1. Tämä sivusto käyttää keksejä (cookie). Jatkamalla sivuston käyttämistä hyväksyt keksien käyttämisen. Lue lisää.

Hjt log, viruksia koneella.

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi kiisselia 08.06.2008.

Sivu 1 / 2
  1. kiisselia

    kiisselia Regular member

    Liittynyt:
    13.12.2006
    Viestejä:
    125
    Kiitokset:
    0
    Pisteet:
    26
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 13:57:36, on 8.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\inetsrv\inetinfo.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\UAService7.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Elisa\Avustaja\Elisa.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\VM_STI.EXE
    C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\wplayer.exe
    C:\WINDOWS\service.exe
    C:\Windows\mservice.exe
    C:\Program Files\PDF-XChangeSDKEU\PDFSaver.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\CCleaner\ccleaner.exe
    C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/wdgt3/*http://www.yahoo.com/ext/search/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R3 - URLSearchHook: Advanced Searchbar - {57F02779-3D88-4958-8AD3-83C12D86ADC7} - C:\Program Files\AdvancedSearchbar\advancedsearchbar.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: CoTGT_BHO Class - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Program Files\TGTSoft\StyleXP\TGT_BHO.dll
    O2 - BHO: Advanced Searchbar - {CDEEC43D-3572-4E95-A2A5-F519D29F00C0} - C:\PROGRA~1\ADVANC~1\ADVANC~1.DLL
    O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
    O3 - Toolbar: Advanced Searchbar - {57F02779-3D88-4958-8AD3-83C12D86ADC7} - C:\Program Files\AdvancedSearchbar\advancedsearchbar.dll
    O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [ADSL_A2] A2Installed
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [Elisa Avustaja] "C:\Program Files\Elisa\Avustaja\Elisa.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Audio Web Cam 31
    O4 - HKLM\..\Run: [Windows svchost] service.exe
    O4 - HKLM\..\Run: [MSN] C:\Windows\mservice.exe
    O4 - HKLM\..\Run: [Microsoft] wplayer.exe
    O4 - HKLM\..\RunServices: [Microsoft] wplayer.exe
    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: PDF-Capture.lnk = C:\Program Files\PDF-XChangeSDKEU\PDFSaver.exe
    O4 - Global Startup: VPN Client.lnk = ?
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Matkaviestimen suosikkien luominen - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
    O9 - Extra 'Tools' menuitem: Matkaviestimen suosikkien luominen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
    O9 - Extra button: Advanced Searchbar - {57F02779-3D88-4958-8AD3-83C12D86ADC7} - C:\Program Files\AdvancedSearchbar\advancedsearchbar.dll
    O9 - Extra 'Tools' menuitem: Advanced Searchbar - {57F02779-3D88-4958-8AD3-83C12D86ADC7} - C:\Program Files\AdvancedSearchbar\advancedsearchbar.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1106078188394
    O16 - DPF: {6EE39BFC-2FB6-4B69-9D05-CFC10E4F5B3E} (MavenBootInstallerAXControl Class) - http://client.maven.net/client/mavenBootInstaller.cab
    O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://www.lumonetti.fi/portaali/Virusskanneri/OLS3/fscax.cab
    O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinktanks/BTDownloadCtrl.cab
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: MSSQL$PINNACLESYS - Unknown owner - I:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe (file missing)
    O23 - Service: MySQL - Unknown owner - C:\wamp\mysql\bin\bin\mysqld-nt (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Unknown owner - I:\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe (file missing)
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: SQLAgent$PINNACLESYS - Unknown owner - I:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE (file missing)
    O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
    O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

    --
    End of file - 11989 bytes
     
    kiisselia, 08.06.2008
    #1
  2.  
  3. Hujo

    Hujo Guest

    1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
    combofix1
    combofix2

    2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, 08.06.2008
    #2
  4. kiisselia

    kiisselia Regular member

    Liittynyt:
    13.12.2006
    Viestejä:
    125
    Kiitokset:
    0
    Pisteet:
    26
    Mihin se tallentaa login?
     
    kiisselia, 08.06.2008
    #3
  5. Hujo

    Hujo Guest

    katos tuolta

    C:\combofix.txt

    sen pitäis aueta kun ohjelma on mennyt lävitse niin automaatisesti
     
    Hujo, 08.06.2008
    #4
  6. kiisselia

    kiisselia Regular member

    Liittynyt:
    13.12.2006
    Viestejä:
    125
    Kiitokset:
    0
    Pisteet:
    26
    vetäsen uutelleen!
     
    kiisselia, 08.06.2008
    #5
  7. kiisselia

    kiisselia Regular member

    Liittynyt:
    13.12.2006
    Viestejä:
    125
    Kiitokset:
    0
    Pisteet:
    26
    ComboFix 08-06-07.3 - User 2008-06-08 15:25:25.3 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.916 [GMT 3:00]
    Running from: C:\Documents and Settings\User\Desktop\ComboFix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    ---- Previous Run -------
    .
    C:\f.exe
    C:\Program Files\download plugin
    C:\Program Files\download plugin\DlPlugin-Moz\buddy.dat
    C:\Program Files\download plugin\DlPlugin-Moz\buddy.uri
    C:\Program Files\download plugin\DlPlugin-Moz\vendor.txt
    C:\setup.exe
    C:\WINDOWS\service.exe
    C:\WINDOWS\system32\Cache
    C:\WINDOWS\system32\fccDTlMd.dll
    C:\WINDOWS\system32\fccyvUOi.dll
    C:\WINDOWS\system32\jkkJaywV.dll
    C:\WINDOWS\system32\ljJyvWOf.dll
    C:\WINDOWS\system32\mdm.exe
    C:\WINDOWS\system32\mlJyATNe.dll

    .
    ((((((((((((((((((((((((( Files Created from 2008-05-08 to 2008-06-08 )))))))))))))))))))))))))))))))
    .

    2080-04-06 17:51 . 2080-04-06 17:51 <DIR> d-------- C:\Program Files\7-Zip
    2080-04-06 14:56 . 2004-08-04 08:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
    2080-03-28 16:11 . 2080-03-28 16:14 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
    2080-03-27 17:32 . 2080-03-27 17:32 <DIR> d-------- C:\Documents and Settings\User\Application Data\Malwarebytes
    2080-03-27 17:31 . 2080-03-27 17:31 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2080-03-27 15:59 . 2080-03-27 15:59 <DIR> d-------- C:\WINDOWS\ERUNT
    2080-03-27 15:21 . 2080-03-27 15:21 <DIR> d-------- C:\Documents and Settings\User\Application Data\Grisoft
    2080-03-27 15:20 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2080-03-26 23:17 . 2080-03-26 23:17 <DIR> d-------- C:\fsaua.data
    2008-06-08 13:48 . 2008-06-08 13:48 2,231 --a------ C:\sjgz.exe
    2008-06-08 13:48 . 2008-06-08 13:48 2,231 --a------ C:\shz.exe
    2008-06-08 13:48 . 2008-06-08 13:48 2,230 --a------ C:\is154890.exe
    2008-06-06 00:23 . 2008-06-06 00:23 49,156 --a------ C:\fs.exe
    2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\User\f.exe
    2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
    2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\User\stp.exe
    2008-06-04 21:59 . 2008-06-04 22:06 86,528 --a------ C:\stp.exe
    2008-06-03 23:40 . 2008-06-03 23:40 202,210 --a------ C:\sxy.exe
    2008-06-03 19:53 . 2008-06-03 19:53 4,217 --a------ C:\WINDOWS\is154890.exe
    2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\User\setupa.exe
    2008-06-03 18:32 . 2008-06-03 18:32 86,548 --a------ C:\setz.exe
    2008-06-03 18:10 . 2008-06-03 23:05 86,548 --a------ C:\ssetup.exe
    2008-06-02 22:30 . 2008-06-02 22:30 97,116 --a------ C:\WINDOWS\DC5177176.zip
    2008-06-02 21:23 . 2008-06-02 21:23 96,950 -r-hs---- C:\WINDOWS\mservice.exe
    2008-06-02 21:23 . 2008-06-02 21:28 96,950 --a------ C:\stup.exe
    2008-06-02 19:00 . 2008-06-03 18:18 60,114 --a------ C:\bot1.exe
    2008-05-26 22:23 . 2008-05-26 22:32 <DIR> d-------- C:\Program Files\mIRC
    2008-05-26 22:23 . 2008-05-26 22:34 <DIR> d-------- C:\Documents and Settings\User\Application Data\mIRC
    2008-05-19 17:48 . 2003-07-11 06:12 159,799 -ra------ C:\WINDOWS\system32\vm302prp.ax
    2008-05-19 17:48 . 2002-08-22 11:34 147,456 -ra------ C:\WINDOWS\vmcap.exe
    2008-05-19 17:48 . 2004-03-22 11:22 90,559 -ra------ C:\WINDOWS\system32\drivers\usbvm302.sys
    2008-05-19 17:48 . 2003-05-15 12:16 61,440 -ra------ C:\WINDOWS\system32\vm302sti.dll
    2008-05-19 17:48 . 2002-10-16 04:29 49,152 -ra------ C:\WINDOWS\amcap.exe
    2008-05-19 17:48 . 2003-01-21 10:19 40,960 -ra------ C:\WINDOWS\VM_STI.EXE
    2008-05-14 19:16 . 2008-05-14 20:49 122 --a------ C:\WINDOWS\blank

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2080-03-28 13:41 --------- d-----w C:\Program Files\Common Files\SupportSoft
    2080-03-28 13:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier
    2080-03-27 14:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2080-03-27 12:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
    2080-03-27 12:00 --------- d-----w C:\Program Files\Ahead
    2080-03-27 11:59 --------- d-----w C:\Program Files\Common Files\Ahead
    2080-03-27 11:57 --------- d-----w C:\Program Files\MultiMaker Studio Exam 8.0 Academic
    2080-03-27 11:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2080-03-27 11:52 --------- d-----w C:\Program Files\Macromedia
    2080-03-27 11:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-06-08 11:46 --------- d-----w C:\Program Files\DivX
    2008-06-05 21:32 --------- d-----w C:\Program Files\Microsoft ActiveSync
    2008-05-02 21:41 --------- d-----w C:\Program Files\DC++
    2008-04-18 12:05 --------- d-----w C:\Program Files\Windows Live Toolbar
    2008-04-18 12:02 --------- d-----w C:\Program Files\Windows Live
    2008-04-18 11:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-04-18 11:35 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-04-11 16:31 --------- d-----w C:\Program Files\Lavalys
    2008-03-27 08:12 151,583 ------w C:\WINDOWS\system32\msjint40.dll
    2008-03-26 20:04 38,400 --sh--r C:\WINDOWS\msn.com
    2008-03-21 15:37 499,568 ----a-w C:\Program Files\hijackthis_v2.0.2.zip
    2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-02-22 17:19 4,129,768 ----a-w C:\Program Files\DCPlusPlus-0.699.exe
    2007-12-19 14:47 87,608 ----a-w C:\Documents and Settings\User\Application Data\ezpinst.exe
    2007-12-19 14:47 47,360 ----a-w C:\Documents and Settings\User\Application Data\pcouffin.sys
    2007-06-30 11:34 5,632 --sha-w C:\Program Files\Thumbs.db
    2006-01-27 07:34 20,784 ----a-w C:\Documents and Settings\User\Application Data\GDIPFONTCACHEV1.DAT
    2005-10-17 20:43 62 ----a-w C:\Program Files\Warez P2P ClientIPGUARD.LOG
    2004-03-11 11:27 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
    2007-06-13 10:23 290,110 --sh--r C:\WINDOWS\system32\wplayer.exe
    .

    ((((((((((((((((((((((((((((( snapshot@2008-06-08_15.02.35.12 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-06-08 11:56:57 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-08 12:21:21 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    - 2008-06-08 11:57:12 230,104 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
    + 2008-06-08 12:21:36 230,104 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
    - 2008-06-08 10:52:24 111,210 ----a-w C:\WINDOWS\system32\perfc009.dat
    + 2008-06-08 12:26:05 111,210 ----a-w C:\WINDOWS\system32\perfc009.dat
    - 2008-06-08 10:52:24 550,312 ----a-w C:\WINDOWS\system32\perfh009.dat
    + 2008-06-08 12:26:05 550,312 ----a-w C:\WINDOWS\system32\perfh009.dat
    + 2008-06-08 12:21:31 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_3c4.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
    2007-10-04 23:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-10-04 23:06 1135968]

    [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
    [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
    "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 23:06 1135968]

    [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
    [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-24 16:16 401491]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ADSL_A2"="A2Installed" []
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-15 17:20 6803456]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-06-15 17:20 86016]
    "IntelliType"="C:\Program Files\Microsoft Hardware\Keyboard\type32.exe" [2002-03-22 07:41 94208]
    "nwiz"="nwiz.exe" [2005-06-15 17:20 1519616 C:\WINDOWS\system32\nwiz.exe]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
    "RegistryMechanic"="" []
    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-01-22 13:00 180269]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
    "BigDogPath"="C:\WINDOWS\VM_STI.exe" [2003-01-21 10:19 40960]
    "Windows svchost"="service.exe" []
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 10:56 15360]
    "MSN Updater"="msnms.exe" []
    "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 13:01:04 83360]
    PDF-Capture.lnk - C:\Program Files\PDF-XChangeSDKEU\PDFSaver.exe [2005-05-12 09:24:26 61440]
    VPN Client.lnk - C:\WINDOWS\Installer\{24C67B54-0718-445E-B663-3138D9246BD1}\Icon3E5562ED7.ico [2006-09-09 21:44:36 6144]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=C:\WINDOWS\system32\wmfhotfix.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.DIV3"= DivXc32.dll
    "vidc.DIV4"= DivXc32f.dll
    "vidc.3iv2"= 3ivxVfWCodec.dll
    "msacm.divxa32"= divxa32.acm
    "VIDC.HFYU"= huffyuv.dll
    "VIDC.VP31"= vp31vfw.dll
    "vidc.asv2"= asusasv2.dll
    "MSACM.CEGSM"= mobilev.acm
    "vidc.ffds"= ffdshow.ax
    "VIDC.MJPG"= Pvmjpg30.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    --------- 2004-10-13 19:24 1694208 C:\Program Files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "xmlprov"=3 (0x3)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "C:\\WINDOWS\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Outlook Express\\msimn.exe"=
    "C:\\Program Files\\Internet Explorer\\iexplore.exe"=
    "C:\\WINDOWS\\system32\\dpvsetup.exe"=
    "C:\\WINDOWS\\system32\\javaw.exe"=
    "C:\\Program Files\\DC++\\DCPlusPlus.exe"=
    "C:\\Program Files\\Common Files\\Microsoft Shared\\Windows CE Tools\\Platman\\bin\\cemgr.exe"=
    "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"=
    "C:\\Program Files\\Web Publish\\WPWIZ.EXE"=
    "C:\\Program Files\\Java\\jdk1.5.0_02\\jre\\bin\\java.exe"=
    "C:\\Documents and Settings\\User\\.netbeans\\5.0\\emulators\\wtk22_win\\emulator\\wtk22\\bin\\emulator.exe"=
    "C:\\Documents and Settings\\User\\.netbeans\\5.0\\emulators\\wtk22_win\\emulator\\wtk22\\bin\\zayit.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "E:\\Program Files\\Sony Ericsson\\Update Service\\ma3platform.exe"=
    "C:\\Program Files\\Elisa\\Avustaja\\Elisa.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "25:TCP"= 25:TCP:smtp
    "3389:TCP"= 3389:TCP:mad:xpsp2res.dll,-22009
    "23457:TCP"= 23457:TCP:eMule
    "23457:UDP"= 23457:UDP:emule
    "9842:TCP"= 9842:TCP:*:Disabled:SolidNetworkManager
    "9842:UDP"= 9842:UDP:*:Disabled:SolidNetworkManager

    R0 d343bus;d343bus;C:\WINDOWS\system32\DRIVERS\d343bus.sys [2003-12-15 18:46]
    R0 d343port;d343port;C:\WINDOWS\system32\DRIVERS\d343port.sys [2003-12-15 17:29]
    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
    R2 MLPTDR_N;MLPTDR_N;C:\WINDOWS\system32\MLPTDR_N.sys [2003-07-17 16:44]
    R2 MSF32;MSF32;C:\Program Files\MySecretFolder XP\MSF32.SYS [2007-01-25 01:00]
    R3 ncfvsbus;NCF Virtual Serial Bus Enumerator;C:\WINDOWS\system32\DRIVERS\ncfvsbus.sys [2004-11-26 12:15]
    R3 ZSMC302;Audio Web Cam 31;C:\WINDOWS\system32\Drivers\usbvm302.sys [2004-03-22 11:22]
    S3 itexadsla2;TW-IA300 Service;C:\WINDOWS\system32\DRIVERS\TWIn95a2.sys [2001-11-05 19:00]
    S3 SER120;OTI Serial port driver;C:\WINDOWS\system32\DRIVERS\SER120.sys [2004-11-23 04:59]
    S3 z520bus;Sony Ericsson 520 driver (WDM);C:\WINDOWS\system32\DRIVERS\z520bus.sys [2005-07-26 12:13]
    S3 z520mdfl;Sony Ericsson 520 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\z520mdfl.sys [2005-07-26 12:15]
    S3 z520mdm;Sony Ericsson 520 USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\z520mdm.sys [2005-07-26 12:15]
    S3 z520mgmt;Sony Ericsson 520 USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\z520mgmt.sys [2005-07-26 12:16]
    S3 z520obex;Sony Ericsson 520 USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\z520obex.sys [2005-07-26 12:18]

    .
    Contents of the 'Scheduled Tasks' folder
    "2008-06-08 12:28:00 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-08 15:28:38
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet002\Services\MySQL]
    "ImagePath"="\"C:\wamp\mysql\bin\bin\mysqld-nt\" --defaults-file=\"C:\wamp\mysql\bin\my.ini\" MySQL"
    .
    Completion time: 2008-06-08 15:30:03
    ComboFix-quarantined-files.txt 2008-06-08 12:29:21

    Pre-Run: 21,570,920,448 bytes free
    Post-Run: 21,552,975,872 bytes free

    230 --- E O F --- 2008-06-05 21:33:21

     
    kiisselia, 08.06.2008
    #6
  8. Hujo

    Hujo Guest

    Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

    Tallenna se nimellä CFScript.txt

    Sitten raahaa CFScript ComboFix.exeen kuten alla.
    [​IMG]

    Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.


    =============

    scannaa hjt:llä merkkaa paina Fix checked

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [Windows svchost] service.exe
    O4 - HKLM\..\Run: [MSN] C:\Windows\mservice.exe
    O4 - HKLM\..\Run: [Microsoft] wplayer.exe
    O4 - HKLM\..\RunServices: [Microsoft] wplayer.exe

     
    Hujo, 08.06.2008
    #7
  9. kiisselia

    kiisselia Regular member

    Liittynyt:
    13.12.2006
    Viestejä:
    125
    Kiitokset:
    0
    Pisteet:
    26
    ComboFix 08-06-07.3 - User 2008-06-08 15:51:59.4 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1063 [GMT 3:00]
    Running from: C:\Documents and Settings\User\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\User\Desktop\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((( Files Created from 2008-05-08 to 2008-06-08 )))))))))))))))))))))))))))))))
    .

    2080-04-06 17:51 . 2080-04-06 17:51 <DIR> d-------- C:\Program Files\7-Zip
    2080-04-06 14:56 . 2004-08-04 08:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
    2080-03-28 16:11 . 2080-03-28 16:14 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
    2080-03-27 17:32 . 2080-03-27 17:32 <DIR> d-------- C:\Documents and Settings\User\Application Data\Malwarebytes
    2080-03-27 17:31 . 2080-03-27 17:31 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2080-03-27 15:59 . 2080-03-27 15:59 <DIR> d-------- C:\WINDOWS\ERUNT
    2080-03-27 15:21 . 2080-03-27 15:21 <DIR> d-------- C:\Documents and Settings\User\Application Data\Grisoft
    2080-03-27 15:20 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2080-03-26 23:17 . 2080-03-26 23:17 <DIR> d-------- C:\fsaua.data
    2008-06-08 13:48 . 2008-06-08 13:48 2,231 --a------ C:\sjgz.exe
    2008-06-08 13:48 . 2008-06-08 13:48 2,231 --a------ C:\shz.exe
    2008-06-08 13:48 . 2008-06-08 13:48 2,230 --a------ C:\is154890.exe
    2008-06-06 00:23 . 2008-06-06 00:23 49,156 --a------ C:\fs.exe
    2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\User\f.exe
    2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
    2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\User\stp.exe
    2008-06-04 21:59 . 2008-06-04 22:06 86,528 --a------ C:\stp.exe
    2008-06-03 23:40 . 2008-06-03 23:40 202,210 --a------ C:\sxy.exe
    2008-06-03 19:53 . 2008-06-03 19:53 4,217 --a------ C:\WINDOWS\is154890.exe
    2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\User\setupa.exe
    2008-06-03 18:32 . 2008-06-03 18:32 86,548 --a------ C:\setz.exe
    2008-06-03 18:10 . 2008-06-03 23:05 86,548 --a------ C:\ssetup.exe
    2008-06-02 22:30 . 2008-06-02 22:30 97,116 --a------ C:\WINDOWS\DC5177176.zip
    2008-06-02 21:23 . 2008-06-02 21:23 96,950 -r-hs---- C:\WINDOWS\mservice.exe
    2008-06-02 21:23 . 2008-06-02 21:28 96,950 --a------ C:\stup.exe
    2008-06-02 19:00 . 2008-06-03 18:18 60,114 --a------ C:\bot1.exe
    2008-05-26 22:23 . 2008-05-26 22:32 <DIR> d-------- C:\Program Files\mIRC
    2008-05-26 22:23 . 2008-05-26 22:34 <DIR> d-------- C:\Documents and Settings\User\Application Data\mIRC
    2008-05-19 17:48 . 2003-07-11 06:12 159,799 -ra------ C:\WINDOWS\system32\vm302prp.ax
    2008-05-19 17:48 . 2002-08-22 11:34 147,456 -ra------ C:\WINDOWS\vmcap.exe
    2008-05-19 17:48 . 2004-03-22 11:22 90,559 -ra------ C:\WINDOWS\system32\drivers\usbvm302.sys
    2008-05-19 17:48 . 2003-05-15 12:16 61,440 -ra------ C:\WINDOWS\system32\vm302sti.dll
    2008-05-19 17:48 . 2002-10-16 04:29 49,152 -ra------ C:\WINDOWS\amcap.exe
    2008-05-19 17:48 . 2003-01-21 10:19 40,960 -ra------ C:\WINDOWS\VM_STI.EXE
    2008-05-14 19:16 . 2008-05-14 20:49 122 --a------ C:\WINDOWS\blank

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2080-03-28 13:41 --------- d-----w C:\Program Files\Common Files\SupportSoft
    2080-03-28 13:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier
    2080-03-27 14:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2080-03-27 12:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
    2080-03-27 12:00 --------- d-----w C:\Program Files\Ahead
    2080-03-27 11:59 --------- d-----w C:\Program Files\Common Files\Ahead
    2080-03-27 11:57 --------- d-----w C:\Program Files\MultiMaker Studio Exam 8.0 Academic
    2080-03-27 11:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2080-03-27 11:52 --------- d-----w C:\Program Files\Macromedia
    2080-03-27 11:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-06-08 11:46 --------- d-----w C:\Program Files\DivX
    2008-06-05 21:32 --------- d-----w C:\Program Files\Microsoft ActiveSync
    2008-05-02 21:41 --------- d-----w C:\Program Files\DC++
    2008-04-18 12:05 --------- d-----w C:\Program Files\Windows Live Toolbar
    2008-04-18 12:02 --------- d-----w C:\Program Files\Windows Live
    2008-04-18 11:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-04-18 11:35 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-04-11 16:31 --------- d-----w C:\Program Files\Lavalys
    2008-03-27 08:12 151,583 ------w C:\WINDOWS\system32\msjint40.dll
    2008-03-26 20:04 38,400 --sh--r C:\WINDOWS\msn.com
    2008-03-21 15:37 499,568 ----a-w C:\Program Files\hijackthis_v2.0.2.zip
    2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-02-22 17:19 4,129,768 ----a-w C:\Program Files\DCPlusPlus-0.699.exe
    2007-12-19 14:47 87,608 ----a-w C:\Documents and Settings\User\Application Data\ezpinst.exe
    2007-12-19 14:47 47,360 ----a-w C:\Documents and Settings\User\Application Data\pcouffin.sys
    2007-06-30 11:34 5,632 --sha-w C:\Program Files\Thumbs.db
    2006-01-27 07:34 20,784 ----a-w C:\Documents and Settings\User\Application Data\GDIPFONTCACHEV1.DAT
    2005-10-17 20:43 62 ----a-w C:\Program Files\Warez P2P ClientIPGUARD.LOG
    2004-03-11 11:27 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
    2007-06-13 10:23 290,110 --sh--r C:\WINDOWS\system32\wplayer.exe
    .

    ((((((((((((((((((((((((((((( snapshot@2008-06-08_15.02.35.12 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-06-08 11:56:57 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-08 12:21:21 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    - 2008-06-08 11:57:12 230,104 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
    + 2008-06-08 12:21:36 230,104 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
    - 2008-06-08 10:52:24 111,210 ----a-w C:\WINDOWS\system32\perfc009.dat
    + 2008-06-08 12:26:05 111,210 ----a-w C:\WINDOWS\system32\perfc009.dat
    - 2008-06-08 10:52:24 550,312 ----a-w C:\WINDOWS\system32\perfh009.dat
    + 2008-06-08 12:26:05 550,312 ----a-w C:\WINDOWS\system32\perfh009.dat
    + 2008-06-08 12:21:31 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_3c4.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
    2007-10-04 23:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-10-04 23:06 1135968]

    [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
    [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
    "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 23:06 1135968]

    [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
    [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-24 16:16 401491]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ADSL_A2"="A2Installed" []
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-15 17:20 6803456]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-06-15 17:20 86016]
    "IntelliType"="C:\Program Files\Microsoft Hardware\Keyboard\type32.exe" [2002-03-22 07:41 94208]
    "nwiz"="nwiz.exe" [2005-06-15 17:20 1519616 C:\WINDOWS\system32\nwiz.exe]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
    "RegistryMechanic"="" []
    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-01-22 13:00 180269]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
    "BigDogPath"="C:\WINDOWS\VM_STI.exe" [2003-01-21 10:19 40960]
    "Windows svchost"="service.exe" []
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]
    "MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.exe" [2004-08-04 10:56 158208]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 10:56 15360]
    "MSN Updater"="msnms.exe" []
    "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 13:01:04 83360]
    PDF-Capture.lnk - C:\Program Files\PDF-XChangeSDKEU\PDFSaver.exe [2005-05-12 09:24:26 61440]
    VPN Client.lnk - C:\WINDOWS\Installer\{24C67B54-0718-445E-B663-3138D9246BD1}\Icon3E5562ED7.ico [2006-09-09 21:44:36 6144]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=C:\WINDOWS\system32\wmfhotfix.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.DIV3"= DivXc32.dll
    "vidc.DIV4"= DivXc32f.dll
    "vidc.3iv2"= 3ivxVfWCodec.dll
    "msacm.divxa32"= divxa32.acm
    "VIDC.HFYU"= huffyuv.dll
    "VIDC.VP31"= vp31vfw.dll
    "vidc.asv2"= asusasv2.dll
    "MSACM.CEGSM"= mobilev.acm
    "vidc.ffds"= ffdshow.ax
    "VIDC.MJPG"= Pvmjpg30.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    --------- 2004-10-13 19:24 1694208 C:\Program Files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "xmlprov"=3 (0x3)
    "AVG Anti-Spyware Guard"=2 (0x2)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "C:\\WINDOWS\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Outlook Express\\msimn.exe"=
    "C:\\Program Files\\Internet Explorer\\iexplore.exe"=
    "C:\\WINDOWS\\system32\\dpvsetup.exe"=
    "C:\\WINDOWS\\system32\\javaw.exe"=
    "C:\\Program Files\\DC++\\DCPlusPlus.exe"=
    "C:\\Program Files\\Common Files\\Microsoft Shared\\Windows CE Tools\\Platman\\bin\\cemgr.exe"=
    "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"=
    "C:\\Program Files\\Web Publish\\WPWIZ.EXE"=
    "C:\\Program Files\\Java\\jdk1.5.0_02\\jre\\bin\\java.exe"=
    "C:\\Documents and Settings\\User\\.netbeans\\5.0\\emulators\\wtk22_win\\emulator\\wtk22\\bin\\emulator.exe"=
    "C:\\Documents and Settings\\User\\.netbeans\\5.0\\emulators\\wtk22_win\\emulator\\wtk22\\bin\\zayit.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "E:\\Program Files\\Sony Ericsson\\Update Service\\ma3platform.exe"=
    "C:\\Program Files\\Elisa\\Avustaja\\Elisa.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "25:TCP"= 25:TCP:smtp
    "3389:TCP"= 3389:TCP:mad:xpsp2res.dll,-22009
    "23457:TCP"= 23457:TCP:eMule
    "23457:UDP"= 23457:UDP:emule
    "9842:TCP"= 9842:TCP:*:Disabled:SolidNetworkManager
    "9842:UDP"= 9842:UDP:*:Disabled:SolidNetworkManager

    R0 d343bus;d343bus;C:\WINDOWS\system32\DRIVERS\d343bus.sys [2003-12-15 18:46]
    R0 d343port;d343port;C:\WINDOWS\system32\DRIVERS\d343port.sys [2003-12-15 17:29]
    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
    R2 MLPTDR_N;MLPTDR_N;C:\WINDOWS\system32\MLPTDR_N.sys [2003-07-17 16:44]
    R2 MSF32;MSF32;C:\Program Files\MySecretFolder XP\MSF32.SYS [2007-01-25 01:00]
    R3 ncfvsbus;NCF Virtual Serial Bus Enumerator;C:\WINDOWS\system32\DRIVERS\ncfvsbus.sys [2004-11-26 12:15]
    R3 ZSMC302;Audio Web Cam 31;C:\WINDOWS\system32\Drivers\usbvm302.sys [2004-03-22 11:22]
    S3 itexadsla2;TW-IA300 Service;C:\WINDOWS\system32\DRIVERS\TWIn95a2.sys [2001-11-05 19:00]
    S3 SER120;OTI Serial port driver;C:\WINDOWS\system32\DRIVERS\SER120.sys [2004-11-23 04:59]
    S3 z520bus;Sony Ericsson 520 driver (WDM);C:\WINDOWS\system32\DRIVERS\z520bus.sys [2005-07-26 12:13]
    S3 z520mdfl;Sony Ericsson 520 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\z520mdfl.sys [2005-07-26 12:15]
    S3 z520mdm;Sony Ericsson 520 USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\z520mdm.sys [2005-07-26 12:15]
    S3 z520mgmt;Sony Ericsson 520 USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\z520mgmt.sys [2005-07-26 12:16]
    S3 z520obex;Sony Ericsson 520 USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\z520obex.sys [2005-07-26 12:18]

    *Newly Created Service* - MNMSRVC
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-06-08 12:28:00 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-08 15:53:11
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet002\Services\MySQL]
    "ImagePath"="\"C:\wamp\mysql\bin\bin\mysqld-nt\" --defaults-file=\"C:\wamp\mysql\bin\my.ini\" MySQL"
    .
    Completion time: 2008-06-08 15:54:25
    ComboFix-quarantined-files.txt 2008-06-08 12:53:47
    ComboFix2.txt 2008-06-08 12:30:04

    Pre-Run: 21,523,492,864 bytes free
    Post-Run: 21,508,030,464 bytes free

    216 --- E O F --- 2008-06-05 21:33:21
     
    kiisselia, 08.06.2008
    #8
  10. kiisselia

    kiisselia Regular member

    Liittynyt:
    13.12.2006
    Viestejä:
    125
    Kiitokset:
    0
    Pisteet:
    26
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 16:03:42, on 8.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    C:\WINDOWS\system32\inetsrv\inetinfo.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\UAService7.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\VM_STI.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
    C:\Program Files\PDF-XChangeSDKEU\PDFSaver.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/wdgt3/*http://www.yahoo.com/ext/search/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R3 - URLSearchHook: Advanced Searchbar - {57F02779-3D88-4958-8AD3-83C12D86ADC7} - C:\Program Files\AdvancedSearchbar\advancedsearchbar.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: Advanced Searchbar - {CDEEC43D-3572-4E95-A2A5-F519D29F00C0} - C:\PROGRA~1\ADVANC~1\ADVANC~1.DLL
    O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
    O3 - Toolbar: Advanced Searchbar - {57F02779-3D88-4958-8AD3-83C12D86ADC7} - C:\Program Files\AdvancedSearchbar\advancedsearchbar.dll
    O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [ADSL_A2] A2Installed
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Audio Web Cam 31
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: PDF-Capture.lnk = C:\Program Files\PDF-XChangeSDKEU\PDFSaver.exe
    O4 - Global Startup: VPN Client.lnk = ?
    O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Matkaviestimen suosikkien luominen - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
    O9 - Extra 'Tools' menuitem: Matkaviestimen suosikkien luominen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
    O9 - Extra button: Advanced Searchbar - {57F02779-3D88-4958-8AD3-83C12D86ADC7} - C:\Program Files\AdvancedSearchbar\advancedsearchbar.dll
    O9 - Extra 'Tools' menuitem: Advanced Searchbar - {57F02779-3D88-4958-8AD3-83C12D86ADC7} - C:\Program Files\AdvancedSearchbar\advancedsearchbar.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1106078188394
    O16 - DPF: {6EE39BFC-2FB6-4B69-9D05-CFC10E4F5B3E} (MavenBootInstallerAXControl Class) - http://client.maven.net/client/mavenBootInstaller.cab
    O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://www.lumonetti.fi/portaali/Virusskanneri/OLS3/fscax.cab
    O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinktanks/BTDownloadCtrl.cab
    O20 - AppInit_DLLs: C:\WINDOWS\system32\wmfhotfix.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: MSSQL$PINNACLESYS - Unknown owner - I:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe (file missing)
    O23 - Service: MySQL - Unknown owner - C:\wamp\mysql\bin\bin\mysqld-nt (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Unknown owner - I:\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe (file missing)
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: SQLAgent$PINNACLESYS - Unknown owner - I:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE (file missing)
    O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

    --
    End of file - 10712 bytes
     
    kiisselia, 08.06.2008
    #9
  11. Hujo

    Hujo Guest

    sammuta ja käynnistä

    =============

    scannaa uusi combofix loki

     
    Hujo, 08.06.2008
    #10
  12. kiisselia

    kiisselia Regular member

    Liittynyt:
    13.12.2006
    Viestejä:
    125
    Kiitokset:
    0
    Pisteet:
    26
    ComboFix 08-06-07.3 - User 2008-06-08 16:20:32.5 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.957 [GMT 3:00]
    Running from: C:\Documents and Settings\User\Desktop\ComboFix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((( Files Created from 2008-05-08 to 2008-06-08 )))))))))))))))))))))))))))))))
    .

    2080-04-06 17:51 . 2080-04-06 17:51 <DIR> d-------- C:\Program Files\7-Zip
    2080-04-06 14:56 . 2004-08-04 08:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
    2080-03-28 16:11 . 2080-03-28 16:14 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
    2080-03-27 17:32 . 2080-03-27 17:32 <DIR> d-------- C:\Documents and Settings\User\Application Data\Malwarebytes
    2080-03-27 17:31 . 2080-03-27 17:31 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2080-03-27 15:59 . 2080-03-27 15:59 <DIR> d-------- C:\WINDOWS\ERUNT
    2080-03-27 15:21 . 2080-03-27 15:21 <DIR> d-------- C:\Documents and Settings\User\Application Data\Grisoft
    2080-03-27 15:20 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2080-03-26 23:17 . 2080-03-26 23:17 <DIR> d-------- C:\fsaua.data
    2008-06-08 13:48 . 2008-06-08 13:48 2,231 --a------ C:\sjgz.exe
    2008-06-08 13:48 . 2008-06-08 13:48 2,231 --a------ C:\shz.exe
    2008-06-08 13:48 . 2008-06-08 13:48 2,230 --a------ C:\is154890.exe
    2008-06-06 00:23 . 2008-06-06 00:23 49,156 --a------ C:\fs.exe
    2008-06-06 00:15 . 2008-06-06 00:16 49,156 --a------ C:\Documents and Settings\User\f.exe
    2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
    2008-06-04 22:00 . 2008-06-04 22:00 86,528 --a------ C:\Documents and Settings\User\stp.exe
    2008-06-04 21:59 . 2008-06-04 22:06 86,528 --a------ C:\stp.exe
    2008-06-03 23:40 . 2008-06-03 23:40 202,210 --a------ C:\sxy.exe
    2008-06-03 19:53 . 2008-06-03 19:53 4,217 --a------ C:\WINDOWS\is154890.exe
    2008-06-03 18:37 . 2008-06-03 23:24 86,548 --a------ C:\Documents and Settings\User\setupa.exe
    2008-06-03 18:32 . 2008-06-03 18:32 86,548 --a------ C:\setz.exe
    2008-06-03 18:10 . 2008-06-03 23:05 86,548 --a------ C:\ssetup.exe
    2008-06-02 22:30 . 2008-06-02 22:30 97,116 --a------ C:\WINDOWS\DC5177176.zip
    2008-06-02 21:23 . 2008-06-02 21:23 96,950 -r-hs---- C:\WINDOWS\mservice.exe
    2008-06-02 21:23 . 2008-06-02 21:28 96,950 --a------ C:\stup.exe
    2008-06-02 19:00 . 2008-06-03 18:18 60,114 --a------ C:\bot1.exe
    2008-05-26 22:23 . 2008-05-26 22:32 <DIR> d-------- C:\Program Files\mIRC
    2008-05-26 22:23 . 2008-05-26 22:34 <DIR> d-------- C:\Documents and Settings\User\Application Data\mIRC
    2008-05-19 17:48 . 2003-07-11 06:12 159,799 -ra------ C:\WINDOWS\system32\vm302prp.ax
    2008-05-19 17:48 . 2002-08-22 11:34 147,456 -ra------ C:\WINDOWS\vmcap.exe
    2008-05-19 17:48 . 2004-03-22 11:22 90,559 -ra------ C:\WINDOWS\system32\drivers\usbvm302.sys
    2008-05-19 17:48 . 2003-05-15 12:16 61,440 -ra------ C:\WINDOWS\system32\vm302sti.dll
    2008-05-19 17:48 . 2002-10-16 04:29 49,152 -ra------ C:\WINDOWS\amcap.exe
    2008-05-19 17:48 . 2003-01-21 10:19 40,960 -ra------ C:\WINDOWS\VM_STI.EXE
    2008-05-14 19:16 . 2008-05-14 20:49 122 --a------ C:\WINDOWS\blank

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2080-03-28 13:41 --------- d-----w C:\Program Files\Common Files\SupportSoft
    2080-03-28 13:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier
    2080-03-27 14:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2080-03-27 12:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
    2080-03-27 12:00 --------- d-----w C:\Program Files\Ahead
    2080-03-27 11:59 --------- d-----w C:\Program Files\Common Files\Ahead
    2080-03-27 11:57 --------- d-----w C:\Program Files\MultiMaker Studio Exam 8.0 Academic
    2080-03-27 11:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2080-03-27 11:52 --------- d-----w C:\Program Files\Macromedia
    2080-03-27 11:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-06-08 11:46 --------- d-----w C:\Program Files\DivX
    2008-06-05 21:32 --------- d-----w C:\Program Files\Microsoft ActiveSync
    2008-05-02 21:41 --------- d-----w C:\Program Files\DC++
    2008-04-18 12:05 --------- d-----w C:\Program Files\Windows Live Toolbar
    2008-04-18 12:02 --------- d-----w C:\Program Files\Windows Live
    2008-04-18 11:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-04-18 11:35 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-04-11 16:31 --------- d-----w C:\Program Files\Lavalys
    2008-03-27 08:12 151,583 ------w C:\WINDOWS\system32\msjint40.dll
    2008-03-26 20:04 38,400 --sh--r C:\WINDOWS\msn.com
    2008-03-21 15:37 499,568 ----a-w C:\Program Files\hijackthis_v2.0.2.zip
    2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-02-22 17:19 4,129,768 ----a-w C:\Program Files\DCPlusPlus-0.699.exe
    2007-12-19 14:47 87,608 ----a-w C:\Documents and Settings\User\Application Data\ezpinst.exe
    2007-12-19 14:47 47,360 ----a-w C:\Documents and Settings\User\Application Data\pcouffin.sys
    2007-06-30 11:34 5,632 --sha-w C:\Program Files\Thumbs.db
    2006-01-27 07:34 20,784 ----a-w C:\Documents and Settings\User\Application Data\GDIPFONTCACHEV1.DAT
    2005-10-17 20:43 62 ----a-w C:\Program Files\Warez P2P ClientIPGUARD.LOG
    2004-03-11 11:27 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
    2007-06-13 10:23 290,110 --sh--r C:\WINDOWS\system32\wplayer.exe
    .

    ((((((((((((((((((((((((((((( snapshot@2008-06-08_15.02.35.12 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-06-08 10:48:28 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla.dll
    + 2008-06-08 13:19:39 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla.dll
    - 2008-06-08 10:48:26 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla18.dll
    + 2008-06-08 13:19:38 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla18.dll
    - 2008-06-08 10:48:30 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla21.dll
    + 2008-06-08 13:19:41 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla21.dll
    - 2008-06-08 10:48:20 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla22.dll
    + 2008-06-08 13:19:35 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla22.dll
    - 2008-06-08 10:48:31 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla23.dll
    + 2008-06-08 13:19:42 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla23.dll
    - 2008-06-08 10:48:19 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla24.dll
    + 2008-06-08 13:19:35 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla24.dll
    - 2008-06-08 10:48:31 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla25.dll
    + 2008-06-08 13:19:43 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla25.dll
    - 2008-06-08 10:48:32 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla26.dll
    + 2008-06-08 13:19:44 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla26.dll
    - 2008-06-08 10:48:23 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla27.dll
    + 2008-06-08 13:19:36 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla27.dll
    - 2008-06-08 10:48:29 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla33.dll
    + 2008-06-08 13:19:40 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla33.dll
    - 2008-06-08 10:48:19 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla35.dll
    + 2008-06-08 13:19:34 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla35.dll
    - 2008-06-08 10:48:33 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla36.dll
    + 2008-06-08 13:19:44 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla36.dll
    - 2008-06-08 10:48:26 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla37.dll
    + 2008-06-08 13:19:37 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla37.dll
    - 2008-06-08 10:48:19 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla38.dll
    + 2008-06-08 13:19:35 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla38.dll
    - 2008-06-08 10:48:27 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla39.dll
    + 2008-06-08 13:19:38 29,744 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla39.dll
    - 2008-06-08 10:48:29 111,476 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla41.dll
    + 2008-06-08 13:19:40 111,476 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla41.dll
    - 2008-06-08 10:48:26 111,269 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla42.dll
    + 2008-06-08 13:19:37 111,269 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla42.dll
    - 2008-06-08 10:48:17 111,260 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla43.dll
    + 2008-06-08 13:19:33 111,260 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla43.dll
    - 2008-06-08 10:48:15 110,500 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla44.dll
    + 2008-06-08 13:19:31 110,500 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla44.dll
    - 2008-06-08 10:48:24 110,797 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla46.dll
    + 2008-06-08 13:19:37 110,797 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla46.dll
    - 2008-06-08 10:48:18 110,936 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla47.dll
    + 2008-06-08 13:19:34 110,936 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla47.dll
    - 2008-06-08 10:48:16 116,956 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla48.dll
    + 2008-06-08 13:19:32 116,956 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla48.dll
    - 2008-06-08 10:48:22 110,799 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla49.dll
    + 2008-06-08 13:19:36 110,799 ----a-w C:\WINDOWS\24C67B540718445EB6633138D9246BD1.TMP\WiseCustomCalla49.dll
    - 2008-06-08 11:56:57 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-08 13:18:36 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    - 2008-06-08 11:57:12 230,104 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
    + 2008-06-08 13:18:47 230,103 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
    - 2008-06-08 10:52:24 111,210 ----a-w C:\WINDOWS\system32\perfc009.dat
    + 2008-06-08 13:23:15 111,210 ----a-w C:\WINDOWS\system32\perfc009.dat
    - 2008-06-08 10:52:24 550,312 ----a-w C:\WINDOWS\system32\perfh009.dat
    + 2008-06-08 13:23:15 550,312 ----a-w C:\WINDOWS\system32\perfh009.dat
    + 2008-06-08 13:18:41 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_730.dat
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
    2007-10-04 23:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-10-04 23:06 1135968]

    [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
    [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
    "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 23:06 1135968]

    [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
    [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-24 16:16 401491]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ADSL_A2"="A2Installed" []
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-15 17:20 6803456]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-06-15 17:20 86016]
    "IntelliType"="C:\Program Files\Microsoft Hardware\Keyboard\type32.exe" [2002-03-22 07:41 94208]
    "nwiz"="nwiz.exe" [2005-06-15 17:20 1519616 C:\WINDOWS\system32\nwiz.exe]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
    "RegistryMechanic"="" []
    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-01-22 13:00 180269]
    "BigDogPath"="C:\WINDOWS\VM_STI.exe" [2003-01-21 10:19 40960]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 10:56 15360]
    "MSN Updater"="msnms.exe" []
    "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]

    C:\Documents and Settings\User\Start Menu\Programs\Startup\
    ubisoft register.lnk - C:\Program Files\Ubi Soft\Register\schedule.exe [2007-10-15 20:39:45 28672]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 13:01:04 83360]
    PDF-Capture.lnk - C:\Program Files\PDF-XChangeSDKEU\PDFSaver.exe [2005-05-12 09:24:26 61440]
    VPN Client.lnk - C:\WINDOWS\Installer\{24C67B54-0718-445E-B663-3138D9246BD1}\Icon3E5562ED7.ico [2006-09-09 21:44:36 6144]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=C:\WINDOWS\system32\wmfhotfix.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.DIV3"= DivXc32.dll
    "vidc.DIV4"= DivXc32f.dll
    "vidc.3iv2"= 3ivxVfWCodec.dll
    "msacm.divxa32"= divxa32.acm
    "VIDC.HFYU"= huffyuv.dll
    "VIDC.VP31"= vp31vfw.dll
    "vidc.asv2"= asusasv2.dll
    "MSACM.CEGSM"= mobilev.acm
    "vidc.ffds"= ffdshow.ax
    "VIDC.MJPG"= Pvmjpg30.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    --------- 2004-10-13 19:24 1694208 C:\Program Files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "xmlprov"=3 (0x3)
    "AVG Anti-Spyware Guard"=2 (0x2)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "C:\\WINDOWS\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Outlook Express\\msimn.exe"=
    "C:\\Program Files\\Internet Explorer\\iexplore.exe"=
    "C:\\WINDOWS\\system32\\dpvsetup.exe"=
    "C:\\WINDOWS\\system32\\javaw.exe"=
    "C:\\Program Files\\DC++\\DCPlusPlus.exe"=
    "C:\\Program Files\\Common Files\\Microsoft Shared\\Windows CE Tools\\Platman\\bin\\cemgr.exe"=
    "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"=
    "C:\\Program Files\\Web Publish\\WPWIZ.EXE"=
    "C:\\Program Files\\Java\\jdk1.5.0_02\\jre\\bin\\java.exe"=
    "C:\\Documents and Settings\\User\\.netbeans\\5.0\\emulators\\wtk22_win\\emulator\\wtk22\\bin\\emulator.exe"=
    "C:\\Documents and Settings\\User\\.netbeans\\5.0\\emulators\\wtk22_win\\emulator\\wtk22\\bin\\zayit.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "E:\\Program Files\\Sony Ericsson\\Update Service\\ma3platform.exe"=
    "C:\\Program Files\\Elisa\\Avustaja\\Elisa.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "25:TCP"= 25:TCP:smtp
    "3389:TCP"= 3389:TCP:mad:xpsp2res.dll,-22009
    "23457:TCP"= 23457:TCP:eMule
    "23457:UDP"= 23457:UDP:emule
    "9842:TCP"= 9842:TCP:*:Disabled:SolidNetworkManager
    "9842:UDP"= 9842:UDP:*:Disabled:SolidNetworkManager

    R0 d343bus;d343bus;C:\WINDOWS\system32\DRIVERS\d343bus.sys [2003-12-15 18:46]
    R0 d343port;d343port;C:\WINDOWS\system32\DRIVERS\d343port.sys [2003-12-15 17:29]
    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
    R2 MLPTDR_N;MLPTDR_N;C:\WINDOWS\system32\MLPTDR_N.sys [2003-07-17 16:44]
    R2 MSF32;MSF32;C:\Program Files\MySecretFolder XP\MSF32.SYS [2007-01-25 01:00]
    R3 ncfvsbus;NCF Virtual Serial Bus Enumerator;C:\WINDOWS\system32\DRIVERS\ncfvsbus.sys [2004-11-26 12:15]
    R3 ZSMC302;Audio Web Cam 31;C:\WINDOWS\system32\Drivers\usbvm302.sys [2004-03-22 11:22]
    S3 itexadsla2;TW-IA300 Service;C:\WINDOWS\system32\DRIVERS\TWIn95a2.sys [2001-11-05 19:00]
    S3 SER120;OTI Serial port driver;C:\WINDOWS\system32\DRIVERS\SER120.sys [2004-11-23 04:59]
    S3 z520bus;Sony Ericsson 520 driver (WDM);C:\WINDOWS\system32\DRIVERS\z520bus.sys [2005-07-26 12:13]
    S3 z520mdfl;Sony Ericsson 520 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\z520mdfl.sys [2005-07-26 12:15]
    S3 z520mdm;Sony Ericsson 520 USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\z520mdm.sys [2005-07-26 12:15]
    S3 z520mgmt;Sony Ericsson 520 USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\z520mgmt.sys [2005-07-26 12:16]
    S3 z520obex;Sony Ericsson 520 USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\z520obex.sys [2005-07-26 12:18]

    *Newly Created Service* - CATCHME
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-06-08 12:28:00 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-08 16:25:11
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet002\Services\MySQL]
    "ImagePath"="\"C:\wamp\mysql\bin\bin\mysqld-nt\" --defaults-file=\"C:\wamp\mysql\bin\my.ini\" MySQL"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    PROCESS: C:\WINDOWS\system32\winlogon.exe
    -> C:\WINDOWS\system32\wmfhotfix.dll

    PROCESS: C:\WINDOWS\system32\lsass.exe
    -> C:\WINDOWS\system32\wmfhotfix.dll
    .
    Completion time: 2008-06-08 16:26:32
    ComboFix-quarantined-files.txt 2008-06-08 13:26:13
    ComboFix2.txt 2008-06-08 12:54:28
    ComboFix3.txt 2008-06-08 12:30:04

    Pre-Run: 21,575,741,440 bytes free
    Post-Run: 21,557,362,688 bytes free

    268 --- E O F --- 2008-06-05 21:33:21
     
    kiisselia, 08.06.2008
    #11
  13. Hujo

    Hujo Guest

    nyt sun jutuissa joku mättäää
    _________

    Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

    Tallenna se nimellä CFScript.txt

    Sitten raahaa CFScript ComboFix.exeen kuten alla.
    [​IMG]

    Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.


    =================

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi.
     
    Moderaattorin viimeksi muokkaama: 08.06.2008
    Hujo, 08.06.2008
    #12
  14. kiisselia

    kiisselia Regular member

    Liittynyt:
    13.12.2006
    Viestejä:
    125
    Kiitokset:
    0
    Pisteet:
    26
    Ajoin aikaisemmin!

    Malwarebytes' Anti-Malware 1.09
    Tietokantaversio: 552

    Tarkistustyyppi: Täysi tarkistus (A:\|C:\|E:\|F:\|G:\|)
    Tarkistetut kohteet: 188366
    Kulunut aika: 50 minute(s), 1 second(s)

    Saastuneita muistiprosesseja: 0
    Saastuneita muistimoduuleja: 0
    Saastuneita rekisteriavaimia: 0
    Saastuneita rekisteriarvoja: 0
    Saastuneita rekisterikohteita: 0
    Saastuneita hakemistoja: 0
    Saastuneita tiedostoja: 2

    Saastuneita muistiprosesseja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita muistimoduuleja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriavaimia:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisteriarvoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita rekisterikohteita:
    (Haitallisia kohteita ei löydetty)

    Saastuneita hakemistoja:
    (Haitallisia kohteita ei löydetty)

    Saastuneita tiedostoja:
    C:\bot.exe (Trojan.Downloader) -> No action taken.
    C:\Documents and Settings\User\setup.exe (Trojan.Dropper) -> No action taken.


    Ajan vielä uudestaan
     
    kiisselia, 08.06.2008
    #13
  15. Hujo

    Hujo Guest

    kato laitoin sen tuohon ylös
     
    Hujo, 08.06.2008
    #14
  16. kiisselia

    kiisselia Regular member

    Liittynyt:
    13.12.2006
    Viestejä:
    125
    Kiitokset:
    0
    Pisteet:
    26
    ComboFix 08-06-07.3 - User 2008-06-08 16:56:20.6 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1019 [GMT 3:00]
    Running from: C:\Documents and Settings\User\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\User\Desktop\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\bot1.exe
    C:\Documents and Settings\User\f.exe
    C:\Documents and Settings\User\setupa.exe
    C:\Documents and Settings\User\stp.exe
    C:\fs.exe
    C:\fsaua.data
    C:\is154890.exe
    C:\setz.exe
    C:\shz.exe
    C:\sjgz.exe
    C:\ssetup.exe
    C:\stp.exe
    C:\stup.exe
    C:\sxy.exe
    C:\WINDOWS\DC5177176.zip
    C:\WINDOWS\is154890.exe
    C:\WINDOWS\mservice.exe
    C:\WINDOWS\msn.com
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\bot1.exe
    C:\Documents and Settings\User\f.exe
    C:\Documents and Settings\User\setupa.exe
    C:\Documents and Settings\User\stp.exe
    C:\fs.exe
    C:\is154890.exe
    C:\setz.exe
    C:\shz.exe
    C:\sjgz.exe
    C:\ssetup.exe
    C:\stp.exe
    C:\stup.exe
    C:\sxy.exe
    C:\WINDOWS\DC5177176.zip
    C:\WINDOWS\is154890.exe
    C:\WINDOWS\mservice.exe
    C:\WINDOWS\msn.com

    .
    ((((((((((((((((((((((((( Files Created from 2008-05-08 to 2008-06-08 )))))))))))))))))))))))))))))))
    .

    2080-04-06 17:51 . 2080-04-06 17:51 <DIR> d-------- C:\Program Files\7-Zip
    2080-04-06 14:56 . 2004-08-04 08:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
    2080-03-28 16:12 . 2080-03-28 16:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
    2080-03-28 16:11 . 2080-03-28 16:14 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
    2080-03-27 17:32 . 2080-03-27 17:32 <DIR> d-------- C:\Documents and Settings\User\Application Data\Malwarebytes
    2080-03-27 17:31 . 2080-03-27 17:31 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2080-03-27 17:31 . 2080-03-27 17:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2080-03-27 15:59 . 2080-03-27 15:59 <DIR> d-------- C:\WINDOWS\ERUNT
    2080-03-27 15:21 . 2080-03-27 15:21 <DIR> d-------- C:\Documents and Settings\User\Application Data\Grisoft
    2080-03-27 15:20 . 2080-03-27 15:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2080-03-27 15:20 . 2007-05-30 15:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2080-03-26 23:17 . 2080-03-26 23:17 <DIR> d-------- C:\fsaua.data
    2008-06-08 16:41 . 2008-06-08 16:41 <DIR> d-------- C:\Documents and Settings\User\Application Data\TVU Networks
    2008-06-08 16:40 . 2008-06-08 16:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TVU Networks
    2008-06-08 16:39 . 2008-06-08 16:39 <DIR> d-------- C:\Program Files\TVUPlayer
    2008-06-08 16:39 . 2008-06-08 16:39 <DIR> d-------- C:\Documents and Settings\User\LocalLow
    2008-06-05 00:15 . 2008-06-05 00:15 290,110 --a------ C:\WINDOWS\ftp.exe
    2008-05-26 22:23 . 2008-05-26 22:32 <DIR> d-------- C:\Program Files\mIRC
    2008-05-26 22:23 . 2008-05-26 22:34 <DIR> d-------- C:\Documents and Settings\User\Application Data\mIRC
    2008-05-19 17:48 . 2003-07-11 06:12 159,799 -ra------ C:\WINDOWS\system32\vm302prp.ax
    2008-05-19 17:48 . 2002-08-22 11:34 147,456 -ra------ C:\WINDOWS\vmcap.exe
    2008-05-19 17:48 . 2004-03-22 11:22 90,559 -ra------ C:\WINDOWS\system32\drivers\usbvm302.sys
    2008-05-19 17:48 . 2003-05-15 12:16 61,440 -ra------ C:\WINDOWS\system32\vm302sti.dll
    2008-05-19 17:48 . 2002-10-16 04:29 49,152 -ra------ C:\WINDOWS\amcap.exe
    2008-05-19 17:48 . 2003-01-21 10:19 40,960 -ra------ C:\WINDOWS\VM_STI.EXE
    2008-05-14 19:16 . 2008-05-14 20:49 122 --a------ C:\WINDOWS\blank

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2080-03-28 13:41 --------- d-----w C:\Program Files\Common Files\SupportSoft
    2080-03-27 12:00 --------- d-----w C:\Program Files\Ahead
    2080-03-27 11:59 --------- d-----w C:\Program Files\Common Files\Ahead
    2080-03-27 11:57 --------- d-----w C:\Program Files\MultiMaker Studio Exam 8.0 Academic
    2080-03-27 11:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2080-03-27 11:52 --------- d-----w C:\Program Files\Macromedia
    2080-03-27 11:51 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-06-08 11:46 --------- d-----w C:\Program Files\DivX
    2008-06-05 21:32 --------- d-----w C:\Program Files\Microsoft ActiveSync
    2008-05-02 21:41 --------- d-----w C:\Program Files\DC++
    2008-04-30 14:09 3,187,458 ----a-w C:\Program Files\Setup-SopCast-3.0.3-2008-4-30.exe
    2008-04-30 14:07 3,813 ----a-w C:\Program Files\changeLog.txt
    2008-04-18 12:05 --------- d-----w C:\Program Files\Windows Live Toolbar
    2008-04-18 12:02 --------- d-----w C:\Program Files\Windows Live
    2008-04-18 11:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-04-18 11:35 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-04-11 16:31 --------- d-----w C:\Program Files\Lavalys
    2008-03-27 08:12 151,583 ------w C:\WINDOWS\system32\msjint40.dll
    2008-03-21 15:37 499,568 ----a-w C:\Program Files\hijackthis_v2.0.2.zip
    2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-02-22 17:19 4,129,768 ----a-w C:\Program Files\DCPlusPlus-0.699.exe
    2007-12-19 14:47 87,608 ----a-w C:\Documents and Settings\User\Application Data\ezpinst.exe
    2007-12-19 14:47 47,360 ----a-w C:\Documents and Settings\User\Application Data\pcouffin.sys
    2007-06-30 11:34 5,632 --sha-w C:\Program Files\Thumbs.db
    2006-01-27 07:34 20,784 ----a-w C:\Documents and Settings\User\Application Data\GDIPFONTCACHEV1.DAT
    2005-10-17 20:43 62 ----a-w C:\Program Files\Warez P2P ClientIPGUARD.LOG
    2004-03-11 11:27 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
    2007-06-13 10:23 290,110 --sh--r C:\WINDOWS\system32\wplayer.exe
    .

    ((((((((((((((((((((((((((((( snapshot_2008-06-08_16.26.03,42 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2006-10-18 09:32:38 807,032 ----a-w C:\WINDOWS\system32\wmv9dmod.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
    2007-10-04 23:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-10-04 23:06 1135968]

    [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
    [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
    "{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 23:06 1135968]

    [HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
    [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
    [HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-24 16:16 401491]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ADSL_A2"="A2Installed" []
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-15 17:20 6803456]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-06-15 17:20 86016]
    "IntelliType"="C:\Program Files\Microsoft Hardware\Keyboard\type32.exe" [2002-03-22 07:41 94208]
    "nwiz"="nwiz.exe" [2005-06-15 17:20 1519616 C:\WINDOWS\system32\nwiz.exe]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
    "RegistryMechanic"="" []
    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-01-22 13:00 180269]
    "BigDogPath"="C:\WINDOWS\VM_STI.exe" [2003-01-21 10:19 40960]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 12:25 6731312]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 10:56 15360]
    "MSN Updater"="msnms.exe" []
    "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]

    C:\Documents and Settings\User\Start Menu\Programs\Startup\
    ubisoft register.lnk - C:\Program Files\Ubi Soft\Register\schedule.exe [2007-10-15 20:39:45 28672]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 13:01:04 83360]
    PDF-Capture.lnk - C:\Program Files\PDF-XChangeSDKEU\PDFSaver.exe [2005-05-12 09:24:26 61440]
    VPN Client.lnk - C:\WINDOWS\Installer\{24C67B54-0718-445E-B663-3138D9246BD1}\Icon3E5562ED7.ico [2006-09-09 21:44:36 6144]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=C:\WINDOWS\system32\wmfhotfix.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "vidc.DIV3"= DivXc32.dll
    "vidc.DIV4"= DivXc32f.dll
    "vidc.3iv2"= 3ivxVfWCodec.dll
    "msacm.divxa32"= divxa32.acm
    "VIDC.HFYU"= huffyuv.dll
    "VIDC.VP31"= vp31vfw.dll
    "vidc.asv2"= asusasv2.dll
    "MSACM.CEGSM"= mobilev.acm
    "vidc.ffds"= ffdshow.ax
    "VIDC.MJPG"= Pvmjpg30.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    --------- 2004-10-13 19:24 1694208 C:\Program Files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "xmlprov"=3 (0x3)
    "AVG Anti-Spyware Guard"=2 (0x2)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "C:\\WINDOWS\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Outlook Express\\msimn.exe"=
    "C:\\Program Files\\Internet Explorer\\iexplore.exe"=
    "C:\\WINDOWS\\system32\\dpvsetup.exe"=
    "C:\\WINDOWS\\system32\\javaw.exe"=
    "C:\\Program Files\\DC++\\DCPlusPlus.exe"=
    "C:\\Program Files\\Common Files\\Microsoft Shared\\Windows CE Tools\\Platman\\bin\\cemgr.exe"=
    "C:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"=
    "C:\\Program Files\\Web Publish\\WPWIZ.EXE"=
    "C:\\Program Files\\Java\\jdk1.5.0_02\\jre\\bin\\java.exe"=
    "C:\\Documents and Settings\\User\\.netbeans\\5.0\\emulators\\wtk22_win\\emulator\\wtk22\\bin\\emulator.exe"=
    "C:\\Documents and Settings\\User\\.netbeans\\5.0\\emulators\\wtk22_win\\emulator\\wtk22\\bin\\zayit.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "E:\\Program Files\\Sony Ericsson\\Update Service\\ma3platform.exe"=
    "C:\\Program Files\\Elisa\\Avustaja\\Elisa.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "25:TCP"= 25:TCP:smtp
    "3389:TCP"= 3389:TCP:mad:xpsp2res.dll,-22009
    "23457:TCP"= 23457:TCP:eMule
    "23457:UDP"= 23457:UDP:emule
    "9842:TCP"= 9842:TCP:*:Disabled:SolidNetworkManager
    "9842:UDP"= 9842:UDP:*:Disabled:SolidNetworkManager

    R0 d343bus;d343bus;C:\WINDOWS\system32\DRIVERS\d343bus.sys [2003-12-15 18:46]
    R0 d343port;d343port;C:\WINDOWS\system32\DRIVERS\d343port.sys [2003-12-15 17:29]
    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 02:20]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 02:16]
    R2 MLPTDR_N;MLPTDR_N;C:\WINDOWS\system32\MLPTDR_N.sys [2003-07-17 16:44]
    R2 MSF32;MSF32;C:\Program Files\MySecretFolder XP\MSF32.SYS [2007-01-25 01:00]
    R3 ncfvsbus;NCF Virtual Serial Bus Enumerator;C:\WINDOWS\system32\DRIVERS\ncfvsbus.sys [2004-11-26 12:15]
    R3 ZSMC302;Audio Web Cam 31;C:\WINDOWS\system32\Drivers\usbvm302.sys [2004-03-22 11:22]
    S3 itexadsla2;TW-IA300 Service;C:\WINDOWS\system32\DRIVERS\TWIn95a2.sys [2001-11-05 19:00]
    S3 SER120;OTI Serial port driver;C:\WINDOWS\system32\DRIVERS\SER120.sys [2004-11-23 04:59]
    S3 z520bus;Sony Ericsson 520 driver (WDM);C:\WINDOWS\system32\DRIVERS\z520bus.sys [2005-07-26 12:13]
    S3 z520mdfl;Sony Ericsson 520 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\z520mdfl.sys [2005-07-26 12:15]
    S3 z520mdm;Sony Ericsson 520 USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\z520mdm.sys [2005-07-26 12:15]
    S3 z520mgmt;Sony Ericsson 520 USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\z520mgmt.sys [2005-07-26 12:16]
    S3 z520obex;Sony Ericsson 520 USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\z520obex.sys [2005-07-26 12:18]

    *Newly Created Service* - CATCHME
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-06-08 13:28:00 C:\WINDOWS\Tasks\Tarkistetaan Windows Live -työkalurivin päivitykset.job"
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-08 16:57:32
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    [HKEY_LOCAL_MACHINE\system\ControlSet002\Services\MySQL]
    "ImagePath"="\"C:\wamp\mysql\bin\bin\mysqld-nt\" --defaults-file=\"C:\wamp\mysql\bin\my.ini\" MySQL"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    PROCESS: C:\WINDOWS\system32\winlogon.exe
    -> C:\WINDOWS\system32\wmfhotfix.dll

    PROCESS: C:\WINDOWS\system32\lsass.exe
    -> C:\WINDOWS\system32\wmfhotfix.dll
    .
    Completion time: 2008-06-08 16:58:52
    ComboFix-quarantined-files.txt 2008-06-08 13:58:32
    ComboFix2.txt 2008-06-08 13:26:33
    ComboFix3.txt 2008-06-08 12:54:28
    ComboFix4.txt 2008-06-08 12:30:04

    Pre-Run: 21,490,167,808 bytes free
    Post-Run: 21,471,457,280 bytes free

    243 --- E O F --- 2008-06-05 21:33:21
     
    kiisselia, 08.06.2008
    #15
  17. Hujo

    Hujo Guest

    kiisselia hyvä hyvä nyt teit sen oikeen


    scannaa nyt uusi hjt:n loki
     
    Hujo, 08.06.2008
    #16
  18. kiisselia

    kiisselia Regular member

    Liittynyt:
    13.12.2006
    Viestejä:
    125
    Kiitokset:
    0
    Pisteet:
    26
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:14:40, on 8.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    C:\WINDOWS\system32\inetsrv\inetinfo.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\UAService7.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Microsoft Hardware\Keyboard\type32.exe
    C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\VM_STI.EXE
    C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\PDF-XChangeSDKEU\PDFSaver.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/wdgt3/*http://www.yahoo.com/ext/search/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R3 - URLSearchHook: Advanced Searchbar - {57F02779-3D88-4958-8AD3-83C12D86ADC7} - C:\Program Files\AdvancedSearchbar\advancedsearchbar.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Windows Liven kirjautumisapuohjelma - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O2 - BHO: Advanced Searchbar - {CDEEC43D-3572-4E95-A2A5-F519D29F00C0} - C:\PROGRA~1\ADVANC~1\ADVANC~1.DLL
    O2 - BHO: Elisa Avustaja Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Program Files\Elisa\Avustaja\IEFixItNowPlugin.dll
    O3 - Toolbar: Advanced Searchbar - {57F02779-3D88-4958-8AD3-83C12D86ADC7} - C:\Program Files\AdvancedSearchbar\advancedsearchbar.dll
    O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [ADSL_A2] A2Installed
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [IntelliType] "C:\Program Files\Microsoft Hardware\Keyboard\type32.exe"
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE Audio Web Cam 31
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: ubisoft register.lnk = C:\Program Files\Ubi Soft\Register\schedule.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: PDF-Capture.lnk = C:\Program Files\PDF-XChangeSDKEU\PDFSaver.exe
    O4 - Global Startup: VPN Client.lnk = ?
    O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Matkaviestimen suosikkien luominen - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
    O9 - Extra 'Tools' menuitem: Matkaviestimen suosikkien luominen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
    O9 - Extra button: Advanced Searchbar - {57F02779-3D88-4958-8AD3-83C12D86ADC7} - C:\Program Files\AdvancedSearchbar\advancedsearchbar.dll
    O9 - Extra 'Tools' menuitem: Advanced Searchbar - {57F02779-3D88-4958-8AD3-83C12D86ADC7} - C:\Program Files\AdvancedSearchbar\advancedsearchbar.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1106078188394
    O16 - DPF: {6EE39BFC-2FB6-4B69-9D05-CFC10E4F5B3E} (MavenBootInstallerAXControl Class) - http://client.maven.net/client/mavenBootInstaller.cab
    O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://www.lumonetti.fi/portaali/Virusskanneri/OLS3/fscax.cab
    O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {E13F1132-4CA0-4005-84D3-51406E27D269} (BTDownloadCtrl Control) - http://www.shockwave.com/content/thinktanks/BTDownloadCtrl.cab
    O20 - AppInit_DLLs: C:\WINDOWS\system32\wmfhotfix.dll
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: MSSQL$PINNACLESYS - Unknown owner - I:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe (file missing)
    O23 - Service: MySQL - Unknown owner - C:\wamp\mysql\bin\bin\mysqld-nt (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pinnacle Systems Media Service (PinnacleSys.MediaServer) - Unknown owner - I:\Pinnacle\Shared Files\Programs\MediaServer\PMSHost.exe (file missing)
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: SQLAgent$PINNACLESYS - Unknown owner - I:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlagent.EXE (file missing)
    O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\system32\UAService7.exe

    --
    End of file - 10513 bytes
     
    kiisselia, 08.06.2008
    #17
  19. Hujo

    Hujo Guest

    loki kunnossa

    mites kone takkuaa. :)
     
    Hujo, 08.06.2008
    #18
  20. kiisselia

    kiisselia Regular member

    Liittynyt:
    13.12.2006
    Viestejä:
    125
    Kiitokset:
    0
    Pisteet:
    26
    No tää on kaverin kone!! Ja sillä tulla tupsahti "mese-virus".
    Muuten kai tää on toiminu ihan hyvin.
    Taisin turhaan vaivata sunnuntai-iltaasi.
     
    kiisselia, 08.06.2008
    #19
  21. kiisselia

    kiisselia Regular member

    Liittynyt:
    13.12.2006
    Viestejä:
    125
    Kiitokset:
    0
    Pisteet:
    26
    näyttäs tulevan nuita saastuneita mallwarella...
     
    kiisselia, 08.06.2008
    #20
Sivu 1 / 2

Jaa tämä sivu