1. Tämä sivusto käyttää keksejä (cookie). Jatkamalla sivuston käyttämistä hyväksyt keksien käyttämisen. Lue lisää.

Kone hidastelee. hjt-log

Viestiketju Virukset ja haittaohjelmat - HijackThis -logit -osiossa. Ketjun avasi lehmis 16.06.2008.

  1. lehmis

    lehmis Member

    Liittynyt:
    17.04.2005
    Viestejä:
    10
    Kiitokset:
    0
    Pisteet:
    11
    Kone ei tunnu kauhean puhtaalta ja pieni apu voisi olla tarpeen.
    Kiitokset jo etukäteen.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:28:21, on 16.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\Nero 8\Nero 8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\EPoX\EPTP\EPTP.EXE
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    E:\valve\steam\steam.exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\mIRC\mirc.exe
    C:\Program Files\Winamp\winamp.exe
    C:\Program Files\Last.fm\LastFM.exe
    C:\Program Files\Opera\Opera.exe
    C:\Hjt\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.inet.fi:800
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;<local>
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [hwmdr] "C:\Program Files\EPoX\EPTP\EPTP.EXE" "5000"
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Nero 8\Nero 8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\RunServices: [psyspy-2.1.4 Client Server] C:\WINDOWS\system32\telecms.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Steam] "e:\valve\steam\steam.exe" -silent
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Nero 8\Nero 8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 5796 bytes
     
  2.  
  3. yaht

    yaht Regular member

    Liittynyt:
    07.12.2005
    Viestejä:
    2,261
    Kiitokset:
    0
    Pisteet:
    46
    1. Lataa Combofix.exe työpöydällesi jommastakummasta linkistä:
    Combofix.exe
    Combofix.exe

    Avaa Muistio ja kopioi/liitä Lainaus: laatikon sisältö sinne:



    Tallenna nimellä CFScript (itse asiassa combofix tunnistaa tuon vaikka tiedostopääte ei olisi
    edes .txt).

    Sitten raahaa ja pudota CFScript ComboFix.exeen kuten alla.(Älä klikkaa)

    [​IMG]


    Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.
    Käynnistä kone uudelleen, jos niin pyydetään ja lähetä combofix.txt-tiedoston sisältö tänne.

    Sammuta selain ja muut ohjelmat Fixin ajaksi. (ei virustorjuntaa)
    Käynnistä HijackThis:ja Scan ja ruksaa seuraavat punaisella listatut tiedostot sekä poista ne.(fix Chekked)


    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\RunServices: [psyspy-2.1.4 Client Server] C:\WINDOWS\system32\telecms.exe


    Tyhjennä roskakori ja käynnistä koneesi uudelleen.

    Postita tänne seuraavat lokit:
    * Tuore HijackThis loki (Otetaan viimeisenä ennen postitusta)
    * (C:\ComboFix.txt) raportti
    *
     
  4. lehmis

    lehmis Member

    Liittynyt:
    17.04.2005
    Viestejä:
    10
    Kiitokset:
    0
    Pisteet:
    11
    Cf-raportti:

    ComboFix 08-06-15.4 - pestu 2008-06-16 18:03:31.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1035.18.1412 [GMT 3:00]
    Running from: C:\Documents and Settings\pestu\Työpöytä\cf\ComboFix.exe
    Command switches used :: C:\Documents and Settings\pestu\Työpöytä\cf\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\WINDOWS\system32\telecms.exe
    .

    ((((( Tiedostot, jotka on luotu seuraavalla aikavälillä: 2008-05-16 to 2008-06-16 )))))))))))))))))
    .

    2008-06-04 08:44 . 2008-06-04 08:45 <KANSIO> d-------- C:\Program Files\Common Files\Adobe
    2008-05-30 01:07 . 2008-05-30 01:09 <KANSIO> d-------- C:\Program Files\SpywareBlaster
    2008-05-30 01:07 . 2008-05-30 01:12 <KANSIO> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
    2008-05-30 01:07 . 2005-04-15 19:58 1,071,088 --a------ C:\WINDOWS\system32\MSCOMCTL.OCX
    2008-05-30 01:07 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
    2008-05-30 01:07 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
    2008-05-30 00:38 . 2008-05-30 00:38 <KANSIO> d-------- C:\Documents and Settings\Jõrjestelmõnvalvoja
    2008-05-30 00:15 . 2008-06-16 17:28 <KANSIO> d-------- C:\Hjt
    2008-05-29 13:14 . 2008-05-29 13:14 <KANSIO> d-------- C:\Program Files\Lavasoft
    2008-05-29 13:14 . 2008-05-29 13:16 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-05-29 13:13 . 2008-05-29 13:13 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-05-28 23:47 . 2008-05-28 23:47 369 --a------ C:\vundoFIX.exe
    2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\WINDOWS\system32\lsdelete.exe

    .
    (((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-16 15:00 --------- d-----w C:\Documents and Settings\pestu\Application Data\mIRC
    2008-06-16 14:58 --------- d-----w C:\Documents and Settings\pestu\Application Data\DNA
    2008-06-16 13:39 196,608 ----a-w C:\WINDOWS\system32\drivers\nStandard.bin
    2008-06-15 17:25 --------- d-----w C:\Program Files\Opera
    2008-06-15 15:48 --------- d-----w C:\Program Files\mIRC
    2008-06-15 15:45 1,433,600 ----a-w C:\WINDOWS\Internet Logs\xDB14.tmp
    2008-06-15 15:44 511,488 ----a-w C:\WINDOWS\Internet Logs\xDB13.tmp
    2008-06-15 15:00 71,890,976 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
    2008-06-14 12:54 1,728,512 ----a-w C:\WINDOWS\Internet Logs\xDB11.tmp
    2008-06-14 12:54 1,433,088 ----a-w C:\WINDOWS\Internet Logs\xDB12.tmp
    2008-06-11 14:58 2,914,304 ----a-w C:\WINDOWS\Internet Logs\xDBF.tmp
    2008-06-11 14:58 1,428,992 ----a-w C:\WINDOWS\Internet Logs\xDB10.tmp
    2008-06-08 10:56 --------- d-----w C:\Program Files\DC++
    2008-06-06 14:58 --------- d-----w C:\Program Files\Winamp
    2008-06-06 14:58 --------- d-----w C:\Documents and Settings\pestu\Application Data\Winamp
    2008-06-03 12:46 --------- d-----w C:\Documents and Settings\pestu\Application Data\BitTorrent
    2008-05-29 20:46 548,168 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
    2008-05-29 12:41 --------- d-----w C:\Program Files\Last.fm
    2008-05-29 10:09 --------- d-----w C:\Documents and Settings\pestu\Application Data\Lavasoft
    2008-05-28 20:47 369 ----a-w C:\vundoFIX.exe
    2008-05-26 20:27 2,154,447 ----a-w C:\WINDOWS\Internet Logs\tvDebug.zip
    2008-05-18 10:43 593,408 ----a-w C:\WINDOWS\Internet Logs\xDBD.tmp
    2008-05-18 10:43 1,408,512 ----a-w C:\WINDOWS\Internet Logs\xDBE.tmp
    2008-05-16 19:25 514,560 ----a-w C:\WINDOWS\Internet Logs\xDBC.tmp
    2008-05-15 13:35 1,707,008 ----a-w C:\WINDOWS\Internet Logs\xDBA.tmp
    2008-05-15 13:35 1,405,952 ----a-w C:\WINDOWS\Internet Logs\xDBB.tmp
    2008-05-10 20:54 2,720,256 ----a-w C:\WINDOWS\Internet Logs\xDB8.tmp
    2008-05-10 20:54 1,404,416 ----a-w C:\WINDOWS\Internet Logs\xDB9.tmp
    2008-05-09 14:06 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
    2008-05-09 14:02 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
    2008-05-08 12:49 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
    2008-05-08 12:49 --------- d--h--r C:\Documents and Settings\pestu\Application Data\SecuROM
    2008-05-08 12:18 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-05-08 12:17 --------- d-----w C:\Documents and Settings\pestu\Application Data\InstallShield
    2008-05-06 15:33 946,688 ----a-w C:\WINDOWS\Internet Logs\xDB7.tmp
    2008-05-04 13:31 2,963,456 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp
    2008-05-04 13:31 1,394,688 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp
    2008-05-01 14:40 --------- d-----w C:\Documents and Settings\pestu\Application Data\Nero
    2008-05-01 14:39 --------- d-----w C:\Program Files\Common Files\Nero
    2008-05-01 14:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
    2008-04-29 08:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
    2008-04-29 08:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys
    2008-04-29 08:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys
    2008-04-10 14:24 2,546,176 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp
    2008-04-10 14:24 1,375,232 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp
    2008-04-03 15:19 3,385,344 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
    2008-03-25 21:07 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
    2008-03-24 15:17 2,969,088 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
    2008-03-24 15:13 22,328 ----a-w C:\Documents and Settings\pestu\Application Data\PnkBstrK.sys
    .

    ((((((((((((((((((((((((((((( snapshot@2008-05-30_ 0.38.17.11 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-05-29 21:32:43 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-15 15:46:05 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-06-04 05:46:14 295,606 ----a-r C:\WINDOWS\Installer\{AC76BA86-7AD7-1035-7B44-A81200000003}\SC_Reader.exe
    .
    (((((((((((((((((((((((((((((( Rekisterin käynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Huom* Tyhjiä arvoja ja laillisia oletusarvoja ei näytetä

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-14 17:12 15360]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
    "Steam"="e:\valve\steam\steam.exe" [2008-03-28 23:39 1271032]
    "BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-03-24 06:04 287040]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-08-03 12:51 202024]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-17 22:40 262401]
    "SoundMan"="SOUNDMAN.EXE" [2005-06-20 16:42 77824 C:\WINDOWS\SOUNDMAN.EXE]
    "hwmdr"="C:\Program Files\EPoX\EPTP\EPTP.exe" [2005-09-06 08:32 22713344]
    "ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-06-21 22:54 919016]
    "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35 90112]
    "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
    "NBKeyScan"="C:\Nero 8\Nero 8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 09:25 1828136]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
    "psyspy-2.1.4 Client Server"="C:\WINDOWS\system32\telecms.exe" [ ]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-09-14 17:12 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.avis"= ff_acm.acm

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\psyspy-2.1.4 Client Server]
    C:\WINDOWS\system32\telecms.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\DNA\\btdna.exe"=
    "C:\\Program Files\\BitTorrent\\bittorrent.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrA.exe"=
    "C:\\WINDOWS\\system32\\PnkBstrB.exe"=
    "C:\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
    "E:\\EA GAMES\\Battlefield 2\\BF2.exe"=
    "D:\\WIC\\wic.exe"=
    "D:\\WIC\\wic_online.exe"=
    "D:\\WIC\\wic_ds.exe"=

    R2 epcpuid;epcpuid;C:\WINDOWS\system32\drivers\epcpuid.sys [2005-03-18 05:32]
    R2 GetBINFile;GetBINFile;C:\WINDOWS\system32\drivers\GetBINFile.sys [2004-11-26 05:08]
    R2 hwmdr;hwmdr;C:\WINDOWS\system32\drivers\hwmdr.sys [2005-08-02 05:21]
    R3 EPScanMemory;EPScanMemory;C:\Program Files\EPoX\EPTP\ScanMemory32.sys [2005-06-21 11:27]
    R3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys [2007-09-13 16:54]

    *Newly Created Service* - CATCHME
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-16 18:05:18
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-06-16 18:07:22
    ComboFix-quarantined-files.txt 2008-06-16 15:07:12
    ComboFix2.txt 2008-05-29 21:38:39

    Pre-Run: 33,615,904,768 tavua vapaana
    Post-Run: 33,626,501,120 tavua vapaana

    154







    hjt-logi:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:14:50, on 16.6.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\Nero 8\Nero 8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\EPoX\EPTP\EPTP.EXE
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\DNA\btdna.exe
    C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Opera\Opera.exe
    C:\Hjt\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.inet.fi:800
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;<local>
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader -linkkiavustaja - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [hwmdr] "C:\Program Files\EPoX\EPTP\EPTP.EXE" "5000"
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
    O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Nero 8\Nero 8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Steam] "e:\valve\steam\steam.exe" -silent
    O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Nero 8\Nero 8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 5361 bytes
     

Jaa tämä sivu