HiJackThis apua

Discussion in 'Virukset ja haittaohjelmat' started by Ricustin, Aug 1, 2005.

  1. Ricustin

    Ricustin Member

    Joined:
    Aug 1, 2005
    Messages:
    24
    Likes Received:
    0
    Trophy Points:
    11
    Hain HiJackThis- ohjelman juuri äsken ja tulin siihen tulokseen että tarvitsen apua. Voi siko joku kertoa mikä mättää kun koneen käynnistyessä alkaa viiruksia tulemaan kuin sieniä sateella?

    Logfile of HijackThis v1.99.1
    Scan saved at 2:17:16, on 2.8.2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    C:\sekaa\AVG\AVWUPSRV.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\ALCWZRD.EXE
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\Program Files\D-Tools\daemon.exe
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\windir32.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\sekaa\download\WHATPU~1\WHATPU~2.EXE
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    C:\WINDOWS\system32\windir32.exe
    C:\WINDOWS\etb\pokapoka62.exe
    C:\hjt\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://soft-trend.net
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://soft-trend.net
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://soft-trend.net
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://soft-trend.net
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;<local>;localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O4 - HKLM\..\Run: [High Definition Audio -ominaisuussivun pikakuvake] HDAudPropShortcut.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [Microsoft Windows DLL Services Configuration] windir32.exe
    O4 - HKLM\..\Run: [System service62] C:\WINDOWS\etb\pokapoka62.exe
    O4 - HKLM\..\RunServices: [Microsoft Windows DLL Services Configuration] windir32.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [WhatPulse] C:\sekaa\download\WHATPU~1\WHATPU~2.EXE
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    O4 - HKCU\..\Run: [Microsoft Windows DLL Services Configuration] windir32.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra button: SMS-viesti - {23887A86-FD12-498A-B4E6-8D6F429B0713} - http://sms.kolumbus.fi/ (file missing) (HKCU)
    O9 - Extra button: Tuki - {30359F63-DD31-42DC-ADD3-8D447E633454} - http://tuki.elisa.net/ (file missing) (HKCU)
    O9 - Extra button: Palvelut - {509D2B78-5967-4EAC-B1DC-9634BA757250} - http://service.kolumbus.fi/ (file missing) (HKCU)
    O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
    O15 - Trusted Zone: *.media-motor.net
    O15 - Trusted Zone: *.popuppers.com
    O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {5BDBD95C-1E7F-4FB1-8497-20AF879F8B68} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fi/filesharingctrl.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1107189659078
    O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - https://www.gamespyid.com/alaunch.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O16 - DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} (SDKInstall Class) - http://activex.microsoft.com/activex/controls/sdkupdate/sdkinst.cab
    O20 - Winlogon Notify: drct16 - C:\WINDOWS\SYSTEM32\drct16.dll
    O21 - SSODL: NTLog32 - {9D369A0A-0F66-45DC-B6BA-526E697DF511} - (no file)
    O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\sekaa\AVG\AVGUARD.EXE
    O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\sekaa\AVG\AVWUPSRV.EXE
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: Manageer Network Connections (Kern32) - Unknown owner - C:\WINDOWS\System32\telcmd.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Working Network Connections (TY164) - Unknown owner - C:\WINDOWS\System32\hicom.exe (file missing)
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
     
    Ricustin, Aug 1, 2005
    #1
  2. ion!

    ion! Regular member

    Joined:
    Jan 20, 2004
    Messages:
    408
    Likes Received:
    0
    Trophy Points:
    26
    ion!, Aug 2, 2005
    #2
  3. V-kos

    V-kos Regular member

    Joined:
    Mar 13, 2005
    Messages:
    1,345
    Likes Received:
    0
    Trophy Points:
    46
    Tämä on ilmeiseti ihan sallittu ohjelma.
    C:\sekaa\download\WHATPULSE\WHATPULSE.EXE
    Testaa kuitenkin Jottiksen Online skannerilla jos et ole siitä 100% varma.
    http://virusscan.jotti.org/

    Sammuta järjestelmänhallinnasta prosessit:
    windir32.exe
    pokapoka62.exe

    Laita piilotiedostot näkyviin:
    http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339

    Sulje selain ja ylimääräiset ohjelmat.

    FIXaa:
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://soft-trend.net
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://soft-trend.net
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = http://soft-trend.net
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = http://soft-trend.net
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [Microsoft Windows DLL Services Configuration] windir32.exe
    O4 - HKLM\..\Run: [System service62] C:\WINDOWS\etb\pokapoka62.exe
    O4 - HKLM\..\RunServices: [Microsoft Windows DLL Services Configuration] windir32.exe
    O4 - HKCU\..\Run: [Microsoft Windows DLL Services Configuration] windir32.exe
    O9 - Extra button: SMS-viesti - {23887A86-FD12-498A-B4E6-8D6F429B0713} - http://sms.kolumbus.fi/ (file missing) (HKCU)
    O9 - Extra button: Tuki - {30359F63-DD31-42DC-ADD3-8D447E633454} - http://tuki.elisa.net/ (file missing) (HKCU)
    O9 - Extra button: Palvelut - {509D2B78-5967-4EAC-B1DC-9634BA757250} - http://service.kolumbus.fi/ (file missing) (HKCU)
    O15 - Trusted Zone: *.media-motor.net
    O15 - Trusted Zone: *.popuppers.com
    O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab
    O20 - Winlogon Notify: drct16 - C:\WINDOWS\SYSTEM32\drct16.dll
    O21 - SSODL: NTLog32 - {9D369A0A-0F66-45DC-B6BA-526E697DF511} - (no file)
    O23 - Service: Working Network Connections (TY164) - Unknown owner - C:\WINDOWS\System32\hicom.exe (file missing)

    Poista seuraavat tiedostot vikasietotilassa:
    C:\WINDOWS\etb\ --> pokapoka62.exe
    --> windir32.exe
    --> drct16.dll

    tyhjennä Tempit, väliaikaiset internet tiedostot ja roskis.

    Bootta. kokeile toimiiko. Laita uusi logi

    Nyt väsyttää... Toivottavasti mitään ei unohtunut.







     
    V-kos, Aug 2, 2005
    #3
  4. Ricustin

    Ricustin Member

    Joined:
    Aug 1, 2005
    Messages:
    24
    Likes Received:
    0
    Trophy Points:
    11
    No nyt ei enää tule lisää viiruksia kiitos siitä, mutta nyt on ongelmana aukeilevat popupit ja koneen mystinen hidastelu... En saanut tällä koneella windowsia käynistymään vikasietotillassa. Käynnistäessä ei ollut siihen mahdollisuutta. (?) Ja tässä vielä tuo uusi logi:

    Logfile of HijackThis v1.99.1
    Scan saved at 23:07:29, on 3.8.2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\ALCWZRD.EXE
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\Program Files\D-Tools\daemon.exe
    C:\WINDOWS\etb\pokapoka62.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\sekaa\download\WHATPU~1\WHATPU~2.EXE
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    C:\sekaa\AVG\AVWUPSRV.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Winamp\winamp.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\hjt\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fi/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fi/
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Toimittaja Elisa Internet
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;<local>;localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
     
    Ricustin, Aug 3, 2005
    #4
  5. jersi

    jersi Regular member

    Joined:
    Jan 21, 2005
    Messages:
    198
    Likes Received:
    0
    Trophy Points:
    26
    onkos sulla 2 antiviirusohjelmaa ku olin kattovinaan että AVG ja f-secure jos näin ni toinen joutaa pois.
     
    jersi, Aug 3, 2005
    #5
  6. Ricustin

    Ricustin Member

    Joined:
    Aug 1, 2005
    Messages:
    24
    Likes Received:
    0
    Trophy Points:
    11
    AVG:tä käytän vaan joskus kun ei toi F-secure näytä kaikkee löytävän.
     
    Ricustin, Aug 3, 2005
    #6
  7. jersi

    jersi Regular member

    Joined:
    Jan 21, 2005
    Messages:
    198
    Likes Received:
    0
    Trophy Points:
    26
    kyllä se f-secure on ihan pätevä ohjelma.jos 2 antiviirusohjelmaa käynnissä yhtäaikaa, ni pahimmassa tapauksessa menee kone sekasi...
     
    jersi, Aug 3, 2005
    #7
  8. Ricustin

    Ricustin Member

    Joined:
    Aug 1, 2005
    Messages:
    24
    Likes Received:
    0
    Trophy Points:
    11
    Ei oo päällä yhtä aikaa ;)
     
    Ricustin, Aug 3, 2005
    #8
  9. Ricustin

    Ricustin Member

    Joined:
    Aug 1, 2005
    Messages:
    24
    Likes Received:
    0
    Trophy Points:
    11
    Hankin uusia spyware ohjelmia ja ajettuani ne logi näytttää tältä:

    Logfile of HijackThis v1.99.1
    Scan saved at 1:31:48, on 4.8.2005
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\ALCWZRD.EXE
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\Program Files\D-Tools\daemon.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\etb\pokapoka62.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\sekaa\download\WHATPU~1\WHATPU~2.EXE
    C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    C:\Program Files\Logitech\SetPoint\KEM.exe
    C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    C:\sekaa\AVG\AVWUPSRV.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\WINDOWS\System32\nvsvc32.exe
    C:\WINDOWS\system32\slserv.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\WINDOWS\System32\alg.exe
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\hjt\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fi/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.fi/
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://elisa.net/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer -

    Toimittaja Elisa Internet
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride =

    *.fi;<local>;localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works

    Shared\WkUFind.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [System service62] C:\WINDOWS\etb\pokapoka62.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [WhatPulse] C:\sekaa\download\WHATPU~1\WHATPU~2.EXE
    O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop

    Messenger\8876480\Program\LDMConf.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

    Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

    Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

    Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

    Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra button: Palvelut - {509D2B78-5967-4EAC-B1DC-9634BA757250} - http://service.kolumbus.fi/ (file

    missing) (HKCU)
    O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -

    http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -

    http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) -

    http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {5BDBD95C-1E7F-4FB1-8497-20AF879F8B68} (FileSharingCtrl Class) -

    http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/fi/filesharingctrl.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -

    http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1107189659078
    O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) -

    http://www.installengine.com/engine/isetup.cab
    O16 - DPF: {F2A84794-EE6D-447B-8C21-3BA1DC77C5B4} (SDKInstall Class) -

    http://activex.microsoft.com/activex/controls/sdkupdate/sdkinst.cab
    O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - C:\sekaa\AVG\AVGUARD.EXE
    O23 - Service: Autodesk Licensing Service - Unknown owner - C:\Program Files\Common Files\Autodesk

    Shared\Service\AdskScSrv.exe
    O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - C:\sekaa\AVG\AVWUPSRV.EXE
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program

    Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program

    Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. -

    C:\Program Files\F-Secure\Common\FSAA.EXE
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program

    Files\F-Secure\Common\FSMA32.EXE
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common

    Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Manageer Network Connections (Kern32) - Unknown owner - C:\WINDOWS\System32\telcmd.exe

    (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -

    C:\WINDOWS\System32\nvsvc32.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Working Network Connections (TY164) - Unknown owner - C:\WINDOWS\System32\hicom.exe (file

    missing)
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. -

    C:\WINDOWS\system32\ZoneLabs\vsmon.exe


    Mietin vaan että mikäköhän toi C:\WINDOWS\etb\pokapoka62.exe oikein on ku sitä ei oikeasti ole olemassakaan ja aina kun poistan sen Easy Cleanerilla Käynistyvien ohjelmien joukosta se tulee aina takaisin...
     
    Ricustin, Aug 3, 2005
    #9
  10. ion!

    ion! Regular member

    Joined:
    Jan 20, 2004
    Messages:
    408
    Likes Received:
    0
    Trophy Points:
    26
    ion!, Aug 3, 2005
    #10
  11. V-kos

    V-kos Regular member

    Joined:
    Mar 13, 2005
    Messages:
    1,345
    Likes Received:
    0
    Trophy Points:
    46
    Lataa TheKillBox valmiiksi.
    http://www.bleepingcomputer.com/files/spyware/KillBox.zip

    Piilotidostot näkyviin.
    http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339

    Sulje selain ja ylimääräiset ohjelmat.

    Sammuta MS antispyware.

    Sammuta prosessi:
    pokapoka62.exe

    Fixaa:
    O4 - HKLM\..\Run: [System service62] C:\WINDOWS\etb\pokapoka62.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra button: Palvelut - {509D2B78-5967-4EAC-B1DC-9634BA757250} - http://service.kolumbus.fi/ (filemissing) (HKCU)
    O23 - Service: Manageer Network Connections (Kern32) - Unknown owner - C:\WINDOWS\System32\telcmd.exe (file missing)
    O23 - Service: Working Network Connections (TY164) - Unknown owner - C:\WINDOWS\System32\hicom.exe (file missing)

    Avaa KillBox.

    Laita kohtaan: Full path of file to delete: C:\WINDOWS\etb\pokapoka62.exe

    Ruksi kohtaan Delete on Reboot. Klikkaa punaista nappia.

    Jos ei lähde niin [bold]E[/bold]n[bold]V[/bold]ain[bold]O[/bold]saa.

    Vähän epäilyttää myös tuo WhatPulse. Oletko sitä kauan käyttänyt? Koita auttaisko jos sen poistais käynnistyvistä ennen fixausta.
     
    Last edited: Aug 5, 2005
    V-kos, Aug 5, 2005
    #11
  12. Ricustin

    Ricustin Member

    Joined:
    Aug 1, 2005
    Messages:
    24
    Likes Received:
    0
    Trophy Points:
    11
    Sain vihdoin (siis heti kun jaksoin katsoa netistä apua miten vikasietotila voidaan käynnistää muulla tavalla kuin F8- menetelmällä) tämän pokapoka62.exe :n pois ja samalla kaikki ongelmat katos. Kiitos HiJack login putsaamisen auttamisesta ja kaikesta muusta avusta!!!

    Niin ja se WhatPulse on ihan kunnon ohjelma oon käyttäny sitä jo erittäin kauan.
     
    Ricustin, Aug 8, 2005
    #12

Share This Page