HijackThis-logi

Discussion in 'Virukset ja haittaohjelmat' started by VK86, Oct 31, 2005.

  1. VK86

    VK86 Member

    Joined:
    Oct 31, 2005
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    11
    Tämmöstä työntää, apu olisi tervetullutta:

    Logfile of HijackThis v1.99.1
    Scan saved at 18:32:15, on 31.10.2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    D:\WINDOWS\System32\smss.exe
    D:\WINDOWS\system32\winlogon.exe
    D:\WINDOWS\system32\services.exe
    D:\WINDOWS\system32\lsass.exe
    D:\WINDOWS\System32\Ati2evxx.exe
    D:\WINDOWS\system32\svchost.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\system32\Ati2evxx.exe
    D:\WINDOWS\Explorer.EXE
    D:\WINDOWS\system32\spoolsv.exe
    D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    D:\Program Files\AVPersonal\AVGNT.EXE
    D:\Program Files\MessengerPlus! 3\MsgPlus.exe
    C:\Program Files\ASUS\Probe\AsusProb.exe
    D:\Program Files\Microsoft IntelliPoint\point32.exe
    D:\Program Files\Winamp\winampa.exe
    D:\Program Files\D-Tools\daemon.exe
    D:\Program Files\Common Files\Real\Update_OB\realsched.exe
    D:\WINDOWS\System32\rmctrl.exe
    D:\Program Files\iTunes\iTunesHelper.exe
    D:\Program Files\QuickTime\qttask.exe
    D:\Program Files\MSN Messenger\msnmsgr.exe
    D:\WINDOWS\Mixer.exe
    D:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
    D:\Program Files\AVPersonal\AVWUPSRV.EXE
    D:\Program Files\ewido\security suite\ewidoctrl.exe
    D:\Program Files\ewido\security suite\ewidoguard.exe
    D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\system32\wincntrl.exe
    D:\Program Files\iPod\bin\iPodService.exe
    D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    D:\WINDOWS\system32\cmd.exe
    D:\Program Files\DC++\DCPlusPlus.exe
    D:\Program Files\ACD Systems\ACDSee\ACDSee.exe
    D:\Program Files\Mozilla Firefox\firefox.exe
    D:\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [ATIPTA] "D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [AVGCtrl] "D:\Program Files\AVPersonal\AVGNT.EXE" /min
    O4 - HKLM\..\Run: [MessengerPlus3] "D:\Program Files\MessengerPlus! 3\MsgPlus.exe"
    O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
    O4 - HKLM\..\Run: [C-Media Mixer] D:\Program Files\PCI Audio Applications\Bin\AudioRack.exe /MixerStartup
    O4 - HKLM\..\Run: [IntelliPoint] "D:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [RemoteControl] D:\WINDOWS\System32\rmctrl.exe
    O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [System Service] servu.exe
    O4 - HKLM\..\RunServices: [System Service] servu.exe
    O4 - HKCU\..\Run: [MessengerPlus3] "D:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
    O4 - HKCU\..\Run: [SVCH Service] svch32.pif
    O4 - HKCU\..\Run: [HTML32 Help System] hhs32.pif
    O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\RunServices: [SVCH Service] svch32.pif
    O4 - HKCU\..\RunServices: [HTML32 Help System] hhs32.pif
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll
    O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - D:\Program Files\AVPersonal\AVWUPSRV.EXE
    O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - D:\Program Files\ewido\security suite\ewidoguard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: IpManager (IPtable) - Unknown owner - D:\WINDOWS\ipconfg32.exe (file missing)
    O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    O23 - Service: Msdebugsrv1 (Msdebugsrv) - Unknown owner - D:\WINDOWS\dbg32hlp.exe (file missing)
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    O23 - Service: MS Dns Service (WinNet) - Unknown owner - D:\WINDOWS\system32\wincntrl.exe
     
    VK86, Oct 31, 2005
    #1
  2. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Sammuta prosessi tehtävienhallinnasta (ctrl+alt+del -> lopeta prosessi):

    wincntrl.exe

    Siirrä HjT omaan hakemistoon, vaikka D:\hjt\Hijackthis.exe

    Fixaa HjT:llä (do a system scan only, merkkaa nämä ja paina fix checked):

    O4 - HKLM\..\Run: [System Service] servu.exe
    O4 - HKLM\..\RunServices: [System Service] servu.exe
    O4 - HKCU\..\Run: [SVCH Service] svch32.pif
    O4 - HKCU\..\Run: [HTML32 Help System] hhs32.pif
    O4 - HKCU\..\RunServices: [SVCH Service] svch32.pif
    O4 - HKCU\..\RunServices: [HTML32 Help System] hhs32.pif
    O23 - Service: IpManager (IPtable) - Unknown owner - D:\WINDOWS\ipconfg32.exe (file missing)
    O23 - Service: Msdebugsrv1 (Msdebugsrv) - Unknown owner - D:\WINDOWS\dbg32hlp.exe (file missing)
    O23 - Service: MS Dns Service (WinNet) - Unknown owner - D:\WINDOWS\system32\wincntrl.exe

    Sitten käynnistä -> suorita -> services.msc -> ok -> etsi listalta

    IpManager
    Msdebugsrv1
    MS Dns Service

    Tuplaklikkaa niitä, paina seis ja valitse käynnistymistavaksi "ei käytössä".

    Laita piilotiedostot näkyviin, ohje -> http://keskustelu.afterdawn.com/thread_view.cfm/248944

    Käynnistä vikasietotilaan (F8 käynnistyksen yhteydessä) ja poista:

    servu.exe
    svch32.pif
    hhs32.pif (näitä ei välttämättä ole, etsi Etsi-toiminnolla ja valitse myös Lisävaihtoehdot -> Etsi piilotiedostoista ja -kansioista)
    D:\WINDOWS\==>ipconfg32.exe<==
    D:\WINDOWS\==>dbg32hlp.exe<==(näitäkään ei välttämättä ole)
    D:\WINDOWS\system32\==>wincntrl.exe<==

    Käynnistä uudelleen ja lähetä uusi HjT-loki.


     
    -kemisti-, Oct 31, 2005
    #2
  3. VK86

    VK86 Member

    Joined:
    Oct 31, 2005
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    11
    Kiitoksia jo tähän väliin, ja tässäpä uusi loki:

    Logfile of HijackThis v1.99.1
    Scan saved at 20:41:32, on 31.10.2005
    Platform: Windows XP SP1 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

    Running processes:
    D:\WINDOWS\System32\smss.exe
    D:\WINDOWS\system32\winlogon.exe
    D:\WINDOWS\system32\services.exe
    D:\WINDOWS\system32\lsass.exe
    D:\WINDOWS\System32\Ati2evxx.exe
    D:\WINDOWS\system32\svchost.exe
    D:\WINDOWS\System32\svchost.exe
    D:\WINDOWS\system32\Ati2evxx.exe
    D:\WINDOWS\Explorer.EXE
    D:\WINDOWS\system32\spoolsv.exe
    D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    D:\Program Files\AVPersonal\AVGNT.EXE
    C:\Program Files\ASUS\Probe\AsusProb.exe
    D:\Program Files\Microsoft IntelliPoint\point32.exe
    D:\Program Files\Winamp\winampa.exe
    D:\Program Files\D-Tools\daemon.exe
    D:\Program Files\Common Files\Real\Update_OB\realsched.exe
    D:\WINDOWS\System32\rmctrl.exe
    D:\Program Files\iTunes\iTunesHelper.exe
    D:\Program Files\QuickTime\qttask.exe
    D:\WINDOWS\Mixer.exe
    D:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
    D:\Program Files\AVPersonal\AVWUPSRV.EXE
    D:\Program Files\ewido\security suite\ewidoctrl.exe
    D:\Program Files\ewido\security suite\ewidoguard.exe
    D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
    D:\WINDOWS\System32\svchost.exe
    D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe
    D:\Program Files\iPod\bin\iPodService.exe
    D:\WINDOWS\System32\wuauclt.exe
    D:\Hjt\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [ATIPTA] "D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [AVGCtrl] "D:\Program Files\AVPersonal\AVGNT.EXE" /min
    O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
    O4 - HKLM\..\Run: [C-Media Mixer] D:\Program Files\PCI Audio Applications\Bin\AudioRack.exe /MixerStartup
    O4 - HKLM\..\Run: [IntelliPoint] "D:\Program Files\Microsoft IntelliPoint\point32.exe"
    O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe
    O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033
    O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [RemoteControl] D:\WINDOWS\System32\rmctrl.exe
    O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll
    O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
    O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - D:\Program Files\AVPersonal\AVWUPSRV.EXE
    O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - D:\Program Files\ewido\security suite\ewidoguard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe
    O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

     
    VK86, Oct 31, 2005
    #3
  4. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Ole hyvä ja loki on kunnossa :)
     
    -kemisti-, Oct 31, 2005
    #4
  5. VK86

    VK86 Member

    Joined:
    Oct 31, 2005
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    11
    Kiittelen vielä kovasti, suuresti helpottunut olen nyt ma. Jee.
     
    VK86, Oct 31, 2005
    #5

Share This Page