HijackThis logi backdoor poebot.b

Discussion in 'Virukset ja haittaohjelmat' started by Sean_, Apr 28, 2005.

Page 1 of 3
  1. Sean_

    Sean_ Member

    Joined:
    Apr 28, 2005
    Messages:
    76
    Likes Received:
    0
    Trophy Points:
    16
    Eli tarvis saada tollanen Backdoor ohjelma pois koneelta. F-Secure vähän väliä ilmoittaa tuosta viruksesta.
    [bold]Windows/system32/explorer.exe backdoor.win32.poebot.b[/bold] tollasta se F-Secure herjaa, mutta ilmoittaa, että ei voi puhdistaa sitä. Netistä löyty tällästä tietoa:

    W32/Poebot-B is an IRC backdoor worm.

    W32/Poebot-B attempts to contact an IRC server and runs in the background waiting for backdoor commands. The worm may as a result spread to network shares with weak passwords, or via IRC.

    The worm has other backdoor functionality which may include stealing passwords for the FlashFXP FTP client.

    Logi -->
     
    Last edited: Apr 28, 2005
    Sean_, Apr 28, 2005
    #1
  2. Sean_

    Sean_ Member

    Joined:
    Apr 28, 2005
    Messages:
    76
    Likes Received:
    0
    Trophy Points:
    16
    Ja tässä on logi:

    Logfile of HijackThis v1.99.1
    Scan saved at 18:01:34, on 28.4.2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\alg.exe
    C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
    C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
    C:\Program Files\Sonera Tietoturva\Anti-Virus\FSGK32.EXE
    C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
    C:\Program Files\Sonera Tietoturva\Anti-Virus\fssm32.exe
    C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
    C:\Program Files\Sonera Tietoturva\Common\FSMB32.EXE
    C:\Program Files\Sonera Tietoturva\Common\FCH32.EXE
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Sonera Tietoturva\Common\FAMEH32.EXE
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
    C:\Program Files\Sonera Tietoturva\backweb\4436233\Program\fspex.exe
    C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
    C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
    C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
    C:\Program Files\Sonera Tietoturva\Anti-Virus\fsav32.exe
    C:\WINDOWS\System32\PROMon.exe
    C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
    C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
    C:\WINDOWS\System32\NMSSvc.exe
    C:\Compaq\EAKDRV\EAUSBKBD.EXE
    C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
    C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
    C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
    C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE
    C:\Program Files\Sonera Tietoturva\FSGUI\fsguiexe.exe
    C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
    C:\Program Files\Mozilla Thunderbird\thunderbird.exe
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\HJT\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://haku.soneraplaza.fi/haku/queryie5.jsp
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://haku.soneraplaza.fi/haku/queryie5.jsp
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Internet
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.fi;*.*.fi;*.*.*.fi;<local>
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll (file missing)
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll (file missing)
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
    O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
    O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
    O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
    O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe
    O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
    O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
    O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
    O4 - HKLM\..\Run: [Windows Explorer] C:\WINDOWS\System32\explorer.exe
    O4 - HKLM\..\Run: [Windows Network Firewall] C:\WINDOWS\System32\firewall.exe
    O4 - HKLM\..\Run: [Services] C:\WINDOWS\System32\xxlfdeg.exe
    O4 - HKLM\..\Run: [Windows_Protect] winsystem.exe
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Sonera Tietoturva\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Sonera Tietoturva\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [News Service] "C:\Program Files\Sonera Tietoturva\FSGUI\ispnews.exe"
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\RunServices: [Windows_Protect] winsystem.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Windows_Protect] winsystem.exe
    O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
    O4 - HKCU\..\Run: [Spyware Doctor] "C:\Program Files\Spyware Doctor\swdoctor.exe" /Q
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Microsoft Works Kalenterin muistutukset.lnk = ?
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
    O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.com/scan8/oscan8.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.c...ls/en/x86/client/wuweb_site.cab?1114428693670
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
    O23 - Service: Sonera Tietoturva (BackWeb Plug-in - 4436233) - Unknown owner - C:\PROGRA~1\SONERA~1\backweb\4436233\Program\SERVIC~1.EXE
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\Anti-Virus\fsgk32st.exe
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Sonera Tietoturva\backweb\4436233\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Sonera Tietoturva\Common\FSMA32.EXE
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
     
    Sean_, Apr 28, 2005
    #2
  3. Toymaatti

    Toymaatti Active member

    Joined:
    Feb 4, 2005
    Messages:
    1,038
    Likes Received:
    0
    Trophy Points:
    66
    No morjens Sean_! Onko muuten sukunimi Connery? :)

    Onhan tuolla vähän jokasorttia, virus, mato, troijalainen ;)

    Hae RecSeeker(Huom. Osaa Suomea, vasemmalla ylhäällä > Language)
    http://www.hoverdesk.net/freeware.htm

    Laita piilotiedostot näkyviin
    http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/2002092715262339

    Aja HjT, laita merkki noiden eteen, sulje selain ja muut ohjelmat, klikkaa Fix.
    O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll (file missing)
    O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll (file missing)
    O4 - HKLM\..\Run: [Windows Explorer] C:\WINDOWS\System32\explorer.exe
    O4 - HKLM\..\Run: [Windows Network Firewall] C:\WINDOWS\System32\firewall.exe
    O4 - HKLM\..\Run: [Services] C:\WINDOWS\System32\xxlfdeg.exe
    O4 - HKLM\..\Run: [Windows_Protect] winsystem.exe
    O4 - HKLM\..\RunServices: [Windows_Protect] winsystem.exe
    O4 - HKCU\..\Run: [Windows_Protect] winsystem.exe

    Käynnistä vikasietotilaan ja poista nuo
    C:\WINDOWS\System32\===>explorer.exe<===HUOM!!!Vain ja ainoastaan tuolta!
    C:\WINDOWS\System32\===>firewall.exe<===
    C:\WINDOWS\System32\===>xxlfdeg.exe<===

    Käynnistä normaalisti

    Putsaa RecSeekerillä, poista kaikki löydöt(tekee varmuuskopion oletuksena)

    Käytä ja kokeile... miltäs tuntuu??



     
    Toymaatti, Apr 28, 2005
    #3
  4. Sean_

    Sean_ Member

    Joined:
    Apr 28, 2005
    Messages:
    76
    Likes Received:
    0
    Trophy Points:
    16
    No iltaa vaan sinnekin päin. Connery on siis sedän nimi ;)

    Isi, isi, se toimii. Hei, kiitos sinulle. Mä olen jo monta päivää leikkiny ton kanssa ja vetäny ties kuinka monta virusohjelmaa, online skanneria ym... koneen läpi ja sit se käy noin helposti ;o)

    En muuten löytäny vikasietotilassa tuota xxlfdeg.exe ollenkaan joten sitä en voinut poistaa. RegSeekerilla löyty muutaman vajaa 500 osumaa =)
     
    Last edited: Apr 28, 2005
    Sean_, Apr 28, 2005
    #4
  5. Toymaatti

    Toymaatti Active member

    Joined:
    Feb 4, 2005
    Messages:
    1,038
    Likes Received:
    0
    Trophy Points:
    66
    Jess!! Helposti ja helposti...pääasia että toimii ;)
    Kummalla nyt sitten putsasitkaan, RecSEEKERILLÄ tai RecCLEANERILLA niin ei tuo 500 ole ollenkaan huono tulos:)

    PS.Kerro sedälle terkkuja :D
     
    Toymaatti, Apr 28, 2005
    #5
  6. Sean_

    Sean_ Member

    Joined:
    Apr 28, 2005
    Messages:
    76
    Likes Received:
    0
    Trophy Points:
    16
    Eli kuten ehdin jo muokkaamaan tuota edellistä viestiäni, niin, tuolla mainitsemallasi RegSeekerillä. Kyllähän tuo nyt ainakin omasta mielestäni kävi suht helposti :p Eikä virustarkistuksessa löytyny tuota poebot.b backdoor enää.

    Täytyy sanoa moro sun puolesta kun seuraavan kerran käyn skotlannissa tai iso S tulee Rixu Cityyn =D
     
    Sean_, Apr 28, 2005
    #6
  7. Toymaatti

    Toymaatti Active member

    Joined:
    Feb 4, 2005
    Messages:
    1,038
    Likes Received:
    0
    Trophy Points:
    66
    :)))
     
    Toymaatti, Apr 28, 2005
    #7
  8. Sean_

    Sean_ Member

    Joined:
    Apr 28, 2005
    Messages:
    76
    Likes Received:
    0
    Trophy Points:
    16
    C:\System Volume Information\_restore{902C8A14-3E6B-4B0A-9426-1861C61B6C54}\RP45\A0013119.exe Virustartunta: Backdoor.Win32.PoeBot.b
    Toiminto: Nimetty uudelleen.

    Jes.... Eli toi v*tun virus on tullu takasin, mutta eri paikkaan. TOYMAATTI, plz help me :,/
     
    Sean_, Apr 29, 2005
    #8
  9. Toymaatti

    Toymaatti Active member

    Joined:
    Feb 4, 2005
    Messages:
    1,038
    Likes Received:
    0
    Trophy Points:
    66
    Toymaatti, Apr 29, 2005
    #9
  10. Sean_

    Sean_ Member

    Joined:
    Apr 28, 2005
    Messages:
    76
    Likes Received:
    0
    Trophy Points:
    16
    Yeah, Kiitos taas. Ny ei oo enään yhtään virusta koneella...ainakaan F-Securen, Ad-Awaren ym ohjelmien mukaan =)

    Niin, mähän en tiedä, että kuinka helposti löydät nuo virheet tuosta, itse en ainakaan ymmärrä juuri mitään logista. Itse pääsin kuitenkin suht helpolla.
     
    Sean_, May 1, 2005
    #10
  11. Toymaatti

    Toymaatti Active member

    Joined:
    Feb 4, 2005
    Messages:
    1,038
    Likes Received:
    0
    Trophy Points:
    66
    Pääsit asian ytimeen :)

    Niimpä :)

    Mutta kuten joku viisas on kirjoittanut ;)
    -=Reilu peli on perseestä=-
     
    Toymaatti, May 1, 2005
    #11
  12. Sean_

    Sean_ Member

    Joined:
    Apr 28, 2005
    Messages:
    76
    Likes Received:
    0
    Trophy Points:
    16
    =D
     
    Sean_, May 2, 2005
    #12
  13. olpp

    olpp Member

    Joined:
    May 18, 2005
    Messages:
    35
    Likes Received:
    0
    Trophy Points:
    16
    Mulla kummittelee sama matonen. HjT:n loki:

    Logfile of HijackThis v1.99.1
    Scan saved at 17:03:13, on 18.5.2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\WINDOWS\System32\atievxx.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\wpabaln.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe


    Osaako joku auttaa mitä pitäisi tehdä?
     
    olpp, May 18, 2005
    #13
  14. Toymaatti

    Toymaatti Active member

    Joined:
    Feb 4, 2005
    Messages:
    1,038
    Likes Received:
    0
    Trophy Points:
    66
    Ei tuolla mitään näy, mutta ompa lyhyt loki?? Sammuta ja käynnistä kone, scannaa HjT:llä uudestaan ja laita uusi loki.
     
    Toymaatti, May 18, 2005
    #14
  15. olpp

    olpp Member

    Joined:
    May 18, 2005
    Messages:
    35
    Likes Received:
    0
    Trophy Points:
    16
    Juu se lyhyys johtuu varmaan siitä, että windows on juuri asennettu, eikä ole hirveästi mitän lisäohjelmia.
    Tässä loki uudestaan:

    Logfile of HijackThis v1.99.1
    Scan saved at 19:20:36, on 18.5.2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\System32\ctfmon.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\WINDOWS\System32\atievxx.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    C:\Documents and Settings\Kari Haavisto\Työpöytä\Ollin omat\hijackthis\HijackThis.exe
    C:\WINDOWS\System32\wuauclt.exe
    C:\Program Files\Alwil Software\Avast4\setup\avast.setup

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe

     
    olpp, May 18, 2005
    #15
  16. V-kos

    V-kos Regular member

    Joined:
    Mar 13, 2005
    Messages:
    1,345
    Likes Received:
    0
    Trophy Points:
    46
    Tuo on lyhin logi ikinä. Oikeen kiva lukea kun ei tarvi skrollata ollenkaan. Kannattais päivittää xp -> sp2 niin ois madon reikiä vähemmän.

    Noin lyhyen login Toymaatti lukee varmaan pelkällä sivusilmällä tutkiessan noita perinteisiä metrin pituisia logeja. :D
     
    Last edited: May 18, 2005
    V-kos, May 18, 2005
    #16
  17. Toymaatti

    Toymaatti Active member

    Joined:
    Feb 4, 2005
    Messages:
    1,038
    Likes Received:
    0
    Trophy Points:
    66
    No eipä se siitään somene, puhas tuo on. Avastiko siitä örkistä huutelee, voi olla vaikka Avastin näköharha. Putsaa vielä eScanilla(lue ohjeet ja päivitä ensin), jos sekään ei mitään löydä niin tuskin siellä mitään onkaan, jos jotain löytyy niin laita alalaatikon löydöslista tänne. Se SP2 kannattaa hakea kun tiedetään että kone on puhdas.

    http://koti.mbnet.fi/pattaya1/escanmwav.htm
     
    Toymaatti, May 18, 2005
    #17
  18. jussi_vaa

    jussi_vaa Guest

    nii et mul on tällänen logi...C:\PROGRA~1\MOZILL~1\firefox.exe
    C:\DOCUME~1\Jussi\LOCALS~1\Temp\Tilapäinen kansio 2 HijackThis.zip\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.fi.soneraplaza.net/cgi/sonera-ie5
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.soneraplaza.fi
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.soneraplaza.fi
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.fi.soneraplaza.net/cgi/sonera-ie5
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.soneraplaza.fi
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - toimittaja Sonera Plaza Oy
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;localhost;<local>
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: (no name) - {DB4CA3DA-A8B2-4BEE-BAD4-0B002E12F30E} - (no file)
    O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll
    O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
    O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
    O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\fi\msntb.dll
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\1Kamat\D-Tools 3.44\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
    O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
    O4 - HKLM\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Steam] C:\1Kamat\pelit\steam_cs\Steam.exe -silent
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://www.soneraplaza.fi
    O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
    O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
    O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
    O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
    O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab31267.cab
    O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab31267.cab
    O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

     
    jussi_vaa, May 18, 2005
    #18
  19. olpp

    olpp Member

    Joined:
    May 18, 2005
    Messages:
    35
    Likes Received:
    0
    Trophy Points:
    16
    Jepjep, löytyihän sieltä kaikenlaista kivaa. Onko nuo nyt sitten tuon login mukaan puhdistettu?

    File C:\WINDOWS\System32\kqkgcb.exe infected by "Backdoor.Win32.PoeBot.b" Virus. Action Taken: File Renamed.
    File C:\WINDOWS\System32\logon.exe infected by "Backdoor.Win32.PoeBot.b" Virus. Action Taken: File Renamed.
    File C:\WINDOWS\System32\quhmlz.exe infected by "Backdoor.Win32.PoeBot.b" Virus. Action Taken: File Renamed.
    File C:\WINDOWS\System32\vscn.exe infected by "Backdoor.Win32.PoeBot.b" Virus. Action Taken: File Renamed.
    File C:\pavfn\PAVCL.EXE infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File C:\Program Files\Iomega\System32\Win2kDrivers.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
    File C:\System Volume Information\_restore{729CC12E-5E08-4D9E-A99A-C5B71538F2AB}\RP1\A0000002.exe infected by "Backdoor.Win32.PoeBot.b" Virus. Action Taken: File Renamed.
    File C:\System Volume Information\_restore{729CC12E-5E08-4D9E-A99A-C5B71538F2AB}\RP1\A0000003.exe infected by "Backdoor.Win32.PoeBot.b" Virus. Action Taken: File Renamed.
    File C:\System Volume Information\_restore{729CC12E-5E08-4D9E-A99A-C5B71538F2AB}\RP1\A0000004.exe infected by "Backdoor.Win32.PoeBot.b" Virus. Action Taken: File Renamed.
    File C:\System Volume Information\_restore{729CC12E-5E08-4D9E-A99A-C5B71538F2AB}\RP1\A0000005.exe infected by "Backdoor.Win32.PoeBot.b" Virus. Action Taken: File Renamed.
    File C:\System Volume Information\_restore{729CC12E-5E08-4D9E-A99A-C5B71538F2AB}\RP1\A0000006.EXE infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
     
    olpp, May 18, 2005
    #19
  20. Toymaatti

    Toymaatti Active member

    Joined:
    Feb 4, 2005
    Messages:
    1,038
    Likes Received:
    0
    Trophy Points:
    66
    Hyvä!! Backdoor.Win32.PoeBot.b löytyi ja on uudelleen nimetty = vaaraton ja sama homma vielä järjestelmänpalautus tiedostoissa, Jeess!
    Eli olihan siellä örkki piilossa, mutta niinvaan tuli noutaja sillekkin ;)

    Tuolle eScan ei tehnyt mitään ja se onkin OK
    File C:\Program Files\Iomega\System32\Win2kDrivers.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

    Nyt vaan SP2 hakemaan :D
     
    Toymaatti, May 18, 2005
    #20
Page 1 of 3

Share This Page