Turvapc virus poistettu, mutta kone jumittaa+hjt loki

Elikkä olen yrittänyt poistaa kyseisen viruksen jo Malwarebytes' Anti-Malware ohjelmalla, mutta silti kone on hidas. Toivottavasti osaat auttaa. Tässä hjt loki:




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:20:41, on 12.6.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure\BackWeb\7681197\Program\BackWeb-7681197.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Launch Manager\QtZgAcer.EXE
C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LManager] C:\Program Files\Launch Manager\QtZgAcer.EXE
O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS\System32\M-AudioTaskBarIcon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Paikallinen palve')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Verkkopalve')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: F-Secure Automatic Update (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: M-Audio USB Installer (MAudioUSBService) - M-Audio - C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe

--
End of file - 7596 bytes

 

1.Lataa combofix.exe työpöydällesi yhdestä linkistä:
combofix1
combofix2

2. Tuplaklikkaa combofix.exe tiedostoa ja seuraa ohjeistuksia.
3. Kun työkalu on valmis, se tuottaa lokin. Lähetä tämä loki viesti ketjuusi.
Huom! Älä klikkaile combofixin ikkunaa käytön aikana. Tämä saattaa aiheuttaa ohjelman jumiutumisen.

 

ComboFix 08-06-11.3 - Acer 2008-06-13 14:39:54.1 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.694 [GMT 3:00]
Running from: C:\Documents and Settings\Acer\Työpöytä\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BM0a6725ef.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\cyjahnte.dll
C:\WINDOWS\system32\drqotbri.dll
C:\WINDOWS\system32\fxyfixvj.dll
C:\WINDOWS\system32\hajhetxq.dll
C:\WINDOWS\system32\kfmlgrba.ini
C:\WINDOWS\system32\luqquaoa.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nllftxuo.dll
C:\WINDOWS\system32\ogoticjw.dll
C:\WINDOWS\system32\qeyqlsdb.ini
C:\WINDOWS\system32\vfmsbpjp.ini

.
((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-05-13 to 2008-06-13 )))))))))))))))))
.

2008-06-12 18:13 . 2008-06-12 18:13 <KANSIO> d--hs---- C:\FOUND.030
2008-06-12 16:40 . 2003-08-19 12:58 82,144 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
2008-06-12 16:40 . 2003-08-19 12:58 29,952 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys
2008-06-12 16:39 . 2008-06-12 16:39 81,920 -r------- C:\WINDOWS\bwUnin-6.1.4.58-7681197L.exe
2008-06-11 22:21 . 2008-06-11 22:21 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-06-11 19:24 . 2008-06-11 19:24 <KANSIO> d-------- C:\Program Files\Yahoo!
2008-06-11 19:24 . 2008-06-11 19:24 <KANSIO> d-------- C:\Program Files\CCleaner
2008-06-11 16:55 . 2008-06-11 16:55 <KANSIO> d-------- C:\Documents and Settings\Acer\Application Data\Malwarebytes
2008-06-11 16:54 . 2008-06-11 16:54 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-11 16:54 . 2008-06-11 16:54 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-11 16:54 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-11 16:54 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-10 19:20 . 2008-06-10 21:48 21,840 --a------ C:\WINDOWS\system32\SIntfNT.dll
2008-06-10 19:20 . 2008-06-10 21:48 17,212 --a------ C:\WINDOWS\system32\SIntf32.dll
2008-06-10 19:20 . 2008-06-10 21:48 12,067 --a------ C:\WINDOWS\system32\SIntf16.dll
2008-06-10 18:18 . 2008-06-10 18:18 94,208 --a------ C:\WINDOWS\DIIUnin.exe
2008-06-10 18:18 . 2008-06-10 19:09 34,721 --a------ C:\WINDOWS\DIIUnin.dat
2008-06-10 18:18 . 2008-06-10 18:18 2,829 --a------ C:\WINDOWS\DIIUnin.pif
2008-06-10 17:14 . 2008-06-10 17:14 <KANSIO> d-------- C:\Program Files\Diablo II
2008-06-08 21:31 . 2008-06-08 21:31 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-06-05 20:10 . 2008-06-05 20:10 <KANSIO> d-------- C:\Documents and Settings\Apcool\Application Data\Spyware Terminator
2008-06-05 19:17 . 2008-06-05 19:17 <KANSIO> d-------- C:\Program Files\Crawler
2008-06-05 19:16 . 2008-06-05 19:16 <KANSIO> d-------- C:\Program Files\Spyware Terminator
2008-06-05 19:16 . 2008-06-05 19:16 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2008-06-05 19:16 . 2008-06-05 19:16 <KANSIO> d-------- C:\Documents and Settings\Acer\Application Data\Spyware Terminator
2008-06-02 10:04 . 2008-06-02 10:04 3,423 --a------ C:\WINDOWS\is154890.exe
2008-05-30 19:44 . 2008-05-31 15:33 534 ---hs---- C:\WINDOWS\system32\haontnwc.ini
2008-05-28 11:40 . 2008-05-28 11:40 <KANSIO> d--hs---- C:\FOUND.029
2008-05-22 12:22 . 2008-05-22 12:22 <KANSIO> d--hs---- C:\FOUND.028
2008-05-13 16:36 . 2008-05-13 16:36 <KANSIO> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-13 16:20 . 2008-05-13 16:20 <KANSIO> d--hs---- C:\FOUND.027

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-03 18:45 --------- d-----w C:\Program Files\MP3 WAV WMA Converter
2008-05-03 09:12 --------- d-----w C:\Program Files\EA SPORTS
2008-04-25 12:29 --------- d-----w C:\Program Files\LucasArts
2008-04-19 11:18 --------- d-----w C:\Program Files\directx
2008-04-01 16:09 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
.

(((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 20:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" []
"AGRSMMSG"="AGRSMMSG.exe" [2005-04-15 11:45 88202 C:\WINDOWS\AGRSMMSG.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-01-08 07:17 102491]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-01-08 07:16 692315]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-07-15 01:07 32768]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-09-15 20:00 110592 C:\WINDOWS\system32\bthprops.cpl]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-09-15 20:00 208952]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-09-15 20:00 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-09-15 20:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-09-15 20:00 455168]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-03 21:05 344064]
"SoundMan"="SOUNDMAN.EXE" [2005-04-22 09:45 77824 C:\WINDOWS\SOUNDMAN.EXE]
"LManager"="C:\Program Files\Launch Manager\QtZgAcer.EXE" [2005-05-05 09:48 286720]
"M-Audio Taskbar Icon"="C:\WINDOWS\System32\M-AudioTaskBarIcon.exe" [2005-12-13 10:39 91136]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2003-07-23 07:00 118833]
"F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2003-05-09 12:30 647168]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 20:00 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\PROGRAM\\backWeb-7681197.exe"=
"C:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"C:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=

R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2003-08-19 12:58]
R2 BackWeb Client - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2008-06-12 16:39]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2003-04-30 14:13]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2003-05-30 15:15]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2002-04-23 15:23]
R2 MAudioUSBService;M-Audio USB Installer;C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe [2005-12-02 09:20]
S3 MAUSB;Service for M-Audio Fast Track Pro Driver (WDM);C:\WINDOWS\system32\DRIVERS\mausb.sys [2005-12-13 10:39]

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-13 15:01:06
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE
C:\ACER\EMANAGER\ANBMSERV.EXE
C:\PROGRAM FILES\F-SECURE\BACKWEB\7681197\PROGRAM\SERVIC~1.EXE
C:\PROGRAM FILES\F-SECURE\ANTI-VIRUS\FSGK32ST.EXE
C:\PROGRAM FILES\F-SECURE\BACKWEB\7681197\PROGRAM\FSBWSYS.EXE
C:\PROGRAM FILES\F-SECURE\ANTI-VIRUS\FSGK32.EXE
C:\PROGRAM FILES\F-SECURE\COMMON\FSMA32.EXE
C:\PROGRAM FILES\F-SECURE\ANTI-VIRUS\FSSM32.EXE
C:\PROGRAM FILES\F-SECURE\COMMON\FSMB32.EXE
C:\PROGRAM FILES\F-SECURE\BACKWEB\7681197\PROGRAM\BACKWEB-7681197.EXE
C:\PROGRAM FILES\F-SECURE\COMMON\FCH32.EXE
C:\PROGRAM FILES\F-SECURE\COMMON\FAMEH32.EXE
C:\PROGRAM FILES\F-SECURE\COMMON\FNRB32.EXE
C:\PROGRAM FILES\F-SECURE\FWES\PROGRAM\FSDFWD.EXE
C:\PROGRAM FILES\F-SECURE\COMMON\FIH32.EXE
C:\PROGRAM FILES\F-SECURE\ANTI-VIRUS\FSAV32.EXE
C:\WINDOWS\SYSTEM32\WSCNTFY.EXE
C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
C:\WINDOWS\SYSTEM32\IMAPI.EXE
.
**************************************************************************
.
Completion time: 2008-06-13 15:03:40 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-13 12:03:26

Pre-Run: 88,535,924,736 tavua vapaana
Post-Run: 91,834,843,136 tavua vapaana

147 --- E O F --- 2008-04-12 18:05:19

 

Lataa Malwarebytes' Anti-Malware työpöydällesi.

1. Tuplaklikkaa mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
2. Lopuksi varmistu, että seuraavat on valittu: Update Malwarebytes', Anti-Malwareja
Launch Malwarebytes' Anti-Malware ja sen jälkeen klikkaaFinish.
3. Jos päivitys löytyy. ohjelma lataa ja asentaa uusimman version.
4. Kun ohjelma on latautunut, valitse Perform full scan ja klikkaa Scan.
5. Kun skanni on valmis, klikkaa OK ja sitten Show Results nähdäksesi tulokset.
6. Varmistu, että kaikki on merkitty ja klikkaa Remove Selected.
7. Tämän jälkeen loki avautuu muistioon. Tallenna se paikkaan, josta löydät sen helposti. Loki
löytyy myös täältä: C:\Documents and Settings\Käyttäjänimi\Application
Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-päiväys.txt
8. Lähetä lokin sisältö seuraavassa viestissäsi.

 

Malwarebytes' Anti-Malware 1.17
Tietokantaversio: 846

23:25:02 14.6.2008
mbam-log-6-14-2008 (23-25-02).txt

Tarkistustyyppi: Täysi tarkistus (C:\|)
Tarkistetut kohteet: 93250
Kulunut aika: 2 hour(s), 7 minute(s), 21 second(s)

Saastuneita muistiprosesseja: 0
Saastuneita muistimoduuleja: 0
Saastuneita rekisteriavaimia: 0
Saastuneita rekisteriarvoja: 0
Saastuneita rekisterikohteita: 0
Saastuneita hakemistoja: 0
Saastuneita tiedostoja: 0

Saastuneita muistiprosesseja:
(Haitallisia kohteita ei löydetty)

Saastuneita muistimoduuleja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriavaimia:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisteriarvoja:
(Haitallisia kohteita ei löydetty)

Saastuneita rekisterikohteita:
(Haitallisia kohteita ei löydetty)

Saastuneita hakemistoja:
(Haitallisia kohteita ei löydetty)

Saastuneita tiedostoja:
(Haitallisia kohteita ei löydetty)

 

Avaa Muistio ja kopioi/liitä quoteboxin sisältö sinne:

Tallenna se nimellä CFScript.txt

Sitten raahaa CFScript ComboFix.exeen kuten alla.


Käynnistä tietokone uudelleen pyydettäessä ja lähetä combofix.txt-tiedoston sisältö tänne.

==========

scannaa hjt:llä merkkaa paina Fix checked

O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll

==============

 

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1035.18.471 [GMT 3:00]
Running from: C:\Documents and Settings\Acer\Työpöytä\ComboFix.exe
Command switches used :: C:\Documents and Settings\Acer\Työpöytä\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\is154890.exe
.

(((((((((((((((((((((((((((((((((((((( Muut poistot ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\PROGRA~1\Crawler
C:\PROGRA~1\Crawler\Toolbar\adrkeys.dat
C:\PROGRA~1\Crawler\Toolbar\Cache\COMMON\DIRLIST_CHBMP.dat
C:\PROGRA~1\Crawler\Toolbar\Cache\COMMON\DIRLIST_MENU.dat
C:\PROGRA~1\Crawler\Toolbar\Cache\COMMON\TRAVEL_CHBMP.dat
C:\PROGRA~1\Crawler\Toolbar\Cache\COMMON\WP_CHBMP.dat
C:\PROGRA~1\Crawler\Toolbar\Cache\COMMON\YP_CHBMP.dat
C:\PROGRA~1\Crawler\Toolbar\Cache\STERM\STERM_BMP.dat
C:\PROGRA~1\Crawler\Toolbar\Cache\STERM\STERM_CHBMP.dat
C:\PROGRA~1\Crawler\Toolbar\Cache\STERM\STERM_MENU.dat
C:\PROGRA~1\Crawler\Toolbar\Cache\STWSG\STBUTTON_BMP.dat
C:\PROGRA~1\Crawler\Toolbar\Cache\STWSG\STBUTTON_CHBMP.dat
C:\PROGRA~1\Crawler\Toolbar\Cache\STWSG\STBUTTON_MENU.dat
C:\PROGRA~1\Crawler\Toolbar\confirm.dat
C:\PROGRA~1\Crawler\Toolbar\ctbcomm.dll
C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
C:\PROGRA~1\Crawler\Toolbar\CTConf.dat
C:\PROGRA~1\Crawler\Toolbar\CTipsDef.dll
C:\PROGRA~1\Crawler\Toolbar\CToolbar.exe
C:\PROGRA~1\Crawler\Toolbar\CUpdate.exe
C:\PROGRA~1\Crawler\Toolbar\firefox\chrome.manifest
C:\PROGRA~1\Crawler\Toolbar\firefox\chrome\crawlertbr.jar
C:\PROGRA~1\Crawler\Toolbar\firefox\components\xshared.dll
C:\PROGRA~1\Crawler\Toolbar\firefox\components\xshared.xpt
C:\PROGRA~1\Crawler\Toolbar\firefox\components\xsupport.dll
C:\PROGRA~1\Crawler\Toolbar\firefox\components\xsupport.xpt
C:\PROGRA~1\Crawler\Toolbar\firefox\components\xwsg.dll
C:\PROGRA~1\Crawler\Toolbar\firefox\components\xwsg.xpt
C:\PROGRA~1\Crawler\Toolbar\firefox\install.ini
C:\PROGRA~1\Crawler\Toolbar\firefox\install.rdf
C:\PROGRA~1\Crawler\Toolbar\Languages\STWSG_CS.cab
C:\PROGRA~1\Crawler\Toolbar\Languages\STWSG_DE.cab
C:\PROGRA~1\Crawler\Toolbar\Languages\STWSG_EN.cab
C:\PROGRA~1\Crawler\Toolbar\Languages\STWSG_ES.cab
C:\PROGRA~1\Crawler\Toolbar\Languages\STWSG_FR.cab
C:\PROGRA~1\Crawler\Toolbar\Languages\STWSG_IT.cab
C:\PROGRA~1\Crawler\Toolbar\Languages\STWSG_PT-BR.cab
C:\PROGRA~1\Crawler\Toolbar\Languages\STWSG_PT.cab
C:\PROGRA~1\Crawler\Toolbar\lookfor.dat
C:\PROGRA~1\Crawler\Toolbar\majorse.dat
C:\PROGRA~1\Crawler\Toolbar\rootmenu.dat
C:\PROGRA~1\Crawler\Toolbar\services.dat
C:\PROGRA~1\Crawler\Toolbar\stwsg_ff.dat
C:\PROGRA~1\Crawler\Toolbar\svc_set.dat
C:\PROGRA~1\Crawler\Toolbar\update\DOMAINS.cab
C:\PROGRA~1\Crawler\Toolbar\WebSecurityGuard.dll
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_000.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_000_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_001.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_001_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_002.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_002_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_003.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_003_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_004.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_004_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_005.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_005_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_006.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_006_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_007.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_007_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_008.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_008_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_009.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_009_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_010.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_010_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_011.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_011_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_012.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_012_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_013.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_013_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_014.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_014_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_015.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_015_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_016.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_016_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_017.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_017_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_018.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_018_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_019.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_019_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_020.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_020_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_021.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_021_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_022.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_022_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_023.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_023_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_024.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\domains_024_diff.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\domains\index.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\g_S-1-5-21-1522346399-2520524457-3137422539-1005.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\p_S-1-5-21-1522346399-2520524457-3137422539-1005.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\w_S-1-5-21-1522346399-2520524457-3137422539-1005.dat
C:\PROGRA~1\Crawler\Toolbar\WSGData\wfilter.dat
C:\Program Files\Crawler\Toolbar\adrkeys.dat
C:\Program Files\Crawler\Toolbar\Cache\COMMON\DIRLIST_CHBMP.dat
C:\Program Files\Crawler\Toolbar\Cache\COMMON\DIRLIST_MENU.dat
C:\Program Files\Crawler\Toolbar\Cache\COMMON\TRAVEL_CHBMP.dat
C:\Program Files\Crawler\Toolbar\Cache\COMMON\WP_CHBMP.dat
C:\Program Files\Crawler\Toolbar\Cache\COMMON\YP_CHBMP.dat
C:\Program Files\Crawler\Toolbar\Cache\STERM\STERM_BMP.dat
C:\Program Files\Crawler\Toolbar\Cache\STERM\STERM_CHBMP.dat
C:\Program Files\Crawler\Toolbar\Cache\STERM\STERM_MENU.dat
C:\Program Files\Crawler\Toolbar\Cache\STWSG\STBUTTON_BMP.dat
C:\Program Files\Crawler\Toolbar\Cache\STWSG\STBUTTON_CHBMP.dat
C:\Program Files\Crawler\Toolbar\Cache\STWSG\STBUTTON_MENU.dat
C:\Program Files\Crawler\Toolbar\confirm.dat
C:\Program Files\Crawler\Toolbar\ctbcomm.dll
C:\Program Files\Crawler\Toolbar\ctbr.dll
C:\Program Files\Crawler\Toolbar\CTConf.dat
C:\Program Files\Crawler\Toolbar\CTipsDef.dll
C:\Program Files\Crawler\Toolbar\CToolbar.exe
C:\Program Files\Crawler\Toolbar\CUpdate.exe
C:\Program Files\Crawler\Toolbar\firefox\chrome.manifest
C:\Program Files\Crawler\Toolbar\firefox\components\xshared.dll
C:\Program Files\Crawler\Toolbar\firefox\components\xshared.xpt
C:\Program Files\Crawler\Toolbar\firefox\components\xsupport.dll
C:\Program Files\Crawler\Toolbar\firefox\components\xsupport.xpt
C:\Program Files\Crawler\Toolbar\firefox\components\xwsg.dll
C:\Program Files\Crawler\Toolbar\firefox\components\xwsg.xpt
C:\Program Files\Crawler\Toolbar\firefox\install.ini
C:\Program Files\Crawler\Toolbar\firefox\install.rdf
C:\Program Files\Crawler\Toolbar\Languages\STWSG_CS.cab
C:\Program Files\Crawler\Toolbar\Languages\STWSG_DE.cab
C:\Program Files\Crawler\Toolbar\Languages\STWSG_EN.cab
C:\Program Files\Crawler\Toolbar\Languages\STWSG_ES.cab
C:\Program Files\Crawler\Toolbar\Languages\STWSG_FR.cab
C:\Program Files\Crawler\Toolbar\Languages\STWSG_IT.cab
C:\Program Files\Crawler\Toolbar\Languages\STWSG_PT-BR.cab
C:\Program Files\Crawler\Toolbar\Languages\STWSG_PT.cab
C:\Program Files\Crawler\Toolbar\lookfor.dat
C:\Program Files\Crawler\Toolbar\majorse.dat
C:\Program Files\Crawler\Toolbar\rootmenu.dat
C:\Program Files\Crawler\Toolbar\services.dat
C:\Program Files\Crawler\Toolbar\stwsg_ff.dat
C:\Program Files\Crawler\Toolbar\svc_set.dat
C:\Program Files\Crawler\Toolbar\update\DOMAINS.cab
C:\Program Files\Crawler\Toolbar\WebSecurityGuard.dll
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_000.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_000_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_001.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_001_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_002.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_002_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_003.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_003_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_004.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_004_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_005.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_005_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_006.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_006_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_007.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_007_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_008.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_008_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_009.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_009_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_010.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_010_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_011.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_011_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_012.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_012_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_013.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_013_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_014.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_014_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_015.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_015_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_016.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_016_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_017.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_017_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_018.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_018_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_019.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_019_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_020.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_020_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_021.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_021_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_022.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_022_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_023.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_023_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_024.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\domains_024_diff.dat
C:\Program Files\Crawler\Toolbar\WSGData\domains\index.dat
C:\Program Files\Crawler\Toolbar\WSGData\g_S-1-5-21-1522346399-2520524457-3137422539-1005.dat
C:\Program Files\Crawler\Toolbar\WSGData\p_S-1-5-21-1522346399-2520524457-3137422539-1005.dat
C:\Program Files\Crawler\Toolbar\WSGData\w_S-1-5-21-1522346399-2520524457-3137422539-1005.dat
C:\Program Files\Crawler\Toolbar\WSGData\wfilter.dat
C:\WINDOWS\is154890.exe
C:\WINDOWS\system32\sysmwwod.dll

.
((((( Tiedostot, jotka on luotu seuraavalla aikav„lill„: 2008-05-14 to 2008-06-14 )))))))))))))))))
.

2008-06-12 18:13 . 2008-06-12 18:13 <KANSIO> d--hs---- C:\FOUND.030
2008-06-12 16:40 . 2003-08-19 12:58 82,144 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
2008-06-12 16:40 . 2003-08-19 12:58 29,952 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys
2008-06-12 16:39 . 2008-06-12 16:39 81,920 -r------- C:\WINDOWS\bwUnin-6.1.4.58-7681197L.exe
2008-06-11 22:21 . 2008-06-11 22:21 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-06-11 19:24 . 2008-06-11 19:24 <KANSIO> d-------- C:\Program Files\Yahoo!
2008-06-11 19:24 . 2008-06-11 19:24 <KANSIO> d-------- C:\Program Files\CCleaner
2008-06-11 16:55 . 2008-06-11 16:55 <KANSIO> d-------- C:\Documents and Settings\Acer\Application Data\Malwarebytes
2008-06-11 16:54 . 2008-06-11 16:54 <KANSIO> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-11 16:54 . 2008-06-11 16:54 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-11 16:54 . 2008-06-10 19:02 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-11 16:54 . 2008-06-10 19:02 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-10 19:20 . 2008-06-10 21:48 21,840 --a------ C:\WINDOWS\system32\SIntfNT.dll
2008-06-10 19:20 . 2008-06-10 21:48 17,212 --a------ C:\WINDOWS\system32\SIntf32.dll
2008-06-10 19:20 . 2008-06-10 21:48 12,067 --a------ C:\WINDOWS\system32\SIntf16.dll
2008-06-10 18:18 . 2008-06-10 18:18 94,208 --a------ C:\WINDOWS\DIIUnin.exe
2008-06-10 18:18 . 2008-06-10 19:09 34,721 --a------ C:\WINDOWS\DIIUnin.dat
2008-06-10 18:18 . 2008-06-10 18:18 2,829 --a------ C:\WINDOWS\DIIUnin.pif
2008-06-10 17:14 . 2008-06-10 17:14 <KANSIO> d-------- C:\Program Files\Diablo II
2008-06-08 21:31 . 2008-06-08 21:31 <KANSIO> d-------- C:\Program Files\Trend Micro
2008-06-05 20:10 . 2008-06-05 20:10 <KANSIO> d-------- C:\Documents and Settings\Apcool\Application Data\Spyware Terminator
2008-06-05 19:16 . 2008-06-05 19:16 <KANSIO> d-------- C:\Program Files\Spyware Terminator
2008-06-05 19:16 . 2008-06-05 19:16 <KANSIO> d-------- C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2008-06-05 19:16 . 2008-06-05 19:16 <KANSIO> d-------- C:\Documents and Settings\Acer\Application Data\Spyware Terminator
2008-05-30 19:44 . 2008-05-31 15:33 534 ---hs---- C:\WINDOWS\system32\haontnwc.ini
2008-05-28 11:40 . 2008-05-28 11:40 <KANSIO> d--hs---- C:\FOUND.029
2008-05-22 12:22 . 2008-05-22 12:22 <KANSIO> d--hs---- C:\FOUND.028

.
(((((((((((((((((((((((((((((((((((( Find3M-raportti ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-13 13:36 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-03 18:45 --------- d-----w C:\Program Files\MP3 WAV WMA Converter
2008-05-03 09:12 --------- d-----w C:\Program Files\EA SPORTS
2008-04-25 12:29 --------- d-----w C:\Program Files\LucasArts
2008-04-19 11:18 --------- d-----w C:\Program Files\directx
2008-04-01 16:09 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
.

((((((((((((((((((((((((((((( snapshot@2008-06-13_15.02.32.75 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-13 11:58:52 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-14 21:15:14 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
(((((((((((((((((((((((((((((( Rekisterin k„ynnistyskohteet )))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Huom* Tyhji„ arvoja ja laillisia oletusarvoja ei n„ytet„

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-15 20:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" []
"AGRSMMSG"="AGRSMMSG.exe" [2005-04-15 11:45 88202 C:\WINDOWS\AGRSMMSG.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2005-01-08 07:17 102491]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-01-08 07:16 692315]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-07-15 01:07 32768]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-09-15 20:00 110592 C:\WINDOWS\system32\bthprops.cpl]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-09-15 20:00 208952]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-09-15 20:00 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-09-15 20:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-09-15 20:00 455168]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-05-03 21:05 344064]
"SoundMan"="SOUNDMAN.EXE" [2005-04-22 09:45 77824 C:\WINDOWS\SOUNDMAN.EXE]
"LManager"="C:\Program Files\Launch Manager\QtZgAcer.EXE" [2005-05-05 09:48 286720]
"M-Audio Taskbar Icon"="C:\WINDOWS\System32\M-AudioTaskBarIcon.exe" [2005-12-13 10:39 91136]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"F-Secure Manager"="C:\Program Files\F-Secure\Common\FSM32.exe" [2003-07-23 07:00 118833]
"F-Secure TNB"="C:\Program Files\F-Secure\TNB\TNBUtil.exe" [2003-05-09 12:30 647168]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-15 20:00 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\F-Secure\\BackWeb\\7681197\\PROGRAM\\backWeb-7681197.exe"=
"C:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"=
"C:\\Program Files\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"=

R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2003-08-19 12:58]
R2 BackWeb Client - 7681197;F-Secure Automatic Update;C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE [2008-06-12 16:39]
R2 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2003-04-30 14:13]
R2 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSgk.sys [2003-05-30 15:15]
R2 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure\Anti-Virus\Win2K\FSrec.sys [2002-04-23 15:23]
R2 MAudioUSBService;M-Audio USB Installer;C:\Program Files\M-Audio\Fast Track Pro\MAUSBInst.exe [2005-12-02 09:20]
S3 MAUSB;Service for M-Audio Fast Track Pro Driver (WDM);C:\WINDOWS\system32\DRIVERS\mausb.sys [2005-12-13 10:39]

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-15 00:16:53
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE
C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE
C:\ACER\EMANAGER\ANBMSERV.EXE
C:\PROGRAM FILES\F-SECURE\BACKWEB\7681197\PROGRAM\SERVIC~1.EXE
C:\PROGRAM FILES\F-SECURE\ANTI-VIRUS\FSGK32ST.EXE
C:\PROGRAM FILES\F-SECURE\BACKWEB\7681197\PROGRAM\FSBWSYS.EXE
C:\PROGRAM FILES\F-SECURE\ANTI-VIRUS\FSGK32.EXE
C:\PROGRAM FILES\F-SECURE\COMMON\FSMA32.EXE
C:\PROGRAM FILES\F-SECURE\ANTI-VIRUS\FSSM32.EXE
C:\PROGRAM FILES\F-SECURE\COMMON\FSMB32.EXE
C:\PROGRAM FILES\F-SECURE\BACKWEB\7681197\PROGRAM\BACKWEB-7681197.EXE
C:\PROGRAM FILES\F-SECURE\COMMON\FCH32.EXE
C:\PROGRAM FILES\F-SECURE\COMMON\FAMEH32.EXE
C:\PROGRAM FILES\F-SECURE\COMMON\FNRB32.EXE
C:\PROGRAM FILES\F-SECURE\FWES\PROGRAM\FSDFWD.EXE
C:\PROGRAM FILES\F-SECURE\COMMON\FIH32.EXE
C:\PROGRAM FILES\F-SECURE\ANTI-VIRUS\FSAV32.EXE
C:\WINDOWS\SYSTEM32\WSCNTFY.EXE
C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
C:\WINDOWS\SYSTEM32\IMAPI.EXE
.
**************************************************************************
.
Completion time: 2008-06-15 0:19:59 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-14 21:19:46
ComboFix2.txt 2008-06-13 12:03:42

Pre-Run: 91,789,819,904 tavua vapaana
Post-Run: 91,766,915,072 tavua vapaana

342 --- E O F --- 2008-04-12 18:05:19

 

mites kone toimii

Poista tuo vielä lisää poista sovelutuksesta

Crawler

 

Vielä pientä lagia esim. kursori tökkii

 

Päivitä Malwarebytes' Anti-Malware ja aja se

 

Onko normaalia, että ....Anti'malwaren ajaminen kestää jopa kolme tuntia?

 

jos koneella hirveesti kamaa.

 

36 gigaa käytettynä eli eikai mitenkään kamalasti

 

nooh aja tuokin vielä

Escan
Ohjeet tuolla sivulla.
http://koti.mbnet.fi/pattaya1/escanmwav.htm
lataa tuosta
http://www.spywareinfo.dk/download/mwav.exe
päivitä tuosta
http://koti.mbnet.fi/pattaya1/lataus/Mwav.bat
laita täpit merkkauksien mukaan
http://koti.mbnet.fi/pattaya1/eScan6.jpg

scannaa

jos ala luukkuun tulee jotain niin kopioi se näin:
Käytä komentoa Ctrl+A.
Kopioi rivit komennolla Ctrl+C.
Liitä rivit komennolla Ctrl+V.

Laita virus log tänne.

========

siintäkin tulee pitkä ajo

 

File C:\Documents and Settings\Apcool\Työpöytä\freeripmp3.exe tagged as not-a-virus:AdTool.Win32.MyWebSearch.br. No Action Taken.

 

C:\Documents and Settings\Apcool\Työpöytä\freeripmp3.exe

Poista

 

Tehty

 

Kone nopeutui hieman muttei samaksi kuin ennen virusta

 

Jotain vielä tehtävissä?

 

Lataa CCleaner tästä

- Asennuksessa poista merkki/rasti kohdasta "asenna Yahoo! toolbar/työkalupalkki".
- Asennuksen jälkeen aukaise CCleaner.
- Valitse vasemmalta pystyrivistä Options.
- Valitse viereisestä pystyrivistä Settings.
- Language kohtaan valitse Suomi.

- Käynnistä CCleaner.
- Valitse Valinnat.
- Paina Lisäasetukset.
- Ota ruksi pois kohdasta "Poista vain yli 48 tuntia vanhat tiedostot Windowsin tilapäiskansioista".

Puhdistaja

- Valitse vasemmalta pystyrivistä Puhdistaja.
- Paina alhaalta Tutki.
Nyt CCleaner tutkii, mitä voidaan poistaa (tempit, cookiessit jne.).
- Kun tutkiminen on valmis, paina Aja CCleaner.
Nyt CCleaner poistaa löydetyt tempit, cookiessit jne.

Rekisterin virheiden korjaus

- Valitse vasemmalta pystyrivistä Rekisteri.
- Paina alhaalta Etsi rekisterin virheitä.
- Kun etsintä on valmis ja olet varma, että haluat korjata ne rivit jotka ovat merkattuja, niin paina Korjaa valitut rekisterin virheet.
- Sinulta kysytään "haluatko varmuuskopioida muutokset rekisteriin", paina Kyllä. Tallenna varmuuskopio vaikka "Omat tiedostot" -kansioon.
- Klikkaa uudesta aukeavasta ikkunasta Korjaa kaikki valitut virheet.
- Saat vielä varmistus kysymyksen, paina Ok.
- Kun virheet on korjattu, paina Sulje.

Nyt voit suljea CCleanerin painamalla oikealta ylhäältä punaista rastia.