1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

HJT-login tarkistus, selvä Troijalainen, apua?

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Zostrodon, Apr 13, 2008.

Page 2 of 2
  1. Zostrodon

    Zostrodon Member

    Joined:
    Apr 13, 2008
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    11
    Ei muutosta.. Yhä valittaa viruksesta
     
    Zostrodon, Apr 20, 2008
    #21
  2. Hujo

    Hujo Guest

    Mitä ja missä se on mitä valittaa.
     
    Hujo, Apr 20, 2008
    #22
  3. Zostrodon

    Zostrodon Member

    Joined:
    Apr 13, 2008
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    11
    Noin aina kun yrittää käynnistää sitä eScania
     
    Zostrodon, Apr 20, 2008
    #23
  4. Zostrodon

    Zostrodon Member

    Joined:
    Apr 13, 2008
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    11
    Zostrodon, Apr 20, 2008
    #24
  5. Hujo

    Hujo Guest

    avautuko se escan

    jos avautu niin laita täpit ohjeen mukaan ja scannaa

    laita siintä alaluukusta se virusraportti tänne.
     
    Last edited by a moderator: Apr 20, 2008
    Hujo, Apr 20, 2008
    #25
  6. Zostrodon

    Zostrodon Member

    Joined:
    Apr 13, 2008
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    11
    Ei, tuommoinen virheilmoitus tulee aina.
     
    Zostrodon, Apr 20, 2008
    #26
  7. Hujo

    Hujo Guest

    ookos tehnyt ton kilbox homman
    mitä se siinä sanoo
     
    Hujo, Apr 20, 2008
    #27
  8. Zostrodon

    Zostrodon Member

    Joined:
    Apr 13, 2008
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    11
    Zostrodon, Apr 20, 2008
    #28
  9. Hujo

    Hujo Guest

    scannaa hjt:n loki
     
    Hujo, Apr 20, 2008
    #29
  10. Zostrodon

    Zostrodon Member

    Joined:
    Apr 13, 2008
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    11
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 17:29:00, on 20.4.2008
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
    Boot mode: Normal

    Running processes:
    G:\WINDOWS\System32\smss.exe
    G:\WINDOWS\system32\winlogon.exe
    G:\WINDOWS\system32\services.exe
    G:\WINDOWS\system32\lsass.exe
    G:\WINDOWS\system32\svchost.exe
    G:\WINDOWS\System32\svchost.exe
    E:\Hyötyohjelmat\Ad-Aware\aawservice.exe
    G:\WINDOWS\Explorer.EXE
    G:\Program Files\Winamp\winampa.exe
    G:\WINDOWS\system32\spoolsv.exe
    G:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    G:\WINDOWS\System32\svchost.exe
    G:\Program Files\Mozilla Firefox\firefox.exe
    G:\WINDOWS\system32\rundll32.exe
    E:\Hyötyohjelmat\Asennusohjelmat\HiJackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - G:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [NeroCheck] G:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [WinampAgent] "G:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [avgnt] "E:\Hyötyohjelmat\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [WinDLL (wingatey32.exe)] rundll32.exe G:\WINDOWS\System32\wingatey32.exe,start
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [MsnMsgr] "G:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User '?')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User '?')
    O4 - HKUS\S-1-5-21-1343024091-1580436667-1060284298-1003\..\Run: [MsnMsgr] "G:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (User '?')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User '?')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Microsoft Office.lnk = G:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://G:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - E:\Hyötyohjelmat\Ad-Aware\aawservice.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\HYTYOH~1\AVG\avgamsvr.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Unknown owner - G:\Program Files\Symantec AntiVirus\DefWatch.exe (file missing)
    O23 - Service: SAVRoam (SavRoam) - Unknown owner - G:\Program Files\Symantec AntiVirus\SavRoam.exe (file missing)
    O23 - Service: Sygate Personal Firewall Pro (SmcService) - Unknown owner - G:\Program Files\Sygate\SPF\smc.exe (file missing)
    O23 - Service: Symantec AntiVirus - Unknown owner - G:\Program Files\Symantec AntiVirus\Rtvscan.exe (file missing)

    --
    End of file - 3226 bytes
     
    Zostrodon, Apr 20, 2008
    #30
  11. Hujo

    Hujo Guest

    sfcannaa hjt:llä merkkaa paina Fix checked

    O4 - HKLM\..\Run: [WinDLL (wingatey32.exe)] rundll32.exe G:\WINDOWS\System32\wingatey32.exe,start
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

    =====================

    Kopioi / liitä seuraava teksti alapuolella tyhjään muistioFiluun
    Varmista että tiedoston tyyppi on ”all Files” ja tallenna se Poisto.bat. nimisenä
    työpöydällesi.

    @echo off
    sc stop DefWatch
    sc delete DefWatch
    sc stop SavRoam
    sc delete SavRoam
    sc stop ”Symantec AntiVirus”
    sc delete ”Symantec AntiVirus”

    Tupla-klikkaa Poisto.bat. filua työpöydälläsi , ikkuna avautuu ja Sulkeutuu tämä on normaalia.
     
    Hujo, Apr 20, 2008
    #31
  12. Zostrodon

    Zostrodon Member

    Joined:
    Apr 13, 2008
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    11
    Tehty. Entäs sitten?
     
    Zostrodon, Apr 20, 2008
    #32
  13. Hujo

    Hujo Guest

    scannaa uusi hjt:n loki
     
    Hujo, Apr 20, 2008
    #33
  14. Zostrodon

    Zostrodon Member

    Joined:
    Apr 13, 2008
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    11
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:09:02, on 20.4.2008
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
    Boot mode: Normal

    Running processes:
    G:\WINDOWS\System32\smss.exe
    G:\WINDOWS\system32\winlogon.exe
    G:\WINDOWS\system32\services.exe
    G:\WINDOWS\system32\lsass.exe
    G:\WINDOWS\system32\svchost.exe
    G:\WINDOWS\System32\svchost.exe
    E:\Hyötyohjelmat\Ad-Aware\aawservice.exe
    G:\WINDOWS\Explorer.EXE
    G:\Program Files\Winamp\winampa.exe
    G:\WINDOWS\system32\spoolsv.exe
    G:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    G:\WINDOWS\System32\svchost.exe
    G:\Program Files\Mozilla Firefox\firefox.exe
    G:\WINDOWS\system32\rundll32.exe
    E:\Hyötyohjelmat\Asennusohjelmat\HiJackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - G:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [NeroCheck] G:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [WinampAgent] "G:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [avgnt] "E:\Hyötyohjelmat\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKCU\..\Run: [MsnMsgr] "G:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User '?')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User '?')
    O4 - HKUS\S-1-5-21-1343024091-1580436667-1060284298-1003\..\Run: [MsnMsgr] "G:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (User '?')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User '?')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Microsoft Office.lnk = G:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://G:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - E:\Hyötyohjelmat\Ad-Aware\aawservice.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\HYTYOH~1\AVG\avgamsvr.exe
    O23 - Service: Sygate Personal Firewall Pro (SmcService) - Unknown owner - G:\Program Files\Sygate\SPF\smc.exe (file missing)
    O23 - Service: Symantec AntiVirus - Unknown owner - G:\Program Files\Symantec AntiVirus\Rtvscan.exe (file missing)

    --
    End of file - 2792 bytes
     
    Zostrodon, Apr 20, 2008
    #34
  15. Hujo

    Hujo Guest

    Poista tuo kansio

    G:\Program Files\Symantec AntiVirus

    ja uusiksi pistä nuo suorita luukuun yksi rivi lainaus merkkiwen kanssa ja täppää enter

    sc stop ”Symantec AntiVirus”
    sc delete ”Symantec AntiVirus”

    Oitä sitten uusi hjt:n loki

    muuten ei tuo avg myöskään ole kunnollinen

    Kohta pitää sanoo se yksi sana Formatoi
     
    Last edited by a moderator: Apr 20, 2008
    Hujo, Apr 20, 2008
    #35
  16. Zostrodon

    Zostrodon Member

    Joined:
    Apr 13, 2008
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    11
    Ei ole tuota kansiota olemassa.. Ja AVG ei ole kunnollinen sen virusjutun takia varmaankin. Mutta tässä loki:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:24:37, on 20.4.2008
    Platform: Windows XP (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)
    Boot mode: Normal

    Running processes:
    G:\WINDOWS\System32\smss.exe
    G:\WINDOWS\system32\winlogon.exe
    G:\WINDOWS\system32\services.exe
    G:\WINDOWS\system32\lsass.exe
    G:\WINDOWS\system32\svchost.exe
    G:\WINDOWS\System32\svchost.exe
    E:\Hyötyohjelmat\Ad-Aware\aawservice.exe
    G:\WINDOWS\Explorer.EXE
    G:\Program Files\Winamp\winampa.exe
    G:\WINDOWS\system32\spoolsv.exe
    G:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    G:\WINDOWS\System32\svchost.exe
    G:\Program Files\Mozilla Firefox\firefox.exe
    G:\WINDOWS\system32\rundll32.exe
    E:\Hyötyohjelmat\Asennusohjelmat\HiJackThis.exe
    G:\WINDOWS\system32\NOTEPAD.EXE

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - G:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [NeroCheck] G:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [WinampAgent] "G:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [avgnt] "E:\Hyötyohjelmat\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKCU\..\Run: [MsnMsgr] "G:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User '?')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User '?')
    O4 - HKUS\S-1-5-21-1343024091-1580436667-1060284298-1003\..\Run: [MsnMsgr] "G:\Program Files\MSN Messenger\MsnMsgr.Exe" /background (User '?')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User '?')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] G:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Microsoft Office.lnk = G:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Vie Microsoft E&xceliin - res://G:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - E:\Hyötyohjelmat\Ad-Aware\aawservice.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\HYTYOH~1\AVG\avgamsvr.exe
    O23 - Service: Sygate Personal Firewall Pro (SmcService) - Unknown owner - G:\Program Files\Sygate\SPF\smc.exe (file missing)

    --
    End of file - 2709 bytes
     
    Zostrodon, Apr 20, 2008
    #36
  17. Hujo

    Hujo Guest

    Viskaa toi avg myös pois ja lataa se uudelleen
    ja asenna heti koneelle.
     
    Hujo, Apr 20, 2008
    #37
  18. Zostrodon

    Zostrodon Member

    Joined:
    Apr 13, 2008
    Messages:
    21
    Likes Received:
    0
    Trophy Points:
    11
    Joop, eipä tunnu onnistuvan.. Taitaa olla formatoinnin aika. Tuhannet kiitokset periksiantamattomasta avusta. Teitä suosittelen kaikille tarvitseville.
     
    Zostrodon, Apr 20, 2008
    #38
  19. Hujo

    Hujo Guest

    Sitten kun formatoi niin laita het virustorjunta ja palomuuri ennen netiin menoa sitten laita koneelle sp2 myös
     
    Hujo, Apr 20, 2008
    #39
Page 2 of 2

Share This Page