Järjestelmänvalvoja on poistanut Tehtävienhallinan käytöstä???

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by Porshe, Dec 21, 2006.

Thread Status:
Not open for further replies.
  1. Porshe

    Porshe Regular member

    Joined:
    Dec 1, 2006
    Messages:
    1,111
    Likes Received:
    0
    Trophy Points:
    46
    Logfile of HijackThis v1.99.1
    Scan saved at 16:53:33, on 21.12.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    un:MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\cFosSpeed\spd.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\scvhost.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    D:\Miikka\DC-0.674\DCPlusPlus.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    D:\Miikka\Programs\HiJackThis\scanner.exe

    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/md5auth.srf?lc=1035
    F2 - REG:system.ini: Shell=Explorer.exe scvhost.exe
    F3 - REG:win.ini: run=C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\R [Windows Update] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\Run: [msconfig] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\Run: [icq lite] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\Run: [Update Checker] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\Run: [AntiVir] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\Run: [] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunServices: [Windows Update] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunServices: [msconfig] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunServices: [icq lite] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunServices: [Update Checker] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunServices: [AntiVir] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunServices: [] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunOnce: [Windows Update] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunOnce: [msconfig] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunOnce: [icq lite] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunOnce: [Update Checker] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunOnce: [AntiVir] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunOnce: [] C:\WINDOWS\scvhost.exe
    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe" -service (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

    Mun koneelle putkahti joku scvhost.exe niminen tiedosto kun starttasin yhtä filua.. se teki aika paljon paskamerkintöjä tonne hjt lokiin ja sieltä niitä jo fixasin nuo:

    O4 - HKLM\..\R [Windows Update] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\Run: [msconfig] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\Run: [icq lite] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\Run: [Update Checker] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\Run: [AntiVir] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\Run: [] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunServices: [Windows Update] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunServices: [msconfig] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunServices: [icq lite] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunServices: [Update Checker] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunServices: [AntiVir] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunServices: [] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunOnce: [Windows Update] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunOnce: [msconfig] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunOnce: [icq lite] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunOnce: [Update Checker] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunOnce: [AntiVir] C:\WINDOWS\scvhost.exe
    O4 - HKLM\..\RunOnce: [] C:\WINDOWS\scvhost.exe

    ja sitä filua itse ei löydy enää koneelta. Mutta varsinainen ongelma on että kun tuo ilmesty koneelle niin koitin ekaks mennä tehtävienhallintaan mutta.. Sain virheilmoituksen: Järjestelmänvalvoja on poistanut Tehtävienhallinan käytöstä... mitenhän sen mahtaa saada takasin?
    Se virus oli tommonen: W32/Agobot-S virus
    Ja tietoa siitä: http://www.liutilities.com/products/wintaskspro/processlibrary/scvhost/
     
    Porshe, Dec 21, 2006
    #1
  2. fixeri

    fixeri Regular member

    Joined:
    Oct 5, 2006
    Messages:
    381
    Likes Received:
    0
    Trophy Points:
    26
    Merkkaa ja paina Fix checked:

    F2 - REG:system.ini: Shell=Explorer.exe scvhost.exe
    F3 - REG:win.ini: run=C:\WINDOWS\scvhost.exe
    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

    Aja eScan: http://koti.mbnet.fi/pattaya1/escanmwav.htm

    Päivitä ihan ekaks, ohjeet on tuolla sivulla, päivitystapa 2.
    Aja sitten tuo eScan ja lähetä viruslog tänne jos jotain löytyy.

    Lähetä myös uusi HJT logi.
     
    fixeri, Dec 21, 2006
    #2
  3. Porshe

    Porshe Regular member

    Joined:
    Dec 1, 2006
    Messages:
    1,111
    Likes Received:
    0
    Trophy Points:
    46
    Logfile of HijackThis v1.99.1
    Scan saved at 18:56:35, on 21.12.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\cFosSpeed\spd.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\Teamspeak2_RC2\TeamSpeak.exe
    C:\Soldat131\Soldat.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    D:\Miikka\Programs\HiJackThis\scanner.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/md5auth.srf?lc=1035
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe" -service (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

    ja tossa loki siittä eScannista:
    File C:\WINDOWS\system32\Reboot.exe tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken.
    File C:\WINDOWS\system32\SmitfraudFix.zip tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken.
    File C:\Program Files\mIRC\mirc.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.62. No Action Taken.
    File C:\WINDOWS\system32\Reboot.exe tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken.
    File C:\WINDOWS\system32\SmitfraudFix.zip tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken.
    File D:\Miikka\Downloads uTorrent.lnk infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File D:\Miikka\Ohjelmat\uTorrent.lnk infected by "BkCln.Unknown" Virus. Action Taken: File Renamed.
    File D:\Miikka\Programs\mIRC-621\mirc621.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.621. No Action Taken.
    File D:\Miikka\Programs\SmitfraudFix\Reboot.exe tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken.
    File D:\Miikka\Programs\SmitfraudFix.zip tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken.
    File D:\System Volume Information\_restore{B0F0B188-90B4-4297-8CC4-F509B508B2B1}\RP408\A0210098.exe tagged as not-a-virus:RiskTool.Win32.Reboot.f. No Action Taken.
    File D:\System Volume Information\_restore{D90E9BEC-C692-4882-A7DB-23B07E3DF5D1}\RP446\A0330637.exe tagged as not-a-virus:Client-IRC.Win32.mIRC.603. No Action Taken.
     
    Porshe, Dec 21, 2006
    #3
  4. Hujo

    Hujo Guest

    AVG Anti-Spyware sulla koneella ja se vikasiedossa.
     
    Hujo, Dec 21, 2006
    #4
  5. Porshe

    Porshe Regular member

    Joined:
    Dec 1, 2006
    Messages:
    1,111
    Likes Received:
    0
    Trophy Points:
    46
    Siis ajanko mä sen AVG anti-spywaren vikasietotilassa sen skannauksen koko koneen läpi?
     
    Porshe, Dec 22, 2006
    #5
  6. Porshe

    Porshe Regular member

    Joined:
    Dec 1, 2006
    Messages:
    1,111
    Likes Received:
    0
    Trophy Points:
    46
    Se löysi koneelta sillon kun tuo virus ilmesty niin tommosen windows kansiosta: C:\WINDOWS\shdef.exe Infected with: Rootkit.Nuclear ja se on nyt karantiinissa.
     
    Porshe, Dec 22, 2006
    #6
  7. fixeri

    fixeri Regular member

    Joined:
    Oct 5, 2006
    Messages:
    381
    Likes Received:
    0
    Trophy Points:
    26
    Joo kyllä, valitse vaan vaihtoehto "Complete system scan", mut muista päivittää AVG ekana.
     
    fixeri, Dec 22, 2006
    #7
  8. Porshe

    Porshe Regular member

    Joined:
    Dec 1, 2006
    Messages:
    1,111
    Likes Received:
    0
    Trophy Points:
    46
    ---------------------------------------------------------
    AVG Anti-Spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 15:06:38 22.12.2006

    + Scan result:



    C:\WINDOWS\system32\drivers\etc\hosts -> Trojan.Qhosts : Cleaned with backup (quarantined).


    ::Report end
     
    Porshe, Dec 22, 2006
    #8
  9. Hujo

    Hujo Guest

    uusi hjt loki scannaten
     
    Hujo, Dec 22, 2006
    #9
  10. Porshe

    Porshe Regular member

    Joined:
    Dec 1, 2006
    Messages:
    1,111
    Likes Received:
    0
    Trophy Points:
    46
    Logfile of HijackThis v1.99.1
    Scan saved at 15:15:38, on 24.12.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\cFosSpeed\spd.exe
    C:\Program Files\Sygate\SPF\smc.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\uTorrent\utorrent.exe
    D:\Miikka\Programs\HiJackThis\scanner.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/md5auth.srf?lc=1035
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\npjpi150_06.dll
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe" -service (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

    Se tehtävienhallinta tars kans saada takasin.
     
    Porshe, Dec 24, 2006
    #10
  11. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    -kemisti-, Dec 24, 2006
    #11
  12. Porshe

    Porshe Regular member

    Joined:
    Dec 1, 2006
    Messages:
    1,111
    Likes Received:
    0
    Trophy Points:
    46
    Kiitoksia paljon avusta. Vielä sellainen ongelma että antivirin kuvake ei näy tuolla oikeassa alareunassa ja olisi mukavampi jos tietäisi sen olevan päällä ettei aina tarvitse varmistaa sitä kun se on nyt kerran ollut pois päältä.
     
    Porshe, Dec 24, 2006
    #12
  13. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Tehtävienhallinnan kautta sen näkee (avguard.exe + avgnt.exe päällä). Voit kokeilla myös AntiVirin uudelleenasennusta.

    Lisäksi pitäisi vaihtaa kaikki salasanat koska tuo scvhost.exe on keylogger.
     
    -kemisti-, Dec 24, 2006
    #13
  14. Porshe

    Porshe Regular member

    Joined:
    Dec 1, 2006
    Messages:
    1,111
    Likes Received:
    0
    Trophy Points:
    46
    Ei mun tarvi sit vaihtaa todennäkösesti ne salasanat mitä mä käytin kun eihän tuo loggaa muutakuin ne mitä mä tänne näppäilen sinä aikana kun se oli yhdistynyt nettiin? Ja eihän se saa tallennettuja? Ja mä huomasin sen kyl heti ku se tuli tähän koneelle ja blockkasin sen sygatesta.. se tuli tune up 2007 keygenistä. Mul ei oo kamalasti huonoja kokemuksia noista keygeneistä niin en tajunnu sit katsoa tätä niin tarkkaan.. tää oli 7 megan kokonen ja siinä oli ihmeellinen kuvakekkin vielä.. mut tosiaan kyl tarkastin tehtävienhallinasta että tuliko sinne mitään ylimäärästä ja huomasin ton sieltä heti niin blokkasin sen.
     
    Porshe, Dec 24, 2006
    #14
  15. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Ei pitäisi saada tallennettuja salasanoja haltuunsa, mutta jos haluat olla täysin varma niin vaihda kaikki.
     
    -kemisti-, Dec 24, 2006
    #15
  16. Porshe

    Porshe Regular member

    Joined:
    Dec 1, 2006
    Messages:
    1,111
    Likes Received:
    0
    Trophy Points:
    46
    ok. kiitoksia asiantuntevasta avusta ja hyvät joulut sekä uudetvuodet ;)
     
    Porshe, Dec 24, 2006
    #16
  17. Porshe

    Porshe Regular member

    Joined:
    Dec 1, 2006
    Messages:
    1,111
    Likes Received:
    0
    Trophy Points:
    46
    Semmonen kysymys vielä että onko tuo AVG Anti-Malware niinkun AVG Anti-Spyware ja Anti-Virus samassa paketissa? Oon ajattelut vaihtaa tuon Antivirin siihen vaan.
     
    Porshe, Dec 24, 2006
    #17
  18. -kemisti-

    -kemisti- Active member

    Joined:
    Jun 6, 2005
    Messages:
    6,305
    Likes Received:
    0
    Trophy Points:
    96
    Kyllä on sama asia ja ole hyvä ja hyvät joulut :)
     
    -kemisti-, Dec 24, 2006
    #18
Thread Status:
Not open for further replies.

Share This Page