm
2008-05-04 13:47 --------- d-----w C:\Program Files\Google
2008-05-02 19:11 --------- d-----w C:\Program Files\iPod
2008-05-02 18:58 --------- d-----w C:\Program Files\Bonjour
2008-05-02 18:56 --------- d-----w C:\Program Files\Canon
2008-05-02 18:55 --------- d-----w C:\Program Files\DivX
2008-05-02 18:39 --------- d-----w C:\Program Files\Juice
2008-04-23 15:32 --------- d-----w C:\Program Files\Apple Software Update
2008-04-13 14:56 --------- d-----w C:\Program Files\QuickTime
.

------- Sigcheck -------

2008-05-28 17:28 87552 918e116feae29a433201b7a5400829ba C:\WINDOWS\system32\ws2_32.dll
2004-08-04 04:07 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\dllcache\ws2_32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{84DC7C50-3080-41C9-A11B-FFB851A7B222}]
2008-05-28 17:28 380416 --a------ C:\WINDOWS\system32\ddcApnKe.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-03 05:23 102400]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 23:55 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 22:00 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-17 10:11 49152]
"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-27 18:41 262401]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 04:06 40048]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"Windows UDP Control"="winudspm.exe" [2008-05-29 15:14 56832 C:\WINDOWS\winudspm.exe]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]
"Windows Controls Center"="winudmr.exe" [2008-06-09 15:35 29342 C:\WINDOWS\winudmr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:07 15360]

C:\Documents and Settings\Aira&Pekka\Start Menu\Programs\Startup\
OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe [2005-10-15 13:02:32 61440]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 16:19:24 237568]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Last.fm\\LastFM.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\iTunes\\iTunes.exe"=

S1 ensqio;ensqio;C:\WINDOWS\system32\DRIVERS\ensqio.sys []
S1 sbpcint4;SB AudioPCI 128;C:\WINDOWS\system32\DRIVERS\sbpcint4.sys []
S3 ES1370;Creative AudioPCI (ES1370), SB PCI 64/128 (WDM);C:\WINDOWS\system32\drivers\ES1370MP.sys [2001-08-17 23:19]

.
Contents of the 'Scheduled Tasks' folder
"2008-04-20 16:10:26 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-10 15:02:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.bin
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2008-06-10 15:18:22 - machine was rebooted [Aira&Pekka]
ComboFix-quarantined-files.txt 2008-06-10 12:17:12

Pre-Run: 489,512,960 bytes free
Post-Run: 435,904,512 bytes free

190 --- E O F --- 2008-05-18 11:53:23

 

Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

Tallenna se nimellä CFScript.txt

Sitten raahaa CFScript ComboFix.exeen kuten alla.


Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

=============

scannaa hjt:llä merkkaa paina Fix checked

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Windows UDP Control] winudspm.exe
O4 - HKLM\..\Run: [Windows Controls Center] winudmr.exe
O4 - HKLM\..\Run: [BMa727cb6e] Rundll32.exe "C:\WINDOWS\system32\rewvifwi.dll",s
O4 - HKLM\..\Run: [a414f8f2] rundll32.exe "C:\WINDOWS\system32\ooycjevh.dll",b

==============

Lataa Malwarebytes' Anti-Malware työpöydällesi.

1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.

 

Tässä tämä, sitte skannaamaan HJT:lla...

---

ComboFix 08-06-09.7 - Aira&Pekka 2008-06-10 16:27:55.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.320 [GMT 3:00]
Running from: C:\Documents and Settings\Aira&Pekka\My Documents\Downloads\ComboFix.exe
Command switches used :: C:\Documents and Settings\Aira&Pekka\My Documents\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\d.exe
C:\dchi.exe
C:\dci.exe
C:\ddc.exe
C:\dsdc.exe
C:\fa.com
C:\gf.exe
C:\gpf.exe
C:\hszs.exe
C:\img.com
C:\is154890.exe
C:\pf.exe
C:\ps.exe
C:\sexy.com
C:\ssetup.exe
C:\WINDOWS\is154890.exe
C:\WINDOWS\system32\ooycjevh.dll
C:\WINDOWS\system32\rewvifwi.dll
C:\WINDOWS\winudmr.exe
C:\WINDOWS\winudspm.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\d.exe
C:\dchi.exe
C:\dci.exe
C:\ddc.exe
C:\dsdc.exe
C:\fa.com
C:\gf.exe
C:\gpf.exe
C:\hszs.exe
C:\img.com
C:\is154890.exe
C:\pf.exe
C:\ps.exe
C:\sexy.com
C:\ssetup.exe
C:\WINDOWS\BMa727cb6e.xml
C:\WINDOWS\is154890.exe
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\ddmbwxly.dll
C:\WINDOWS\system32\dohbklff.dll
C:\WINDOWS\system32\eKnpAcdd.ini
C:\WINDOWS\system32\eKnpAcdd.ini2
C:\WINDOWS\system32\fflkbhod.ini
C:\WINDOWS\winudmr.exe
C:\WINDOWS\winudspm.exe

.
((((((((((((((((((((((((( Files Created from 2008-05-10 to 2008-06-10 )))))))))))))))))))))))))))))))
.

2008-06-09 21:53 . 2008-06-10 14:50 2,232 --a------ C:\mzda.exe
2008-06-09 21:48 . 2008-06-09 21:48 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-09 20:58 . 2008-06-09 20:58 <DIR> d-------- C:\Documents and Settings\Aira&Pekka\Application Data\MSNInstaller
2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
2008-06-03 20:34 . 2008-06-03 20:34 <DIR> d-------- C:\Documents and Settings\Aira&Pekka\Application Data\Grisoft
2008-06-03 20:29 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-06-03 20:28 . 2008-06-03 20:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-06-03 20:17 . 2008-06-03 22:58 86,548 --a------ C:\Documents and Settings\Aira&Pekka\setupa.exe
2008-06-01 20:07 . 2008-06-01 20:07 <DIR> d--h----- C:\WINDOWS\PIF
2008-05-29 15:07 . 2008-05-29 15:07 59,392 --a------ C:\WINDOWS\system32\nnnkKATl.dll
2008-05-28 17:28 . 2008-05-28 17:28 380,416 --a------ C:\WINDOWS\system32\ddcApnKe.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-10 12:09 --------- d-----w C:\Documents and Settings\Aira&Pekka\Application Data\OpenOffice.org2
2008-06-09 17:55 --------- d-----w C:\Program Files\Sony
2008-05-29 17:00 --------- d-----w C:\Program Files\Creative
2008-05-29 16:52 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-20 10:17 --------- d-----w C:\Program Files\Last.fm
2008-05-04 13:47 --------- d-----w C:\Program Files\Google
2008-05-02 19:11 --------- d-----w C:\Program Files\iPod
2008-05-02 18:58 --------- d-----w C:\Program Files\Bonjour
2008-05-02 18:56 --------- d-----w C:\Program Files\Canon
2008-05-02 18:55 --------- d-----w C:\Program Files\DivX
2008-05-02 18:39 --------- d-----w C:\Program Files\Juice
2008-04-23 15:32 --------- d-----w C:\Program Files\Apple Software Update
2008-04-13 14:56 --------- d-----w C:\Program Files\QuickTime
.

------- Sigcheck -------

2008-05-28 17:28 87552 918e116feae29a433201b7a5400829ba C:\WINDOWS\system32\ws2_32.dll
2004-08-04 04:07 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\dllcache\ws2_32.dll
.
((((((((((((((((((((((((((((( snapshot@2008-06-10_15.16.21.04 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-10 12:01:02 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-10 13:35:47 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C5F134A9-9A48-44CF-82B0-948FDA82C09E}]
2008-05-28 17:28 380416 --a------ C:\WINDOWS\system32\ddcApnKe.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-03 05:23 102400]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 23:55 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 22:00 49152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-17 10:11 49152]
"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-27 18:41 262401]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 04:06 40048]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"Windows UDP Control"="winudspm.exe" []
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]
"Windows Controls Center"="winudmr.exe" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:07 15360]

C:\Documents and Settings\Aira&Pekka\Start Menu\Programs\Startup\
OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe [2005-10-15 13:02:32 61440]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 16:19:24 237568]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Last.fm\\LastFM.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\iTunes\\iTunes.exe"=

S1 ensqio;ensqio;C:\WINDOWS\system32\DRIVERS\ensqio.sys []
S1 sbpcint4;SB AudioPCI 128;C:\WINDOWS\system32\DRIVERS\sbpcint4.sys []
S3 ES1370;Creative AudioPCI (ES1370), SB PCI 64/128 (WDM);C:\WINDOWS\system32\drivers\ES1370MP.sys [2001-08-17 23:19]

.
Contents of the 'Scheduled Tasks' folder
"2008-04-20 16:10:26 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-10 16:37:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.bin
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2008-06-10 16:51:55 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-10 13:50:46
ComboFix2.txt 2008-06-10 12:18:25

Pre-Run: 378,699,776 bytes free
Post-Run: 404,967,424 bytes free

177 --- E O F --- 2008-05-18 11:53:23

 

Tota noin, näitä kahta ei löytynyt tuosta listasta HJT:lla. Haittaako?


O4 - HKLM\..\Run: [BMa727cb6e] Rundll32.exe "C:\WINDOWS\system32\rewvifwi.dll",s

ja

O4 - HKLM\..\Run: [a414f8f2] rundll32.exe "C:\WINDOWS\system32\ooycjevh.dll",b

 

Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

Tallenna se nimellä CFScript.txt

Sitten raahaa CFScript ComboFix.exeen kuten alla.


Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

=============

ei haittaa

 

Okei, kiitti.
Lataan eka vaan ton Malwarebytesin, ku en ole vielä ehtinyt...

 

Noniiin... Ja nyt teen ton C:\mzda.exe ComboFix jutun?



--


Malwarebytes' Anti-Malware 1.16
Database version: 845

20:03:42 10.6.2008
mbam-log-6-10-2008 (20-03-42).txt

Scan type: Full Scan (C:\|)
Objects scanned: 97915
Time elapsed: 2 hour(s), 29 minute(s), 22 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 21

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\ddcApnKe.dll (Trojan.Vundo) -> Unloaded module successfully.

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{c5f134a9-9a48-44cf-82b0-948fda82c09e} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c5f134a9-9a48-44cf-82b0-948fda82c09e} (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\QooBox\Quarantine\C\bot.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\d.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\dchi.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\dci.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\ddc.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\dsdc.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\fa.com.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\img.com.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\winudspm.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\aaxwnqyd.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\bxuvuccj.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\dlmsadux.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\nnnlmJDW.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\opnmJDUn.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\ssqPiffE.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\vnxdcabl.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\vtUlMfGy.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\yrwixtwm.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nnnkKATl.dll (Backdoor.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ddcApnKe.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

 

ok....

 

Näin..:

---



ComboFix 08-06-09.7 - Aira&Pekka 2008-06-10 21:27:55.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.375 [GMT 3:00]
Running from: C:\Documents and Settings\Aira&Pekka\My Documents\Downloads\ComboFix.exe
Command switches used :: C:\Documents and Settings\Aira&Pekka\My Documents\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\mzda.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Aira&Pekka\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\mzda.exe

.
((((((((((((((((((((((((( Files Created from 2008-05-10 to 2008-06-10 )))))))))))))))))))))))))))))))
.

2008-06-10 17:22 . 2008-06-10 17:22 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-10 17:22 . 2008-06-10 17:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-10 17:22 . 2008-06-10 17:22 <DIR> d-------- C:\Documents and Settings\Aira&Pekka\Application Data\Malwarebytes
2008-06-10 17:22 . 2008-06-09 20:13 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-10 17:22 . 2008-06-09 20:13 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-09 21:48 . 2008-06-09 21:48 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-09 20:58 . 2008-06-09 20:58 <DIR> d-------- C:\Documents and Settings\Aira&Pekka\Application Data\MSNInstaller
2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
2008-06-03 20:34 . 2008-06-03 20:34 <DIR> d-------- C:\Documents and Settings\Aira&Pekka\Application Data\Grisoft
2008-06-03 20:29 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-06-03 20:28 . 2008-06-03 20:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-06-03 20:17 . 2008-06-03 22:58 86,548 --a------ C:\Documents and Settings\Aira&Pekka\setupa.exe
2008-06-01 20:07 . 2008-06-01 20:07 <DIR> d--h----- C:\WINDOWS\PIF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-10 17:19 --------- d-----w C:\Documents and Settings\Aira&Pekka\Application Data\OpenOffice.org2
2008-06-09 17:55 --------- d-----w C:\Program Files\Sony
2008-05-29 17:00 --------- d-----w C:\Program Files\Creative
2008-05-29 16:52 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-20 10:17 --------- d-----w C:\Program Files\Last.fm
2008-05-04 13:47 --------- d-----w C:\Program Files\Google
2008-05-02 19:11 --------- d-----w C:\Program Files\iPod
2008-05-02 18:58 --------- d-----w C:\Program Files\Bonjour
2008-05-02 18:56 --------- d-----w C:\Program Files\Canon
2008-05-02 18:55 --------- d-----w C:\Program Files\DivX
2008-05-02 18:39 --------- d-----w C:\Program Files\Juice
2008-04-23 15:32 --------- d-----w C:\Program Files\Apple Software Update
2008-04-13 14:56 --------- d-----w C:\Program Files\QuickTime
.

------- Sigcheck -------

2008-05-28 17:28 87552 918e116feae29a433201b7a5400829ba C:\WINDOWS\system32\ws2_32.dll
2004-08-04 04:07 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\dllcache\ws2_32.dll
.
((((((((((((((((((((((((((((( snapshot@2008-06-10_15.16.21.04 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-10 12:01:02 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-10 18:35:24 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-03 05:23 102400]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 23:55 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 22:00 49152]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-17 10:11 49152]
"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-27 18:41 262401]
"iTunesHelper"="C:\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:07 15360]

C:\Documents and Settings\Aira&Pekka\Start Menu\Programs\Startup\
OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe [2005-10-15 13:02:32 61440]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 16:19:24 237568]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Last.fm\\LastFM.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\iTunes\\iTunes.exe"=

S1 ensqio;ensqio;C:\WINDOWS\system32\DRIVERS\ensqio.sys []
S1 sbpcint4;SB AudioPCI 128;C:\WINDOWS\system32\DRIVERS\sbpcint4.sys []
S3 ES1370;Creative AudioPCI (ES1370), SB PCI 64/128 (WDM);C:\WINDOWS\system32\drivers\ES1370MP.sys [2001-08-17 23:19]

.
Contents of the 'Scheduled Tasks' folder
"2008-04-20 16:10:26 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-10 21:37:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.bin
.
**************************************************************************
.
Completion time: 2008-06-10 21:51:34 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-10 18:50:26
ComboFix2.txt 2008-06-10 13:51:57
ComboFix3.txt 2008-06-10 12:18:25

Pre-Run: 377,700,352 bytes free
Post-Run: 452,321,280 bytes free

130 --- E O F --- 2008-05-18 11:53:23

 

Lataa TÄSTÄ VundoFix.exe työpöydällesi.

Tupla-klikkaa VundoFix.exe ajaaksesi sen.
Klikkaa Scan for Vundo valintaa.
Kun skannaus on valmis, klikkaa Fix Vundo valintaa.
Sinulta kysytään haluatko poistaa filut - klikkaa YES.
Kun olet klikannut yes, työpöytäsi tyhjenee kun se alkaa poistamaan Vundoa.
Kun se on valmis, fiksi ilmoittaa käynnistäväsi koneesi uudelleen, klikkaa OK.
Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö.

Huomaa: Se on mahdollista että VundoFix löysi tiedoston jota se ei pystynyt poistamaan.
Tässä tilanteessa, VundoFix ajaa itsensä rebootissa, seuraa vain yläpuolelle olevia ohjeita alkaen kohdasta "Klikkaa Scan for Vundo valintaa." kun VundoFix ilmaantuu uudelleenkäynnistyksen yhteydessä.

 

Olen tässä kohta kaksi tuntia odottanut vundoa, että se poistuisi..

Siinä lukee vaan "Removing vundo..."

Eli... Pitää kai vaan venaa?

 

fix vundo

päräytä poikki se ohjelma taitaa olla sulla vanha vundofix

 

Ei auta... Siihen tulee teksti, että se nyt sulkee Vundon, mut lukee edelleen "Removing vundo..." Enkä tiiä kauaa pitäis odottaa vielä.


Ok, suljen ikkunan...

 

tee raaka tempu sammuta ja käynnistä kone

 

Käskystä.. Eli nyt tota "Postita C:\vundofix.txt lokin sekä tuoreen HijackThis lokin sisältö."

Mistä saan ton vundofix lokin?

 

Oho, löysinkin sellasen.!

---


VundoFix V7.0.5

Scan started at 22:19:03 10.6.2008

Listing files found while scanning....

No infected files were found.


Beginning removal...

Beginning removal...

Beginning removal...

 

Ja tämä vielä...

Olisko jo puhdas kone?

---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:06:15, on 11.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ig?hl=fi
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;<local>;*.local
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [iTunesHelper] "C:\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Tuki - {43D2E5C2-7C6F-4FA0-8E99-3710D39419E3} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Service - {4B8A4CEF-46CE-442D-914B-6EEDAA0B0757} - http://service.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: SMS - {51AEE4AD-ED6C-477D-986F-BA295C34AE49} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: SMS-viesti - {87AC75E3-B87C-41A0-9944-DE3843486312} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Support - {9A8D9E17-C866-4C12-A4A3-96B579D0CEA8} - http://tuki.elisa.net/ (file missing) (HKCU)
O9 - Extra button: Palvelut - {FB431587-8135-49D9-8BBD-446412BB777F} - http://service.kolumbus.fi/ (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: iPod-palvelu (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 6576 bytes

 

Javan päivitys ja välimuistin tyhjennys:

1. Klikkaa Käynnistä -> Ohjauspaneeli ja tupla-klikkaa Lisää tai poista sovellus Ohjauspaneelissa.
2. Etsi listasta kaikki entiset Java versiosi. (J2SE Runtime Environment.... )
Niissä pitäisi olla seuraava kuva vieressä:

3. Valitse kaikki entiset Java versiosi ja valitse Poista.
4. Asenna uusin Java päivitys seuraavasta linkistä..
5. Käynnistä kone uudelleen asennuksen jälkeen:

http://java.sun.com/javase/downloads/index.jsp

Rullaa alas kohteeseen Java Runtime Environment (JRE) 6u6

Paina Download

Ruksaa Accept, ota offline installation, tallenna vaikka työpöydälle ja asenna se.

6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).

7. General Settings -osion alla, vedä liukusäädintä (Disk Space) pienemmälle, ja klikkaa Delete Files -nappia.

(Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).

8. Varmista että kaikki kaksi valintaa ovat rastitettuja:

*Applications and Applets

*Trace and Log Files

Ja paina OK -nappia

9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.

10. Klikkaa OK jättääksesi Java asetusikkunasi.


=============

scannaa vielä uusi combofix loki ja Malwarebytes' Anti-Malware loki