Hjt - logi.

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by heikkipa, Aug 27, 2006.

Thread Status:
Not open for further replies.
  1. heikkipa

    heikkipa Member

    Joined:
    Aug 18, 2005
    Messages:
    54
    Likes Received:
    0
    Trophy Points:
    16
    a2 löysi jotain koneelta. Tässä sen logi ja hjt-logi myös. Onko hjt-logi nyt OK?

    a-squared Free - Version 2.0

    Scan settings:

    Objects: Memory, Traces, Cookies
    Scan archives: On
    Heuristics: On
    ADS Scan: On

    Scan start: 27.8.2006 23:48:01

    Value: HKEY_CLASSES_ROOT\CLSID\{1BE669B7-D464-438A-94A7-7FDA6C47BA47}\InprocServer32 --> ThreadingModel detected: Trace.Registry.ESP+
    Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BE669B7-D464-438A-94A7-7FDA6C47BA47}\InprocServer32 --> ThreadingModel detected: Trace.Registry.ESP+
    Value: HKEY_CLASSES_ROOT\CLSID\{1BE669B7-D464-438A-94A7-7FDA6C47BA47}\InprocServer32 --> ThreadingModel detected: Trace.Registry.FindNot GuardDog
    Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BE669B7-D464-438A-94A7-7FDA6C47BA47}\InprocServer32 --> ThreadingModel detected: Trace.Registry.FindNot GuardDog
    C:\WINDOWS\system32\memman.vxd detected: Trace.File.Computer Monitor Keylogger

    Scanned

    Files: 1495
    Traces: 67487
    Cookies: 7
    Processes: 40

    Found

    Files: 0
    Traces: 5
    Cookies: 0
    Processes: 0
    Registry keys: 0

    Scan end: 27.8.2006 23:52:27
    Scan time: 0:04:26

    C:\WINDOWS\system32\memman.vxd Deleted Trace.File.Computer Monitor Keylogger
    Value: HKEY_CLASSES_ROOT\CLSID\{1BE669B7-D464-438A-94A7-7FDA6C47BA47}\InprocServer32 --> ThreadingModel Deleted Trace.Registry.FindNot GuardDog
    Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BE669B7-D464-438A-94A7-7FDA6C47BA47}\InprocServer32 --> ThreadingModel Deleted Trace.Registry.FindNot GuardDog
    Value: HKEY_CLASSES_ROOT\CLSID\{1BE669B7-D464-438A-94A7-7FDA6C47BA47}\InprocServer32 --> ThreadingModel Deleted Trace.Registry.ESP+
    Value: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1BE669B7-D464-438A-94A7-7FDA6C47BA47}\InprocServer32 --> ThreadingModel Deleted Trace.Registry.ESP+

    Deleted

    Files: 0
    Traces: 5
    Cookies: 0


    Logfile of HijackThis v1.99.1
    Scan saved at 0:14:28, on 28.8.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\NORMAN\Npf\BIN\NPFSVICE.EXE
    C:\NORMAN\bin\ZANDA.EXE
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\NORMAN\bin\ZLH.EXE
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\MSN Messenger\msnmsgr.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
    C:\NORMAN\Nvc\BIN\NIP.EXE
    C:\NORMAN\Npf\BIN\npfmsg2.exe
    C:\NORMAN\Nvc\bin\nvcoas.exe
    C:\NORMAN\bin\NJEEVES.EXE
    C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    C:\NORMAN\Nvc\BIN\nipsvc.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\System32\alg.exe
    C:\NORMAN\Nvc\bin\cclaw.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Hijack\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24.fi/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.suomi24.fi/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.dial.inet.fi:800
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://chatserver.suomi24.fi:8080;http://chatserver2.suomi24.fi:8080 ;<local>
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\SiteAdv.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\SiteAdv.dll
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [Norman ZANDA] C:\NORMAN\bin\ZLH.EXE /LOAD /SPLASH
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    O4 - Global Startup: hp psc 1000 series.lnk = ?
    O4 - Global Startup: hpoddt01.exe.lnk = ?
    O8 - Extra context menu item: &Google-haku - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Käännä englanninkielinen sana - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\TB\02.05.0000.1105\fi-fi\msntb.dll/search.htm
    O8 - Extra context menu item: Avaa uuteen etuvälilehteen - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fi-fi\msntabres.dll/230?f50ccb43ed5c4e90aa42b88dd711aab
    O8 - Extra context menu item: Avaa uuteen taustavälilehteen - res://C:\Program Files\MSN Toolbar Suite\TAB\02.05.0000.1105\fi-fi\msntabres.dll/229?f50ccb43ed5c4e90aa42b88dd711aab
    O8 - Extra context menu item: Linkit taaksepäin - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Samankaltaisia sivuja - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Välimuistissa oleva kuvakaappaus sivusta - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/SSC/SharedContent/vc/bin/AvSniff.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123151511218
    O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1127924658500
    O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
    O16 - DPF: {8EB3FF4E-86A1-4717-884D-7BA2D38272CB} (F-Secure Online Scanner) - http://support.f-secure.com/ols/fscax.cab
    O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://koti.sonkajarvi.net/activex/AxisCamControl.cab
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
    O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\NORMAN\Nvc\BIN\nipsvc.exe
    O23 - Service: Norman NJeeves - Unknown owner - C:\NORMAN\bin\NJEEVES.EXE
    O23 - Service: Norman Type-R - Unknown owner - C:\NORMAN\Npf\BIN\NPFSVICE.EXE
    O23 - Service: Norman ZANDA - Unknown owner - C:\NORMAN\bin\ZANDA.EXE
    O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\NORMAN\Nvc\bin\nvcoas.exe
    O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE
    O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
     
    heikkipa, Aug 27, 2006
    #1
  2. Jurppis

    Jurppis Regular member

    Joined:
    Feb 22, 2006
    Messages:
    659
    Likes Received:
    0
    Trophy Points:
    26
    Puhtaalta näyttää
     
    Last edited: Aug 28, 2006
    Jurppis, Aug 28, 2006
    #2
  3. heikkipa

    heikkipa Member

    Joined:
    Aug 18, 2005
    Messages:
    54
    Likes Received:
    0
    Trophy Points:
    16
    Asia selvä. Kiitos tarkistuksesta.
     
    heikkipa, Aug 30, 2006
    #3
Thread Status:
Not open for further replies.

Share This Page