Internet Explorer ei käynnisty

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi m0pee 09.02.2009.

Sivu 1 / 2
  1. m0pee

    m0pee Member

    Liittynyt:
    09.04.2006
    Viestejä:
    59
    Kiitokset:
    0
    Pisteet:
    16
    Ongelma on siis se, että IE:tä käynnistäessä tulee joka kerta seuraava vikailmoitus:

    Windows cannot find 'C:\Program Files\Internet Explorer\iexplore.exe'. Make sure you typed the name correctly, and try again. To search for a file, click the start button, and then click search

    IE7 kuitenkin on koneellani ja tuo iexplore.exe siellä paikassa jossa sen pitääkin olla. Uudelleen asennusta on kokeiltu useasti ja IE6:kin olen kokeillut, aina sama vika. Norton 360 ja SpySweeper 5.5 väittävät että kone on täysin puhdas. Olen lukenut kymmeniä keskusteluja aiheesta, mutta yhdestäkään ei ole ollut apua, mikä siis neuvoksi?

    HjT-logi:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:20:22, on 9.2.2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINXP\System32\smss.exe
    C:\WINXP\system32\winlogon.exe
    C:\WINXP\system32\services.exe
    C:\WINXP\system32\lsass.exe
    C:\WINXP\system32\svchost.exe
    C:\WINXP\System32\svchost.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\WINXP\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\WINXP\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    C:\WINXP\Explorer.EXE
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINXP\system32\nvsvc32.exe
    C:\WINXP\system32\PnkBstrA.exe
    C:\WINXP\system32\svchost.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\RivaTuner v2.08\RivaTuner.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\WINXP\system32\RUNDLL32.EXE
    C:\WINXP\RTHDCPL.EXE
    C:\WINXP\system32\ctfmon.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Program Files\Last.fm\LastFM.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
    C:\WINXP\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: D - {24EBFBFF-F4EF-3B53-9A81-1F4BFD774412} - C:\WINXP\system32\xel89141.dll
    O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINXP\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [CanonSolutionMenu] "C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" /logon
    O4 - HKLM\..\Run: [CanonMyPrinter] "C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" /logon
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [RivaTuner] "C:\Program Files\RivaTuner v2.08\RivaTuner.exe" /T
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINXP\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
    O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINXP\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINXP\system32\ctfmon.exe
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
    O4 - Global Startup: Adobe Gamma Loader.lnk = ?
    O4 - Global Startup: Bluetooth.lnk = ?
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
    O23 - Service: Automaattinen LiveUpdate-ajastustoiminto (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
    O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINXP\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINXP\system32\PnkBstrA.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

    --
    End of file - 9248 bytes
     
    m0pee, 09.02.2009
    #1
  2.  
  3. Hujo

    Hujo Guest

    scanjnaa hjt:llä merkkaa paina Fix checked

    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINXP\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

    ============

    Lataa Malwarebytes' Anti-Malware työpöydällesi.

    1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
    2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
    Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
    3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
    4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
    5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
    6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
    7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
    löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
    Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
    8. Lähetä lokin sisältö seuraavassa viestissäsi

     
    Hujo, 09.02.2009
    #2
  4. m0pee

    m0pee Member

    Liittynyt:
    09.04.2006
    Viestejä:
    59
    Kiitokset:
    0
    Pisteet:
    16
    Tässäpä logit:

    Malwarebytes' Anti-Malware 1.33
    Database version: 1741
    Windows 5.1.2600 Service Pack 3

    9.2.2009 21:44:14
    mbam-log-2009-02-09 (21-44-14).txt

    Scan type: Full Scan (C:\|)
    Objects scanned: 183280
    Time elapsed: 1 hour(s), 25 minute(s), 40 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 5
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 4

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{24ebfbff-f4ef-3b53-9a81-1f4bfd774412} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{24ebfbff-f4ef-3b53-9a81-1f4bfd774412} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{41ce350f-f9b3-3a74-8daf-065643b0eb41} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{008dd531-7ff6-3581-8a2b-47c597f5137b} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{24ebfbff-f4ef-3b53-9a81-1f4bfd774412} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\WINXP\system32\xel89141.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINXP\system32\qnkfqvs.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINXP\system32\el89141.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\Program Files\KB54933.exe (Trojan.Agent) -> Quarantined and deleted successfully.




    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:47:33, on 9.2.2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINXP\System32\smss.exe
    C:\WINXP\system32\winlogon.exe
    C:\WINXP\system32\services.exe
    C:\WINXP\system32\lsass.exe
    C:\WINXP\system32\svchost.exe
    C:\WINXP\System32\svchost.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\WINXP\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\WINXP\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINXP\Explorer.EXE
    C:\WINXP\system32\nvsvc32.exe
    C:\WINXP\system32\PnkBstrA.exe
    C:\WINXP\system32\svchost.exe
    C:\Program Files\RivaTuner v2.08\RivaTuner.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\WINXP\system32\RUNDLL32.EXE
    C:\WINXP\RTHDCPL.EXE
    C:\WINXP\system32\ctfmon.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Last.fm\LastFM.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
    C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
    C:\Program Files\uTorrent\uTorrent.exe
    C:\WINXP\system32\NOTEPAD.EXE
    C:\WINXP\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
    O4 - HKLM\..\Run: [CanonSolutionMenu] "C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" /logon
    O4 - HKLM\..\Run: [CanonMyPrinter] "C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" /logon
    O4 - HKLM\..\Run: [RivaTuner] "C:\Program Files\RivaTuner v2.08\RivaTuner.exe" /T
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINXP\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINXP\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINXP\system32\ctfmon.exe
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
    O4 - Global Startup: Adobe Gamma Loader.lnk = ?
    O4 - Global Startup: Bluetooth.lnk = ?
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
    O23 - Service: Automaattinen LiveUpdate-ajastustoiminto (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
    O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINXP\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINXP\system32\PnkBstrA.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

    --
    End of file - 9051 bytes
     
    m0pee, 09.02.2009
    #3
  5. Hujo

    Hujo Guest

    Lataa JavaRa ja pura se työpöydällesi.

    ***Sulje kaikki päällä olevat Internet Explorerin ikkunat ennen jatkamista!***

    * Tuplaklikkaa JavaRa.exeä käynnistääksesi ohjelma.
    * Valitse English pudotusvalikosta valitaksesi kieleksi englannin ja klikkaa Select.
    * Klikkaa Remove Older Versions poistaaksesi vanhat Java-versiot koneeltasi.
    * Klikkaa Yes kun pyydetään. Kun JavaRa on valmis, se ilmoittaa, että lokitiedosto on luotu. Klikkaa OK.
    * Lokitiedosto avautuu. Lähetä sen sisältö seuraavassa viestissäsi.
    4. Asenna uusin Java päivitys seuraavasta linkistä..

    Lataa täältä uusi java

    Rullaa alas kohteeseen Java Runtime Environment (JRE) 6 Update 12
    Paina Download
    Laita Platform -kohtaan Windows
    Ruksaa I agree to the Java SE Runtime Environment 6 License Agreement ja paina Continue
    Paina Windows Offline Installationin alapuolella jre-6u4-windows-i586-p.exe

    Tallenna tiedosto vaikka työpöydälle ja asenna se.

    5. Käynnistä kone uudelleen asennuksen jälkeen.
    6. Käynnistyksen jälkeen, mene takaisin Ohjauspaneeliin ja avaa Java asetuksesi (Muita Ohjauspaneelin asetuksia -> Java kahvikuppi).
    7. General-välilehdellä klikkaa Settings. Vedä liukusäädintä (Disk Space) pienemmälle.

    (Jotkut javapohjaiset ohjelmat saattavat tarvita enemmän levytilaa.
    Jos huomaat säädön pienentämisen jälkeen koneessa hitautta, siirrä liukusäädintä isommalle).

    8. Klikkaa Delete Files -nappia. Varmista että kaikki kaksi valintaa ovat rastitettuja:
    * Applications and Applets
    * Trace and Log Files

    Ja paina OK -nappia
    Huomaa: Tämä poistaa kaikki ladatut sovellukset ja appletit VÄLIMUISTISTA.

    9. Klikkaa OK "Temporary Files Settings" -ikkunassasi.
    10. Välilehti Update: ota ruksi pois kohdasta Check for Updates automatically
    Valitse Never check
    11. Klikkaa Apply ja OK jättääksesi Java asetusikkunasi.
     
    Hujo, 09.02.2009
    #4
  6. m0pee

    m0pee Member

    Liittynyt:
    09.04.2006
    Viestejä:
    59
    Kiitokset:
    0
    Pisteet:
    16
    JavaRa 1.13 Removal Log.

    Report follows after line.

    ------------------------------------

    The JavaRa removal process was started on Mon Feb 09 23:15:55 2009

    Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}

    Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBB}

    Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC}

    Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610005

    Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610005

    Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610005

    Found and removed: SOFTWARE\Classes\JavaPlugin.160_05

    Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_05

    Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_05

    Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610005

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610005

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610005

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160050}

    Found and removed: Software\Classes\JavaPlugin.160_05

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

    Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_05

    Found and removed: Software\JavaSoft\Java2D\1.6.0_05

    Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_05

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

    Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_05\

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_05\bin\

    Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Common Files\Java\Update\Base Images\jre1.6.0.b105\patch-jre1.6.0_05.b13\

    ------------------------------------

    Finished reporting.
     
    m0pee, 09.02.2009
    #5
  7. Hujo

    Hujo Guest

    Mikäs on koneen toiminta
     
    Hujo, 09.02.2009
    #6
  8. m0pee

    m0pee Member

    Liittynyt:
    09.04.2006
    Viestejä:
    59
    Kiitokset:
    0
    Pisteet:
    16
    Sama ongelma edelleen, IE ei käynnisty vaan antaa samaa virheilmoitusta. Kokoilen vielä, auttaisiko uudelleen asennus puhdistuksen jälkeen.
     
    m0pee, 10.02.2009
    #7
  9. Hujo

    Hujo Guest

    Lataa SDFix by AndyManchesta ja tallenna se työpöydällesi.

    Käynnistä koneesi vikasietotilaan:

    sammuta ja käynnistä
    käynnistyksen yhteydessä hakkaa F8 nappia
    valitse nuolinäppäimellä vikasietotila
    paina enter ja enter
    valitse käyttäjätilisi
    paina kyllä

    Jossakin koneissa hakataan F8:sin sijasta F5:tä

    " Kun vikasietotilassa, pura tiedoston SDFix.zip sisältö (SDFix kansio) työpöydällesi. Työpöydälle pitäisi ilmestyä kansio nimeltä SDFix.
    " Avaa SDFix-kansio ja tuplaklikkaa tiedostoa RunThis.bat käynnistääksesi ohjelman.
    " Paina Y käynnistääksesi skriptin.
    " Työkalu puhdistaa troijalaisen palvelut ja tekee myös joitakin korjauksia rekisteriin. Lopuksi se pyytää käynnistämään koneen uudelleen, "Press any key to Reboot".
    " Paina mitä tahansa näppäintä ja kone käynnistyy uudelleen.
    " Käynnistyminen kestää normaalia kauemmin sillä SDFix puhdistaa konetta.
    " Kun kone on käynnistynyt ja työpöytä latautunut, SDFix kertoo että puhdistus on suoritettu, "Finished".
    " Paina sitten mitä tahansa näppäintä sulkeaksesi skriptin ja ladataksesi pikakuvakkeet työpöydälle.
    " Lopuksi avaa SDFix kansio (työpöydällä) ja kopioi & liitä tiedoston Report.txt sisältö viestiketjuusi uuden HijackThis:n lokin kera.

    ==============

    1.Lataa Combofix.exe työpöydällesi yhdestä linkistä:
    Combofix1
    Combofix2

    Älä asenna palautus consolia
    2. Tuplaklikkaa Combofix.exe tiedostoa ja seuraa ohjeistuksia.
    3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
     
    Hujo, 10.02.2009
    #8
  10. m0pee

    m0pee Member

    Liittynyt:
    09.04.2006
    Viestejä:
    59
    Kiitokset:
    0
    Pisteet:
    16
    SDFix ja ComboFix rullasivat jonkin aikaa ja saivat jotain ilmeisesti aikaankin, sillä IE toimii taas, kiitokset siitä! Tässä logit:


    SDFix: Version 1.240
    Run by Lauri on ti 10.02.2009 at 14:50

    Microsoft Windows XP [Version 5.1.2600]
    Running From: C:\Documents and Settings\Lauri\Desktop\sdfix\SDFix

    Checking Services :


    Restoring Default Security Values
    Restoring Default Hosts File

    Rebooting


    Checking Files :

    No Trojan Files Found






    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-02-10 15:07:01
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
    "s1"=dword:2df9c43f
    "s2"=dword:110480d0
    "h0"=dword:00000001

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools Lite\"
    "h0"=dword:00000000
    "khjeh"=hex:59,b0,c4,3c,28,52,bd,e1,7b,f5,4d,76,c3,58,91,7d,63,f9,0a,84,b1,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,18,99,11,46,58,bb,34,15,98,fd,90,eb,9c,7d,58,5f,3e,..
    "khjeh"=hex:96,ac,ac,78,8b,7f,50,38,04,ff,a3,64,7a,dc,aa,34,5f,e6,f3,f4,f1,..

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:7a,16,a4,fa,d0,e2,d0,6e,34,df,c0,cd,56,83,54,ec,01,d9,47,74,ee,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools Lite\"
    "h0"=dword:00000000
    "khjeh"=hex:59,b0,c4,3c,28,52,bd,e1,7b,f5,4d,76,c3,58,91,7d,63,f9,0a,84,b1,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,18,99,11,46,58,bb,34,15,98,fd,90,eb,9c,7d,58,5f,3e,..
    "khjeh"=hex:96,ac,ac,78,8b,7f,50,38,04,ff,a3,64,7a,dc,aa,34,5f,e6,f3,f4,f1,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:d3,cc,2f,90,9d,ab,ae,fb,74,65,1c,79,6d,42,8d,24,68,04,12,e8,25,..
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
    "p0"="C:\Program Files\DAEMON Tools Lite\"
    "h0"=dword:00000000
    "khjeh"=hex:59,b0,c4,3c,28,52,bd,e1,7b,f5,4d,76,c3,58,91,7d,63,f9,0a,84,b1,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
    "a0"=hex:20,01,00,00,18,99,11,46,58,bb,34,15,98,fd,90,eb,9c,7d,58,5f,3e,..
    "khjeh"=hex:96,ac,ac,78,8b,7f,50,38,04,ff,a3,64,7a,dc,aa,34,5f,e6,f3,f4,f1,..

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
    "khjeh"=hex:7a,16,a4,fa,d0,e2,d0,6e,34,df,c0,cd,56,83,54,ec,01,d9,47,74,ee,..

    scanning hidden registry entries ...

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0


    Remaining Services :




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
    "C:\\WINXP\\system32\\PnkBstrA.exe"="C:\\WINXP\\system32\\PnkBstrA.exe:*:Enabled:pnkBstrA"
    "C:\\WINXP\\system32\\PnkBstrB.exe"="C:\\WINXP\\system32\\PnkBstrB.exe:*:Enabled:pnkBstrB"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
    "C:\\Program Files\\Steam\\Steam.exe"="C:\\Program Files\\Steam\\Steam.exe:*:Enabled:Steam"
    "C:\\Program Files\\Steam\\SteamApps\\cuqumber\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\SteamApps\\cuqumber\\counter-strike source\\hl2.exe:*:Enabled:hl2"
    "C:\\WINXP\\system32\\dpvsetup.exe"="C:\\WINXP\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
    "C:\\WINXP\\system32\\rundll32.exe"="C:\\WINXP\\system32\\rundll32.exe:*:Enabled:Run a DLL as an App"
    "C:\\Program Files\\Counter-Strike 1.6\\hl.exe"="C:\\Program Files\\Counter-Strike 1.6\\hl.exe:*:Enabled:Half-Life Launcher"
    "C:\\Sierra\\Half-Life\\hl.exe"="C:\\Sierra\\Half-Life\\hl.exe:*:Enabled:Half-Life Launcher"
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
    "C:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\xrEngine.exe"="C:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Clear Sky (CLI)"
    "C:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\dedicated\\xrEngine.exe"="C:\\Program Files\\Deep Silver\\S.T.A.L.K.E.R. - Clear Sky\\bin\\dedicated\\xrEngine.exe:*:Enabled:S.T.A.L.K.E.R. - Clear Sky (SRV)"
    "C:\\Program Files\\Juniper\\NetScreen-Remote\\IreIKE.exe"="C:\\Program Files\\Juniper\\NetScreen-Remote\\IreIKE.exe:*:Enabled:IreIke"
    "C:\\Program Files\\Juniper\\NetScreen-Remote\\ViewLog.exe"="C:\\Program Files\\Juniper\\NetScreen-Remote\\ViewLog.exe:127.0.0.1/255.255.255.255:Enabled:ViewLog"
    "C:\\Program Files\\Juniper\\NetScreen-Remote\\CmonApp.exe"="C:\\Program Files\\Juniper\\NetScreen-Remote\\CmonApp.exe:127.0.0.1/255.255.255.255:Enabled:CMonApp"
    "C:\\Program Files\\Juniper\\NetScreen-Remote\\vpn.exe"="C:\\Program Files\\Juniper\\NetScreen-Remote\\vpn.exe:127.0.0.1/255.255.255.255:Enabled:VPN Connection Manager"
    "C:\\Program Files\\EA GAMES\\Mirror's Edge\\Binaries\\MirrorsEdge.exe"="C:\\Program Files\\EA GAMES\\Mirror's Edge\\Binaries\\MirrorsEdge.exe:*:Enabled:Mirror's EdgeT"
    "C:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"="C:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe:*:Enabled:Left 4 Dead"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
    "C:\\Program Files\\Juniper\\NetScreen-Remote\\IreIKE.exe"="C:\\Program Files\\Juniper\\NetScreen-Remote\\IreIKE.exe:*:Enabled:IreIke"
    "C:\\Program Files\\Juniper\\NetScreen-Remote\\ViewLog.exe"="C:\\Program Files\\Juniper\\NetScreen-Remote\\ViewLog.exe:127.0.0.1/255.255.255.255:Enabled:ViewLog"
    "C:\\Program Files\\Juniper\\NetScreen-Remote\\CmonApp.exe"="C:\\Program Files\\Juniper\\NetScreen-Remote\\CmonApp.exe:127.0.0.1/255.255.255.255:Enabled:CMonApp"
    "C:\\Program Files\\Juniper\\NetScreen-Remote\\vpn.exe"="C:\\Program Files\\Juniper\\NetScreen-Remote\\vpn.exe:127.0.0.1/255.255.255.255:Enabled:VPN Connection Manager"

    Remaining Files :



    Files with Hidden Attributes :

    Mon 14 Apr 2008 1,695,232 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe"
    Mon 7 Jul 2008 1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
    Mon 7 Jul 2008 4,891,472 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
    Mon 18 Aug 2008 1,832,272 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
    Wed 3 May 2006 163,328 ..SHR --- "C:\WINXP\system32\flvDX.dll"
    Wed 21 Feb 2007 31,232 ..SHR --- "C:\WINXP\system32\msfDX.dll"
    Sun 16 Mar 2008 216,064 ..SHR --- "C:\WINXP\system32\nbDX.dll"
    Sun 20 Apr 2008 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
    Thu 15 Feb 2007 308,832 A..H. --- "C:\Program Files\Canon\MP Navigator EX 1.0\Maint.exe"
    Mon 19 Dec 2005 61,440 A..H. --- "C:\Program Files\Canon\MP Navigator EX 1.0\uinstrsc.dll"
    Sun 26 Jun 2005 616,448 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygwin1.dll"
    Tue 21 Jun 2005 45,568 ..SHR --- "C:\Program Files\eRightSoft\SUPER\cygz.dll"
    Tue 2 Sep 2008 72,704 ..SHR --- "C:\Program Files\eRightSoft\SUPER\Setup.exe"
    Tue 2 Oct 2007 16,384 A.SHR --- "C:\Program Files\eRightSoft\SUPER\_Setup.dll"
    Mon 7 Apr 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
    Fri 18 Jan 2008 400 A..H. --- "C:\Program Files\Common Files\Symantec Shared\COH\COH32LU.reg"
    Fri 18 Jan 2008 403 A..H. --- "C:\Program Files\Common Files\Symantec Shared\COH\COHDLU.reg"
    Tue 4 Jun 2002 84,992 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\14_43260.dll"
    Tue 4 Jun 2002 44,032 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\28_83260.dll"
    Tue 10 Dec 2002 73,766 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\atrc3260.dll"
    Tue 10 Dec 2002 65,575 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\cook3260.dll"
    Sun 9 Jun 2002 36,864 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ddnt3260.dll"
    Tue 4 Jun 2002 20,480 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dnet3260.dll"
    Tue 10 Dec 2002 102,437 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv13260.dll"
    Tue 10 Dec 2002 176,165 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv23260.dll"
    Tue 10 Dec 2002 208,935 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv33260.dll"
    Tue 10 Dec 2002 217,127 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\drv43260.dll"
    Sun 9 Jun 2002 40,448 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\dspr3260.dll"
    Sun 4 Nov 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\ivvideo.dll"
    Tue 10 Apr 2001 225,280 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\qtmlClient.dll"
    Fri 20 Feb 2004 232,960 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\raac.dll"
    Sun 9 Jun 2002 525,824 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnco3260.dll"
    Tue 10 Dec 2002 245,805 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rnlt3260.dll"
    Tue 10 Dec 2002 45,093 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv103260.dll"
    Tue 10 Dec 2002 98,341 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv203260.dll"
    Tue 10 Dec 2002 94,247 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv303260.dll"
    Tue 10 Dec 2002 90,151 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\rv403260.dll"
    Tue 10 Dec 2002 102,439 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\sipr3260.dll"
    Sun 9 Jun 2002 49,152 ...HR --- "C:\Program Files\eRightSoft\SUPER\mencoder\tokr3260.dll"
    Thu 20 Mar 2008 5,632 ..SHR --- "C:\Program Files\eRightSoft\SUPER\spk\1stRun.exe"
    Sun 18 Jan 2009 5,936 ...HR --- "C:\Documents and Settings\Lauri\Application Data\SecuROM\UserData\securom_v7_01.bak"

    Finished!

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 15:22:36, on 10.2.2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
    Boot mode: Normal

    Running processes:
    C:\WINXP\System32\smss.exe
    C:\WINXP\system32\winlogon.exe
    C:\WINXP\system32\services.exe
    C:\WINXP\system32\lsass.exe
    C:\WINXP\system32\svchost.exe
    C:\WINXP\System32\svchost.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\WINXP\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\WINXP\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\WINXP\system32\nvsvc32.exe
    C:\WINXP\system32\PnkBstrA.exe
    C:\WINXP\system32\svchost.exe
    C:\WINXP\system32\notepad.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\WINXP\RTHDCPL.EXE
    C:\WINXP\system32\ctfmon.exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
    C:\WINXP\system32\notepad.exe
    C:\WINXP\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
    O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
    O4 - HKLM\..\Run: [CanonSolutionMenu] "C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe" /logon
    O4 - HKLM\..\Run: [CanonMyPrinter] "C:\Program Files\Canon\MyPrinter\BJMyPrt.exe" /logon
    O4 - HKLM\..\Run: [RivaTuner] "C:\Program Files\RivaTuner v2.08\RivaTuner.exe" /T
    O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
    O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINXP\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINXP\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINXP\system32\ctfmon.exe
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINXP\system32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
    O4 - Global Startup: Adobe Gamma Loader.lnk = ?
    O4 - Global Startup: Bluetooth.lnk = ?
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINXP\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
    O23 - Service: Automaattinen LiveUpdate-ajastustoiminto (Automatic LiveUpdate Scheduler) - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
    O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINXP\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINXP\system32\PnkBstrA.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

    --
    End of file - 8073 bytes

    ComboFix 09-02-08.02 - Lauri 2009-02-10 15:16:45.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1380 [GMT 2:00]
    Running from: c:\documents and settings\Lauri\Desktop\ComboFix.exe
    AV: Norton 360 *On-access scanning enabled* (Updated)
    FW: Norton 360 *enabled*
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\winxp\Readme.txt
    c:\winxp\system32\tmp71.tmp
    c:\winxp\system32\tmp72.tmp

    .
    ((((((((((((((((((((((((( Files Created from 2009-01-10 to 2009-02-10 )))))))))))))))))))))))))))))))
    .

    2009-02-10 14:50 . 2009-02-10 14:50 578,560 --a--c--- c:\winxp\system32\dllcache\user32.dll
    2009-02-10 14:48 . 2009-02-10 14:48 <DIR> d-------- c:\winxp\ERUNT
    2009-02-10 14:29 . 2009-02-10 14:29 228 --a------ c:\winxp\system32\spupdsvc.inf
    2009-02-10 14:28 . 2007-08-13 18:52 66,048 --a------ c:\winxp\ieResetIcons.exe
    2009-02-09 23:28 . 2009-02-09 23:28 410,984 --a------ c:\winxp\system32\deploytk.dll
    2009-02-09 20:10 . 2009-02-09 20:10 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
    2009-02-09 20:10 . 2009-02-09 20:10 <DIR> d-------- c:\documents and settings\Lauri\Application Data\Malwarebytes
    2009-02-09 20:10 . 2009-02-09 20:10 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-02-09 20:10 . 2009-01-14 16:11 38,496 --a------ c:\winxp\system32\drivers\mbamswissarmy.sys
    2009-02-09 20:10 . 2009-01-14 16:11 15,504 --a------ c:\winxp\system32\drivers\mbam.sys
    2009-02-09 10:19 . 2009-02-09 10:19 <DIR> d-------- c:\program files\Trend Micro
    2009-02-06 13:32 . 2009-02-06 13:33 <DIR> d-------- C:\nss
    2009-02-06 11:15 . 2009-02-06 11:15 164 --a------ C:\install.dat
    2009-01-18 18:58 . 2007-11-14 15:18 553 --a------ c:\winxp\USetup.iss
    2009-01-18 18:57 . 2008-08-05 20:10 1,684,736 --a------ c:\winxp\system32\drivers\Ambfilt.sys
    2009-01-18 18:57 . 2006-01-04 15:41 1,389,056 --a------ c:\winxp\system32\drivers\Monfilt.sys
    2009-01-18 18:57 . 2008-10-23 17:42 290,816 --a------ c:\winxp\vncutil.exe
    2009-01-18 18:57 . 2008-06-24 14:46 104,992 --a------ c:\winxp\RtkAudioService.exe
    2009-01-18 18:57 . 2009-01-05 16:16 34,816 --a------ c:\winxp\system32\RtkCoInstXP.dll
    2009-01-18 15:57 . 2009-01-18 19:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\Electronic Arts
    2009-01-15 21:19 . 2009-01-15 21:19 <DIR> d-------- c:\program files\OpenAL
    2009-01-15 21:19 . 2008-04-28 15:53 805,400 -ra------ c:\winxp\system32\tmpBE.tmp
    2009-01-15 21:19 . 2008-04-28 15:53 805,400 -ra------ c:\winxp\system32\tmpBD.tmp
    2009-01-15 21:19 . 2009-01-15 21:19 444,952 --a------ c:\winxp\system32\wrap_oal.dll
    2009-01-15 21:19 . 2009-01-15 21:19 109,080 --a------ c:\winxp\system32\OpenAL32.dll
    2009-01-15 21:05 . 2009-01-15 21:32 <DIR> d-------- c:\program files\Codemasters
    2009-01-12 17:27 . 2009-01-16 02:54 <DIR> d-------- C:\audiograbber

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-02-10 13:14 --------- d-----w c:\program files\Common Files\Symantec Shared
    2009-02-10 12:37 --------- d-----w c:\documents and settings\All Users\Application Data\2DBoy
    2009-02-10 12:36 --------- d-----w c:\program files\Peggle Nights Deluxe
    2009-02-10 12:34 --------- d-----w c:\documents and settings\All Users\Application Data\Codemasters
    2009-02-09 21:28 --------- d-----w c:\program files\Java
    2009-02-09 21:14 --------- d-----w c:\documents and settings\Lauri\Application Data\uTorrent
    2009-02-09 09:17 --------- d-----w c:\program files\Steam
    2009-01-18 17:03 --------- d-----w c:\program files\Electronic Arts
    2009-01-18 16:57 --------- d-----w c:\program files\Realtek
    2009-01-18 15:35 --------- d-----w c:\program files\EA GAMES
    2009-01-18 13:39 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
    2009-01-18 13:39 --------- d-----w c:\program files\AGEIA Technologies
    2009-01-16 19:59 --------- d-----w c:\program files\Truck Dismount
    2009-01-16 19:59 --------- d-----w c:\program files\Porrasturvat - Stair Dismount
    2009-01-15 19:05 --------- d--h--w c:\program files\InstallShield Installation Information
    2009-01-10 11:02 --------- d-----w c:\documents and settings\Lauri\Application Data\Nokia
    2009-01-09 10:22 806 ----a-w c:\winxp\system32\drivers\SYMEVENT.INF
    2009-01-09 10:22 60,808 ----a-w c:\winxp\system32\S32EVNT1.DLL
    2009-01-09 10:22 124,464 ----a-w c:\winxp\system32\drivers\SYMEVENT.SYS
    2009-01-09 10:22 10,635 ----a-w c:\winxp\system32\drivers\SYMEVENT.CAT
    2009-01-09 10:22 --------- d-----w c:\program files\Symantec
    2009-01-07 12:42 --------- d-----w c:\program files\directx
    2009-01-07 12:33 --------- d-----w c:\program files\Commandos II
    2009-01-06 17:00 4,968,448 ----a-w c:\winxp\system32\drivers\RtkHDAud.sys
    2009-01-05 10:06 --------- d-----w c:\program files\ElastoManiaRegistered
    2009-01-02 05:15 --------- d-----w c:\program files\Filzip
    2009-01-01 18:45 --------- d-----w c:\documents and settings\Lauri\Application Data\dvdcss
    2008-12-30 12:58 18,082,304 ----a-w c:\winxp\RTHDCPL.EXE
    2008-12-26 16:06 --------- d-----w c:\documents and settings\All Users\Application Data\ifolor
    2008-12-26 15:24 --------- d-----w c:\program files\ifolor
    2008-12-26 15:24 --------- d-----w c:\documents and settings\Lauri\Application Data\ifolor
    2008-12-11 10:57 333,952 ----a-w c:\winxp\system32\drivers\srv.sys
    2008-11-29 20:52 111,928 ----a-w c:\winxp\system32\PnkBstrB.exe
    2008-11-29 20:51 5,488,640 ----a-w c:\winxp\system32\xa94468328.exe
    2008-11-29 20:51 5,488,640 ----a-w c:\winxp\system32\xa94468000.exe
    2008-11-29 20:41 5,488,640 ----a-w c:\winxp\system32\xa93878828.exe
    2008-11-29 20:41 5,488,640 ----a-w c:\winxp\system32\xa93878531.exe
    2008-11-29 20:41 5,488,640 ----a-w c:\winxp\system32\xa93861843.exe
    2008-11-29 20:41 5,488,640 ----a-w c:\winxp\system32\xa93861562.exe
    2008-11-29 20:40 5,488,640 ----a-w c:\winxp\system32\xa93806484.exe
    2008-11-29 20:40 5,488,640 ----a-w c:\winxp\system32\xa93806203.exe
    2008-11-29 20:39 5,488,640 ----a-w c:\winxp\system32\xa93757593.exe
    2008-11-29 20:39 5,488,640 ----a-w c:\winxp\system32\xa93757328.exe
    2008-11-29 20:34 5,488,640 ----a-w c:\winxp\system32\xa93420390.exe
    2008-11-29 20:34 5,488,640 ----a-w c:\winxp\system32\xa93420125.exe
    2008-11-29 20:27 5,488,640 ----a-w c:\winxp\system32\xa93016609.exe
    2008-11-29 20:27 5,488,640 ----a-w c:\winxp\system32\xa93016343.exe
    2008-11-29 20:23 5,488,640 ----a-w c:\winxp\system32\xa92789078.exe
    2008-11-29 20:23 5,488,640 ----a-w c:\winxp\system32\xa92787984.exe
    2008-11-29 20:23 5,488,640 ----a-w c:\winxp\system32\xa92762484.exe
    2008-11-29 20:23 5,488,640 ----a-w c:\winxp\system32\xa92762078.exe
    2008-11-29 20:23 176,128 ----a-w c:\winxp\system32\xwr56633.dll
    2008-11-29 20:23 176,128 ----a-w c:\winxp\system32\wr56633.dll
    2008-11-29 10:54 22,328 ----a-w c:\documents and settings\Lauri\Application Data\PnkBstrK.sys
    2008-11-29 10:53 682,280 ----a-w c:\winxp\system32\pbsvc.exe
    2008-11-29 10:53 66,872 ----a-w c:\winxp\system32\PnkBstrA.exe
    2008-11-10 19:22 2,720 ----a-w c:\winxp\system32\ealregsnapshot1.reg
    2008-06-30 10:44 324,976 ----a-w c:\program files\mozilla firefox\components\coFFPlgn.dll
    2006-05-03 09:06 163,328 --sh--r c:\winxp\system32\flvDX.dll
    2007-02-21 10:47 31,232 --sh--r c:\winxp\system32\msfDX.dll
    2008-03-16 12:30 216,064 --sh--r c:\winxp\system32\nbDX.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded]
    @="{4433A54A-1AC8-432F-90FC-85F045CF383C}"
    [HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}]
    2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending]
    @="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}"
    [HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}]
    2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected]
    @="{476D0EA3-80F9-48B5-B70B-05E677C9C148}"
    [HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}]
    2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\winxp\system32\ctfmon.exe" [2008-04-14 15360]
    "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-03-14 486856]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
    "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
    "RivaTuner"="c:\program files\RivaTuner v2.08\RivaTuner.exe" [2008-03-10 2691072]
    "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
    "osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512]
    "NvCplDaemon"="c:\winxp\system32\NvCpl.dll" [2008-09-17 13574144]
    "NvMediaCenter"="c:\winxp\system32\NvMcTray.dll" [2008-09-17 86016]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-09 148888]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\winxp\KHALMNPR.Exe]
    "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\winxp\KHALMNPR.Exe]
    "RTHDCPL"="RTHDCPL.EXE" [2008-12-30 c:\winxp\RTHDCPL.EXE]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\winxp\system32\CTFMON.EXE" [2008-04-14 15360]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "nltide_3"="advpack.dll" [2008-04-14 c:\winxp\system32\advpack.dll]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-03-27 113664]
    Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-11-01 576104]
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-08-02 805392]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
    "ForceClassicControlPanel"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    2008-05-02 01:42 72208 c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.I420"= i420vfw.dll
    "msacm.avis"= ff_acm.acm
    "VIDC.DVSD"= pdvcodec.dll
    "vidc.VSPX"= vspxvfw.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "c:\\WINXP\\system32\\PnkBstrA.exe"=
    "c:\\WINXP\\system32\\PnkBstrB.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "c:\\Program Files\\Steam\\Steam.exe"=
    "c:\\Program Files\\Steam\\SteamApps\\cuqumber\\counter-strike source\\hl2.exe"=
    "c:\\WINXP\\system32\\dpvsetup.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\EA GAMES\\Mirror's Edge\\Binaries\\MirrorsEdge.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 1 (0x1)

    R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-02-18 149352]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-03 99376]
    R3 FStarForce;FStarForce;c:\winxp\system32\drivers\FStarForce.sys [2008-10-30 9216]
    S3 ASPI;Advanced SCSI Programming Interface Driver;c:\winxp\system32\drivers\ASPI32.SYS [2008-08-27 16512]
    S3 COH_Mon;COH_Mon;c:\winxp\system32\drivers\COH_Mon.sys [2008-01-12 23888]

    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - COMHOST

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cddc304c-0397-11dd-b178-00508db7f3cb}]
    \Shell\AutoRun\command - F:\setupSNK.exe
    .
    - - - - ORPHANS REMOVED - - - -

    HKCU-Run-EA Core - c:\program files\Electronic Arts\EADM\Core.exe


    .
    ------- Supplementary Scan -------
    .
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    FF - ProfilePath - c:\documents and settings\Lauri\Application Data\Mozilla\Firefox\Profiles\cxrlyn8r.default\
    FF - prefs.js: browser.startup.homepage - hxxps://posti.sakky.fi/horde3/imp/login.php
    FF - component: c:\program files\Mozilla Firefox\components\coFFPlgn.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-02-10 15:17:39
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-448539723-573735546-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
    "??"=hex:a8,7e,78,49,f9,b0,79,61,57,db,60,5e,4e,58,ce,05,0f,a1,d1,3c,93,03,2b,
    fd,55,22,86,95,5b,f7,62,d4,f7,59,de,3f,de,5c,13,2a,c7,20,e7,2b,28,c1,54,ed,\
    "??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50

    [HKEY_USERS\S-1-5-21-448539723-573735546-839522115-1004\Software\SecuROM\License information*]
    "datasecu"=hex:4d,5c,00,c4,dc,92,01,f6,4f,a0,dd,d6,c7,ea,a0,e6,93,10,91,c0,d3,
    3e,f9,da,5c,f8,50,0f,ca,e3,fb,aa,93,89,47,1b,34,ff,6e,65,25,61,c3,fa,e4,87,\
    "rkeysecu"=hex:cc,31,22,60,21,5f,50,e9,8c,4e,3d,41,70,20,8a,50
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(808)
    c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
    c:\program files\common files\logitech\bluetooth\LBTServ.dll
    .
    Completion time: 2009-02-10 15:19:03
    ComboFix-quarantined-files.txt 2009-02-10 13:18:58

    Pre-Run: 59 113 570 304 bytes free
    Post-Run: 59,158,970,368 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINXP
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINXP="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    242 --- E O F --- 2009-02-06 19:03:33
     
    m0pee, 10.02.2009
    #9
  11. Hujo

    Hujo Guest

    c:\winxp\system32\xa93420390.exe <-- mikäs tämä on

    Lähetetääni tiedosto Virustotaliin
    virustotal

    1 Klikkaa Selaa... nappia
    2 Selaa sitten siihen tämä tiedosto: c:\winxp\system32\xa93420390.exe
    3 Klikkaa Avaa nappia
    4 Klikkaa Send nappia
    5 Sivusto scannaa tiedostoa hetken, tallenna sitten tulokset jotka saat vaikka muistioon.

    tai jos ei pelitä niin tuonne
    jotti



     
    Hujo, 10.02.2009
    #10
  12. m0pee

    m0pee Member

    Liittynyt:
    09.04.2006
    Viestejä:
    59
    Kiitokset:
    0
    Pisteet:
    16
    Taitavat olla Call Of Duty World At Warin tiedostoja, puhtaita ainakin tuon sivuston mukaan. Kyseistä peliä ei tosin enää koneellani ole asennettuna, joten voiko nuo tuolta vaan kylmän viileästi poistaa?

    File: xa93420390.exe
    Status: OK(Note: file has been scanned before. Therefore, this file's scan results will not be stored in the database)
    MD5: 5f1b427c756d7734934d2cc4e542fed3

    Scan taken on 10 Feb 2009 19:00:28 (GMT)
    A-Squared
    Found nothing
    AntiVir
    Found nothing
    ArcaVir
    Found nothing
    Avast
    Found nothing
    AVG Antivirus
    Found nothing
    BitDefender
    Found nothing
    ClamAV
    Found nothing
    CPsecure
    Found nothing
    Dr.Web
    Found nothing
    F-Prot Antivirus
    Found nothing
    F-Secure Anti-Virus
    Found nothing
    G DATA
    Found nothing
    Ikarus
    Found nothing
    Kaspersky Anti-Virus
    Found nothing
    NOD32
    Found nothing
    Norman Virus Control
    Found nothing
    Panda Antivirus
    Found nothing
    Sophos Antivirus
    Found nothing
    VirusBuster
    Found nothing
    VBA32
    Found nothing
     
    m0pee, 10.02.2009
    #11
  13. Hujo

    Hujo Guest

    Hujo, 10.02.2009
    #12
  14. m0pee

    m0pee Member

    Liittynyt:
    09.04.2006
    Viestejä:
    59
    Kiitokset:
    0
    Pisteet:
    16
    SUPERAntiSpyware löysi ja laittoi kuriin pari uhkaa: Adware.Tracking Cookie ja Trojan.Dropper/MS-Fake. Muuta ei löytynyt.
     
    m0pee, 10.02.2009
    #13
  15. Hujo

    Hujo Guest

    scannaa uusi combofix loki
     
    Hujo, 10.02.2009
    #14
  16. m0pee

    m0pee Member

    Liittynyt:
    09.04.2006
    Viestejä:
    59
    Kiitokset:
    0
    Pisteet:
    16
    ComboFix 09-02-10.01 - Lauri 2009-02-10 23:23:55.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1418 [GMT 2:00]
    Running from: c:\documents and settings\Lauri\My Documents\Downloads\SOFTWARE\ComboFix.exe
    AV: Norton 360 *On-access scanning enabled* (Updated)
    FW: Norton 360 *enabled*
    * Created a new restore point
    .

    ((((((((((((((((((((((((( Files Created from 2009-01-10 to 2009-02-10 )))))))))))))))))))))))))))))))
    .

    2009-02-10 22:01 . 2009-02-10 22:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2009-02-10 22:00 . 2009-02-10 22:00 <DIR> d-------- c:\program files\SUPERAntiSpyware
    2009-02-10 22:00 . 2009-02-10 22:00 <DIR> d-------- c:\documents and settings\Lauri\Application Data\SUPERAntiSpyware.com
    2009-02-10 15:39 . 2008-10-10 04:52 4,379,984 --a------ c:\winxp\system32\D3DX9_40.dll
    2009-02-10 15:39 . 2008-10-10 04:52 2,036,576 --a------ c:\winxp\system32\D3DCompiler_40.dll
    2009-02-10 15:39 . 2008-10-27 10:04 514,384 --a------ c:\winxp\system32\XAudio2_3.dll
    2009-02-10 15:39 . 2008-10-10 04:52 452,440 --a------ c:\winxp\system32\d3dx10_40.dll
    2009-02-10 15:39 . 2008-10-27 10:04 235,856 --a------ c:\winxp\system32\xactengine3_3.dll
    2009-02-10 15:39 . 2008-10-27 10:04 70,992 --a------ c:\winxp\system32\XAPOFX1_2.dll
    2009-02-10 15:39 . 2008-10-27 10:04 23,376 --a------ c:\winxp\system32\X3DAudio1_5.dll
    2009-02-10 14:50 . 2009-02-10 14:50 578,560 --a--c--- c:\winxp\system32\dllcache\user32.dll
    2009-02-10 14:48 . 2009-02-10 14:48 <DIR> d-------- c:\winxp\ERUNT
    2009-02-10 14:29 . 2009-02-10 14:29 228 --a------ c:\winxp\system32\spupdsvc.inf
    2009-02-09 23:28 . 2009-02-09 23:28 410,984 --a------ c:\winxp\system32\deploytk.dll
    2009-02-09 20:10 . 2009-02-09 20:10 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
    2009-02-09 20:10 . 2009-02-09 20:10 <DIR> d-------- c:\documents and settings\Lauri\Application Data\Malwarebytes
    2009-02-09 20:10 . 2009-02-09 20:10 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-02-09 20:10 . 2009-01-14 16:11 38,496 --a------ c:\winxp\system32\drivers\mbamswissarmy.sys
    2009-02-09 20:10 . 2009-01-14 16:11 15,504 --a------ c:\winxp\system32\drivers\mbam.sys
    2009-02-09 10:19 . 2009-02-09 10:19 <DIR> d-------- c:\program files\Trend Micro
    2009-02-06 11:15 . 2009-02-06 11:15 164 --a------ C:\install.dat
    2009-01-18 18:58 . 2007-11-14 15:18 553 --a------ c:\winxp\USetup.iss
    2009-01-18 18:57 . 2008-08-05 20:10 1,684,736 --a------ c:\winxp\system32\drivers\Ambfilt.sys
    2009-01-18 18:57 . 2006-01-04 15:41 1,389,056 --a------ c:\winxp\system32\drivers\Monfilt.sys
    2009-01-18 18:57 . 2008-10-23 17:42 290,816 --a------ c:\winxp\vncutil.exe
    2009-01-18 18:57 . 2008-06-24 14:46 104,992 --a------ c:\winxp\RtkAudioService.exe
    2009-01-18 18:57 . 2009-01-05 16:16 34,816 --a------ c:\winxp\system32\RtkCoInstXP.dll
    2009-01-18 15:57 . 2009-01-18 19:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\Electronic Arts
    2009-01-15 21:19 . 2009-01-15 21:19 <DIR> d-------- c:\program files\OpenAL
    2009-01-15 21:19 . 2008-04-28 15:53 805,400 -ra------ c:\winxp\system32\tmpBE.tmp
    2009-01-15 21:19 . 2008-04-28 15:53 805,400 -ra------ c:\winxp\system32\tmpBD.tmp
    2009-01-15 21:19 . 2009-01-15 21:19 444,952 --a------ c:\winxp\system32\wrap_oal.dll
    2009-01-15 21:19 . 2009-01-15 21:19 109,080 --a------ c:\winxp\system32\OpenAL32.dll
    2009-01-15 21:05 . 2009-01-15 21:32 <DIR> d-------- c:\program files\Codemasters

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-02-10 21:25 --------- d-----w c:\documents and settings\Lauri\Application Data\uTorrent
    2009-02-10 21:23 --------- d-----w c:\program files\Common Files\Symantec Shared
    2009-02-10 20:00 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
    2009-02-10 19:54 --------- d-----w c:\program files\Spybot - Search & Destroy
    2009-02-10 19:54 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-02-10 16:34 --------- d-----w c:\program files\Winamp
    2009-02-10 16:33 --------- d-----w c:\documents and settings\Lauri\Application Data\Winamp
    2009-02-10 13:39 --------- d-----w c:\program files\Electronic Arts
    2009-02-10 12:37 --------- d-----w c:\documents and settings\All Users\Application Data\2DBoy
    2009-02-10 12:36 --------- d-----w c:\program files\Peggle Nights Deluxe
    2009-02-10 12:34 --------- d-----w c:\documents and settings\All Users\Application Data\Codemasters
    2009-02-09 21:28 --------- d-----w c:\program files\Java
    2009-02-09 09:17 --------- d-----w c:\program files\Steam
    2009-01-18 16:57 --------- d-----w c:\program files\Realtek
    2009-01-18 15:35 --------- d-----w c:\program files\EA GAMES
    2009-01-18 13:39 --------- d-----w c:\program files\AGEIA Technologies
    2009-01-16 19:59 --------- d-----w c:\program files\Truck Dismount
    2009-01-16 19:59 --------- d-----w c:\program files\Porrasturvat - Stair Dismount
    2009-01-15 19:05 --------- d--h--w c:\program files\InstallShield Installation Information
    2009-01-10 11:02 --------- d-----w c:\documents and settings\Lauri\Application Data\Nokia
    2009-01-09 10:22 806 ----a-w c:\winxp\system32\drivers\SYMEVENT.INF
    2009-01-09 10:22 60,808 ----a-w c:\winxp\system32\S32EVNT1.DLL
    2009-01-09 10:22 124,464 ----a-w c:\winxp\system32\drivers\SYMEVENT.SYS
    2009-01-09 10:22 10,635 ----a-w c:\winxp\system32\drivers\SYMEVENT.CAT
    2009-01-09 10:22 --------- d-----w c:\program files\Symantec
    2009-01-07 12:42 --------- d-----w c:\program files\directx
    2009-01-07 12:33 --------- d-----w c:\program files\Commandos II
    2009-01-06 17:00 4,968,448 ----a-w c:\winxp\system32\drivers\RtkHDAud.sys
    2009-01-05 10:06 --------- d-----w c:\program files\ElastoManiaRegistered
    2009-01-02 05:15 --------- d-----w c:\program files\Filzip
    2009-01-01 18:45 --------- d-----w c:\documents and settings\Lauri\Application Data\dvdcss
    2008-12-30 12:58 18,082,304 ----a-w c:\winxp\RTHDCPL.EXE
    2008-12-26 16:06 --------- d-----w c:\documents and settings\All Users\Application Data\ifolor
    2008-12-26 15:24 --------- d-----w c:\program files\ifolor
    2008-12-26 15:24 --------- d-----w c:\documents and settings\Lauri\Application Data\ifolor
    2008-12-11 10:57 333,952 ----a-w c:\winxp\system32\drivers\srv.sys
    2008-11-29 20:52 111,928 ----a-w c:\winxp\system32\PnkBstrB.exe
    2008-11-29 20:51 5,488,640 ----a-w c:\winxp\system32\xa94468328.exe
    2008-11-29 20:51 5,488,640 ----a-w c:\winxp\system32\xa94468000.exe
    2008-11-29 20:41 5,488,640 ----a-w c:\winxp\system32\xa93878828.exe
    2008-11-29 20:41 5,488,640 ----a-w c:\winxp\system32\xa93878531.exe
    2008-11-29 20:41 5,488,640 ----a-w c:\winxp\system32\xa93861843.exe
    2008-11-29 20:41 5,488,640 ----a-w c:\winxp\system32\xa93861562.exe
    2008-11-29 20:40 5,488,640 ----a-w c:\winxp\system32\xa93806484.exe
    2008-11-29 20:40 5,488,640 ----a-w c:\winxp\system32\xa93806203.exe
    2008-11-29 20:39 5,488,640 ----a-w c:\winxp\system32\xa93757593.exe
    2008-11-29 20:39 5,488,640 ----a-w c:\winxp\system32\xa93757328.exe
    2008-11-29 20:34 5,488,640 ----a-w c:\winxp\system32\xa93420390.exe
    2008-11-29 20:34 5,488,640 ----a-w c:\winxp\system32\xa93420125.exe
    2008-11-29 20:27 5,488,640 ----a-w c:\winxp\system32\xa93016609.exe
    2008-11-29 20:27 5,488,640 ----a-w c:\winxp\system32\xa93016343.exe
    2008-11-29 20:23 5,488,640 ----a-w c:\winxp\system32\xa92789078.exe
    2008-11-29 20:23 5,488,640 ----a-w c:\winxp\system32\xa92787984.exe
    2008-11-29 20:23 5,488,640 ----a-w c:\winxp\system32\xa92762484.exe
    2008-11-29 20:23 5,488,640 ----a-w c:\winxp\system32\xa92762078.exe
    2008-11-29 10:54 22,328 ----a-w c:\documents and settings\Lauri\Application Data\PnkBstrK.sys
    2008-11-29 10:53 682,280 ----a-w c:\winxp\system32\pbsvc.exe
    2008-11-29 10:53 66,872 ----a-w c:\winxp\system32\PnkBstrA.exe
    2008-11-10 19:22 2,720 ----a-w c:\winxp\system32\ealregsnapshot1.reg
    2008-06-30 10:44 324,976 ----a-w c:\program files\mozilla firefox\components\coFFPlgn.dll
    2006-05-03 09:06 163,328 --sh--r c:\winxp\system32\flvDX.dll
    2007-02-21 10:47 31,232 --sh--r c:\winxp\system32\msfDX.dll
    2008-03-16 12:30 216,064 --sh--r c:\winxp\system32\nbDX.dll
    .

    ((((((((((((((((((((((((((((( SnapShot@2009-02-10_15.18.22,57 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2009-01-18 15:35:34 53,248 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
    + 2009-02-10 13:38:44 53,248 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
    - 2009-01-18 15:35:34 12,800 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
    + 2009-02-10 13:38:44 12,800 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
    - 2009-01-18 15:35:35 473,600 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
    + 2009-02-10 13:38:45 473,600 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
    - 2009-01-18 15:35:29 2,676,224 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2009-02-10 13:38:39 2,676,224 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2009-01-18 15:35:30 2,846,720 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2009-02-10 13:38:41 2,846,720 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2009-01-18 15:35:31 563,712 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2009-02-10 13:38:41 563,712 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2009-01-18 15:35:32 567,296 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2009-02-10 13:38:42 567,296 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2009-01-18 15:35:32 576,000 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2009-02-10 13:38:42 576,000 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2009-01-18 15:35:32 577,024 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2009-02-10 13:38:42 577,024 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2009-01-18 15:35:33 577,536 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2009-02-10 13:38:43 577,536 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2009-01-18 15:35:33 577,536 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2009-02-10 13:38:43 577,536 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2009-01-18 15:35:33 578,560 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2009-02-10 13:38:43 578,560 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2009-01-18 15:35:35 578,560 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    + 2009-02-10 13:38:45 578,560 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
    - 2009-01-18 15:35:35 145,920 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
    + 2009-02-10 13:38:45 145,920 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
    - 2009-01-18 15:35:35 159,232 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
    + 2009-02-10 13:38:45 159,232 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
    - 2009-01-18 15:35:36 364,544 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
    + 2009-02-10 13:38:46 364,544 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
    - 2009-01-18 15:35:36 178,176 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
    + 2009-02-10 13:38:46 178,176 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
    - 2009-01-18 15:35:34 223,232 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
    + 2009-02-10 13:38:44 223,232 ----a-w c:\winxp\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
    + 2009-02-10 13:47:46 295,606 ----a-r c:\winxp\Installer\{9A996B6A-846E-4A89-B9C4-17546B7BE49F}\Burnout.exe
    + 2009-02-10 20:00:36 18,944 ----a-r c:\winxp\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
    + 2009-02-10 20:00:36 65,024 ----a-r c:\winxp\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
    + 2006-10-24 01:01:44 780,800 ----a-w c:\winxp\Resources\Themes\Zune\Shell\NormalColor\shellstyle.dll
    + 2009-02-10 20:34:37 16,384 ----atw c:\winxp\Temp\Perflib_Perfdata_618.dat
    + 2009-02-10 20:34:34 16,384 ----atw c:\winxp\Temp\Perflib_Perfdata_66c.dat
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded]
    @="{4433A54A-1AC8-432F-90FC-85F045CF383C}"
    [HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}]
    2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending]
    @="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}"
    [HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}]
    2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected]
    @="{476D0EA3-80F9-48B5-B70B-05E677C9C148}"
    [HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}]
    2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\winxp\system32\ctfmon.exe" [2008-04-14 15360]
    "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-03-14 486856]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-01-15 1830128]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
    "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
    "RivaTuner"="c:\program files\RivaTuner v2.08\RivaTuner.exe" [2008-03-10 2691072]
    "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
    "osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512]
    "NvCplDaemon"="c:\winxp\system32\NvCpl.dll" [2008-09-17 13574144]
    "NvMediaCenter"="c:\winxp\system32\NvMcTray.dll" [2008-09-17 86016]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-09 148888]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\winxp\KHALMNPR.Exe]
    "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\winxp\KHALMNPR.Exe]
    "RTHDCPL"="RTHDCPL.EXE" [2008-12-30 c:\winxp\RTHDCPL.EXE]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\winxp\system32\CTFMON.EXE" [2008-04-14 15360]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "nltide_3"="advpack.dll" [2008-04-14 c:\winxp\system32\advpack.dll]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-03-27 113664]
    Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-11-01 576104]
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-08-02 805392]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
    "ForceClassicControlPanel"= 1 (0x1)

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    2008-05-02 01:42 72208 c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.I420"= i420vfw.dll
    "msacm.avis"= ff_acm.acm
    "VIDC.DVSD"= pdvcodec.dll
    "vidc.VSPX"= vspxvfw.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "c:\\WINXP\\system32\\PnkBstrA.exe"=
    "c:\\WINXP\\system32\\PnkBstrB.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "c:\\Program Files\\Steam\\Steam.exe"=
    "c:\\Program Files\\Steam\\SteamApps\\cuqumber\\counter-strike source\\hl2.exe"=
    "c:\\WINXP\\system32\\dpvsetup.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\EA GAMES\\Mirror's Edge\\Binaries\\MirrorsEdge.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
    "c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutLauncher.exe"=
    "c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutConfigTool.exe"=
    "c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutParadise.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 1 (0x1)

    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
    R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-02-18 149352]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-03 99376]
    R3 FStarForce;FStarForce;c:\winxp\system32\drivers\FStarForce.sys [2008-10-30 9216]
    R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
    S3 ASPI;Advanced SCSI Programming Interface Driver;c:\winxp\system32\drivers\ASPI32.SYS [2008-08-27 16512]
    S3 COH_Mon;COH_Mon;c:\winxp\system32\drivers\COH_Mon.sys [2008-01-12 23888]

    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - COMHOST

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cddc304c-0397-11dd-b178-00508db7f3cb}]
    \Shell\AutoRun\command - F:\setupSNK.exe
    .
    .
    ------- Supplementary Scan -------
    .
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    FF - ProfilePath - c:\documents and settings\Lauri\Application Data\Mozilla\Firefox\Profiles\cxrlyn8r.default\
    FF - prefs.js: browser.startup.homepage - hxxps://posti.sakky.fi/horde3/imp/login.php
    FF - component: c:\program files\Mozilla Firefox\components\coFFPlgn.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-02-10 23:26:32
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-448539723-573735546-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
    "??"=hex:a8,7e,78,49,f9,b0,79,61,57,db,60,5e,4e,58,ce,05,0f,a1,d1,3c,93,03,2b,
    fd,55,22,86,95,5b,f7,62,d4,f7,59,de,3f,de,5c,13,2a,c7,20,e7,2b,28,c1,54,ed,\
    "??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50

    [HKEY_USERS\S-1-5-21-448539723-573735546-839522115-1004\Software\SecuROM\License information*]
    "datasecu"=hex:4d,5c,00,c4,dc,92,01,f6,4f,a0,dd,d6,c7,ea,a0,e6,93,10,91,c0,d3,
    3e,f9,da,5c,f8,50,0f,ca,e3,fb,aa,93,89,47,1b,34,ff,6e,65,25,61,c3,fa,e4,87,\
    "rkeysecu"=hex:cc,31,22,60,21,5f,50,e9,8c,4e,3d,41,70,20,8a,50
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(804)
    c:\program files\SUPERAntiSpyware\SASWINLO.dll
    c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
    c:\program files\common files\logitech\bluetooth\LBTServ.dll
    .
    Completion time: 2009-02-10 23:27:38
    ComboFix-quarantined-files.txt 2009-02-10 21:27:36
    ComboFix2.txt 2009-02-10 13:19:04

    Pre-Run: 62 086 492 160 bytes free
    Post-Run: 62,065,475,584 bytes free

    296 --- E O F --- 2009-02-06 19:03:33
     
    m0pee, 10.02.2009
    #15
  17. Hujo

    Hujo Guest

    Nyt tuon alla olevan lainauksen sisällön Kopioit / liität Tyhjään muistioon
    käynnistä nappi >apuohjelmat > muistio

    Tallenna se nimellä CFScript.txt työpöydälle

    Sitten raahaa CFScript ComboFix.exeen kuten alla.

    [​IMG]

    combofix työstää tulee sininen taulu paina numeroa 1 ja enter

    Laita tuleva loki tänne.

    Sammutat ja käynnistät koneen
     
    Hujo, 10.02.2009
    #16
  18. m0pee

    m0pee Member

    Liittynyt:
    09.04.2006
    Viestejä:
    59
    Kiitokset:
    0
    Pisteet:
    16
    ComboFix 09-02-10.02 - Lauri 2009-02-11 8:20:47.3 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1383 [GMT 2:00]
    Running from: c:\documents and settings\Lauri\My Documents\Downloads\SOFTWARE\ComboFix.exe
    Command switches used :: c:\documents and settings\Lauri\My Documents\Downloads\SOFTWARE\CFScript.txt
    AV: Norton 360 *On-access scanning disabled* (Updated)
    FW: Norton 360 *disabled*
    * Created a new restore point

    FILE ::
    c:\winxp\system32\xa92762078.exe
    c:\winxp\system32\xa92762484.exe
    c:\winxp\system32\xa92787984.exe
    c:\winxp\system32\xa92789078.exe
    c:\winxp\system32\xa93016343.exe
    c:\winxp\system32\xa93016609.exe
    c:\winxp\system32\xa93420125.exe
    c:\winxp\system32\xa93420390.exe
    c:\winxp\system32\xa93757328.exe
    c:\winxp\system32\xa93757593.exe
    c:\winxp\system32\xa93806203.exe
    c:\winxp\system32\xa93806484.exe
    c:\winxp\system32\xa93861562.exe
    c:\winxp\system32\xa93861843.exe
    c:\winxp\system32\xa93878531.exe
    c:\winxp\system32\xa93878828.exe
    c:\winxp\system32\xa94468000.exe
    c:\winxp\system32\xa94468328.exe
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\winxp\system32\xa92762078.exe
    c:\winxp\system32\xa92762484.exe
    c:\winxp\system32\xa92787984.exe
    c:\winxp\system32\xa92789078.exe
    c:\winxp\system32\xa93016343.exe
    c:\winxp\system32\xa93016609.exe
    c:\winxp\system32\xa93420125.exe
    c:\winxp\system32\xa93420390.exe
    c:\winxp\system32\xa93757328.exe
    c:\winxp\system32\xa93757593.exe
    c:\winxp\system32\xa93806203.exe
    c:\winxp\system32\xa93806484.exe
    c:\winxp\system32\xa93861562.exe
    c:\winxp\system32\xa93861843.exe
    c:\winxp\system32\xa93878531.exe
    c:\winxp\system32\xa93878828.exe
    c:\winxp\system32\xa94468000.exe
    c:\winxp\system32\xa94468328.exe

    .
    ((((((((((((((((((((((((( Files Created from 2009-01-11 to 2009-02-11 )))))))))))))))))))))))))))))))
    .

    2009-02-10 22:01 . 2009-02-10 22:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2009-02-10 22:00 . 2009-02-10 22:00 <DIR> d-------- c:\program files\SUPERAntiSpyware
    2009-02-10 22:00 . 2009-02-10 22:00 <DIR> d-------- c:\documents and settings\Lauri\Application Data\SUPERAntiSpyware.com
    2009-02-10 15:39 . 2008-10-10 04:52 4,379,984 --a------ c:\winxp\system32\D3DX9_40.dll
    2009-02-10 15:39 . 2008-10-10 04:52 2,036,576 --a------ c:\winxp\system32\D3DCompiler_40.dll
    2009-02-10 15:39 . 2008-10-27 10:04 514,384 --a------ c:\winxp\system32\XAudio2_3.dll
    2009-02-10 15:39 . 2008-10-10 04:52 452,440 --a------ c:\winxp\system32\d3dx10_40.dll
    2009-02-10 15:39 . 2008-10-27 10:04 235,856 --a------ c:\winxp\system32\xactengine3_3.dll
    2009-02-10 15:39 . 2008-10-27 10:04 70,992 --a------ c:\winxp\system32\XAPOFX1_2.dll
    2009-02-10 15:39 . 2008-10-27 10:04 23,376 --a------ c:\winxp\system32\X3DAudio1_5.dll
    2009-02-10 14:50 . 2009-02-10 14:50 578,560 --a--c--- c:\winxp\system32\dllcache\user32.dll
    2009-02-10 14:48 . 2009-02-10 14:48 <DIR> d-------- c:\winxp\ERUNT
    2009-02-10 14:29 . 2009-02-10 14:29 228 --a------ c:\winxp\system32\spupdsvc.inf
    2009-02-09 23:28 . 2009-02-09 23:28 410,984 --a------ c:\winxp\system32\deploytk.dll
    2009-02-09 20:10 . 2009-02-09 20:10 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
    2009-02-09 20:10 . 2009-02-09 20:10 <DIR> d-------- c:\documents and settings\Lauri\Application Data\Malwarebytes
    2009-02-09 20:10 . 2009-02-09 20:10 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-02-09 20:10 . 2009-01-14 16:11 38,496 --a------ c:\winxp\system32\drivers\mbamswissarmy.sys
    2009-02-09 20:10 . 2009-01-14 16:11 15,504 --a------ c:\winxp\system32\drivers\mbam.sys
    2009-02-09 10:19 . 2009-02-09 10:19 <DIR> d-------- c:\program files\Trend Micro
    2009-02-06 11:15 . 2009-02-06 11:15 164 --a------ C:\install.dat
    2009-01-18 18:58 . 2007-11-14 15:18 553 --a------ c:\winxp\USetup.iss
    2009-01-18 18:57 . 2008-08-05 20:10 1,684,736 --a------ c:\winxp\system32\drivers\Ambfilt.sys
    2009-01-18 18:57 . 2006-01-04 15:41 1,389,056 --a------ c:\winxp\system32\drivers\Monfilt.sys
    2009-01-18 18:57 . 2008-10-23 17:42 290,816 --a------ c:\winxp\vncutil.exe
    2009-01-18 18:57 . 2008-06-24 14:46 104,992 --a------ c:\winxp\RtkAudioService.exe
    2009-01-18 18:57 . 2009-01-05 16:16 34,816 --a------ c:\winxp\system32\RtkCoInstXP.dll
    2009-01-18 15:57 . 2009-01-18 19:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\Electronic Arts
    2009-01-15 21:19 . 2009-01-15 21:19 <DIR> d-------- c:\program files\OpenAL
    2009-01-15 21:19 . 2008-04-28 15:53 805,400 -ra------ c:\winxp\system32\tmpBE.tmp
    2009-01-15 21:19 . 2008-04-28 15:53 805,400 -ra------ c:\winxp\system32\tmpBD.tmp
    2009-01-15 21:19 . 2009-01-15 21:19 444,952 --a------ c:\winxp\system32\wrap_oal.dll
    2009-01-15 21:19 . 2009-01-15 21:19 109,080 --a------ c:\winxp\system32\OpenAL32.dll
    2009-01-15 21:05 . 2009-01-15 21:32 <DIR> d-------- c:\program files\Codemasters

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-02-11 06:20 --------- d-----w c:\program files\Common Files\Symantec Shared
    2009-02-11 06:18 --------- d-----w c:\documents and settings\Lauri\Application Data\uTorrent
    2009-02-10 20:00 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
    2009-02-10 19:54 --------- d-----w c:\program files\Spybot - Search & Destroy
    2009-02-10 19:54 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-02-10 16:34 --------- d-----w c:\program files\Winamp
    2009-02-10 16:33 --------- d-----w c:\documents and settings\Lauri\Application Data\Winamp
    2009-02-10 13:39 --------- d-----w c:\program files\Electronic Arts
    2009-02-10 12:37 --------- d-----w c:\documents and settings\All Users\Application Data\2DBoy
    2009-02-10 12:36 --------- d-----w c:\program files\Peggle Nights Deluxe
    2009-02-10 12:34 --------- d-----w c:\documents and settings\All Users\Application Data\Codemasters
    2009-02-09 21:28 --------- d-----w c:\program files\Java
    2009-02-09 09:17 --------- d-----w c:\program files\Steam
    2009-01-18 16:57 --------- d-----w c:\program files\Realtek
    2009-01-18 15:35 --------- d-----w c:\program files\EA GAMES
    2009-01-18 13:39 --------- d-----w c:\program files\AGEIA Technologies
    2009-01-16 19:59 --------- d-----w c:\program files\Truck Dismount
    2009-01-16 19:59 --------- d-----w c:\program files\Porrasturvat - Stair Dismount
    2009-01-15 19:05 --------- d--h--w c:\program files\InstallShield Installation Information
    2009-01-10 11:02 --------- d-----w c:\documents and settings\Lauri\Application Data\Nokia
    2009-01-09 10:22 806 ----a-w c:\winxp\system32\drivers\SYMEVENT.INF
    2009-01-09 10:22 60,808 ----a-w c:\winxp\system32\S32EVNT1.DLL
    2009-01-09 10:22 124,464 ----a-w c:\winxp\system32\drivers\SYMEVENT.SYS
    2009-01-09 10:22 10,635 ----a-w c:\winxp\system32\drivers\SYMEVENT.CAT
    2009-01-09 10:22 --------- d-----w c:\program files\Symantec
    2009-01-07 12:42 --------- d-----w c:\program files\directx
    2009-01-07 12:33 --------- d-----w c:\program files\Commandos II
    2009-01-06 17:00 4,968,448 ----a-w c:\winxp\system32\drivers\RtkHDAud.sys
    2009-01-05 10:06 --------- d-----w c:\program files\ElastoManiaRegistered
    2009-01-02 05:15 --------- d-----w c:\program files\Filzip
    2009-01-01 18:45 --------- d-----w c:\documents and settings\Lauri\Application Data\dvdcss
    2008-12-30 12:58 18,082,304 ----a-w c:\winxp\RTHDCPL.EXE
    2008-12-26 16:06 --------- d-----w c:\documents and settings\All Users\Application Data\ifolor
    2008-12-26 15:24 --------- d-----w c:\program files\ifolor
    2008-12-26 15:24 --------- d-----w c:\documents and settings\Lauri\Application Data\ifolor
    2008-12-11 10:57 333,952 ----a-w c:\winxp\system32\drivers\srv.sys
    2008-11-29 20:52 111,928 ----a-w c:\winxp\system32\PnkBstrB.exe
    2008-11-29 10:54 22,328 ----a-w c:\documents and settings\Lauri\Application Data\PnkBstrK.sys
    2008-11-29 10:53 682,280 ----a-w c:\winxp\system32\pbsvc.exe
    2008-11-29 10:53 66,872 ----a-w c:\winxp\system32\PnkBstrA.exe
    2008-06-30 10:44 324,976 ----a-w c:\program files\mozilla firefox\components\coFFPlgn.dll
    2006-05-03 09:06 163,328 --sh--r c:\winxp\system32\flvDX.dll
    2007-02-21 10:47 31,232 --sh--r c:\winxp\system32\msfDX.dll
    2008-03-16 12:30 216,064 --sh--r c:\winxp\system32\nbDX.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayExcluded]
    @="{4433A54A-1AC8-432F-90FC-85F045CF383C}"
    [HKEY_CLASSES_ROOT\CLSID\{4433A54A-1AC8-432F-90FC-85F045CF383C}]
    2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayPending]
    @="{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}"
    [HKEY_CLASSES_ROOT\CLSID\{F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225}]
    2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\OverlayProtected]
    @="{476D0EA3-80F9-48B5-B70B-05E677C9C148}"
    [HKEY_CLASSES_ROOT\CLSID\{476D0EA3-80F9-48B5-B70B-05E677C9C148}]
    2008-10-31 12:24 576352 --a------ c:\program files\Common Files\Symantec Shared\Backup\buShell.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\winxp\system32\ctfmon.exe" [2008-04-14 15360]
    "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-03-14 486856]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-01-15 1830128]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-14 644696]
    "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-03 1603152]
    "RivaTuner"="c:\program files\RivaTuner v2.08\RivaTuner.exe" [2008-03-10 2691072]
    "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-10-17 51048]
    "osCheck"="c:\program files\Norton 360\osCheck.exe" [2008-02-26 988512]
    "NvCplDaemon"="c:\winxp\system32\NvCpl.dll" [2008-09-17 13574144]
    "NvMediaCenter"="c:\winxp\system32\NvMcTray.dll" [2008-09-17 86016]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-09 148888]
    "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\winxp\KHALMNPR.Exe]
    "Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\winxp\KHALMNPR.Exe]
    "RTHDCPL"="RTHDCPL.EXE" [2008-12-30 c:\winxp\RTHDCPL.EXE]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\winxp\system32\CTFMON.EXE" [2008-04-14 15360]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "nltide_3"="advpack.dll" [2008-04-14 c:\winxp\system32\advpack.dll]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-03-27 113664]
    Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-11-01 576104]
    Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-08-02 805392]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
    "ForceClassicControlPanel"= 1 (0x1)

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    2008-05-02 01:42 72208 c:\program files\Common Files\Logitech\Bluetooth\LBTWLgn.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.I420"= i420vfw.dll
    "msacm.avis"= ff_acm.acm
    "VIDC.DVSD"= pdvcodec.dll
    "vidc.VSPX"= vspxvfw.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "c:\\WINXP\\system32\\PnkBstrA.exe"=
    "c:\\WINXP\\system32\\PnkBstrB.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "c:\\Program Files\\Steam\\Steam.exe"=
    "c:\\Program Files\\Steam\\SteamApps\\cuqumber\\counter-strike source\\hl2.exe"=
    "c:\\WINXP\\system32\\dpvsetup.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\EA GAMES\\Mirror's Edge\\Binaries\\MirrorsEdge.exe"=
    "c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
    "c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutLauncher.exe"=
    "c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutConfigTool.exe"=
    "c:\\Program Files\\Electronic Arts\\Burnout(TM) Paradise The Ultimate Box\\BurnoutParadise.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 1 (0x1)

    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
    R2 LiveUpdate Notice;LiveUpdate Notice;c:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [2008-02-18 149352]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-03 99376]
    R3 FStarForce;FStarForce;c:\winxp\system32\drivers\FStarForce.sys [2008-10-30 9216]
    R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
    S3 ASPI;Advanced SCSI Programming Interface Driver;c:\winxp\system32\drivers\ASPI32.SYS [2008-08-27 16512]
    S3 COH_Mon;COH_Mon;c:\winxp\system32\drivers\COH_Mon.sys [2008-01-12 23888]

    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - COMHOST

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cddc304c-0397-11dd-b178-00508db7f3cb}]
    \Shell\AutoRun\command - F:\setupSNK.exe
    .
    .
    ------- Supplementary Scan -------
    .
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    IE: Send To Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    FF - ProfilePath - c:\documents and settings\Lauri\Application Data\Mozilla\Firefox\Profiles\cxrlyn8r.default\
    FF - prefs.js: browser.startup.homepage - hxxps://posti.sakky.fi/horde3/imp/login.php
    FF - component: c:\program files\Mozilla Firefox\components\coFFPlgn.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-02-11 08:21:29
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-448539723-573735546-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
    "??"=hex:a8,7e,78,49,f9,b0,79,61,57,db,60,5e,4e,58,ce,05,0f,a1,d1,3c,93,03,2b,
    fd,55,22,86,95,5b,f7,62,d4,f7,59,de,3f,de,5c,13,2a,c7,20,e7,2b,28,c1,54,ed,\
    "??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50

    [HKEY_USERS\S-1-5-21-448539723-573735546-839522115-1004\Software\SecuROM\License information*]
    "datasecu"=hex:4d,5c,00,c4,dc,92,01,f6,4f,a0,dd,d6,c7,ea,a0,e6,93,10,91,c0,d3,
    3e,f9,da,5c,f8,50,0f,ca,e3,fb,aa,93,89,47,1b,34,ff,6e,65,25,61,c3,fa,e4,87,\
    "rkeysecu"=hex:cc,31,22,60,21,5f,50,e9,8c,4e,3d,41,70,20,8a,50
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(804)
    c:\program files\SUPERAntiSpyware\SASWINLO.dll
    c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
    c:\program files\common files\logitech\bluetooth\LBTServ.dll
    .
    Completion time: 2009-02-11 8:22:37
    ComboFix-quarantined-files.txt 2009-02-11 06:22:35
    ComboFix2.txt 2009-02-10 21:27:39
    ComboFix3.txt 2009-02-10 13:19:04

    Pre-Run: 62 065 885 184 bytes free
    Post-Run: 61,945,597,952 bytes free

    272 --- E O F --- 2009-02-06 19:03:33
     
    m0pee, 11.02.2009
    #17
  19. Hujo

    Hujo Guest

    Kirjoita suorita luukkuun

    ComboFix /u

    Klikkaa ok

    ============

    Lataa Tästä Ccleaner
    CCleaner v 2.14.750.- Standard Build, ÄLÄ aseenna Yahoo toolbaria!
    Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
    Asennuksen jälkeen aukaise CCleaneri.
    Valitse vasemmalta pystyrivistä Options.
    Valitse viereisestä pystyrivistä Settings.
    Language kohtaan valitse Suomi.

    Puhdistaja
    Valitse vasemmalta pystyrivistä Puhdistaja.
    Paina alhaalta Tutki.
    Nyt CCleaneri tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
    Kun tutkiminen on valmis, paina Aja CCleaner.
    Nyt CCleaneri poistaa löydetyt tempit, cookiessit jne.

    Rekisterin virheiden korjaus
    Valitse vasemmalta pystyrivistä Rekisteri.
    Paina alhaalta Etsi rekisterin virheitä.
    Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
    Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
    Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
    Saat vielä varmistus kysymyksen, paina Ok.
    Kun virheet on korjattu, paina Sulje.
    Nyt voit sulkea CCleanerin painamalla oikealta ylhäältä punaista rastia.
     
    Hujo, 11.02.2009
    #18
  20. m0pee

    m0pee Member

    Liittynyt:
    09.04.2006
    Viestejä:
    59
    Kiitokset:
    0
    Pisteet:
    16
    Nämä tehty, vieläkö on jotain?
     
    m0pee, 11.02.2009
    #19
  21. Hujo

    Hujo Guest

    Hujo, 11.02.2009
    #20
Sivu 1 / 2

Jaa tämä sivu