joku hämminki, saisiko apuja

Discussion in 'Virukset ja haittaohjelmat - HijackThis -logit' started by tti82, Apr 9, 2015.

  1. tti82

    tti82 Member

    Joined:
    Nov 8, 2007
    Messages:
    12
    Likes Received:
    0
    Trophy Points:
    11
    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 17:51:00, on 9.4.2015
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    c:\PROGRA~1\AVG\AVG2014\avgrsx.exe
    C:\Program Files\AVG\AVG2014\avgcsrvx.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
    C:\Program Files\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe
    C:\Program Files\ASUS\Turbo Key\TurboKey.exe
    C:\Program Files\ASUS\TurboV\TurboV.exe
    C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\DivX\DivX Update\DivXUpdate.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\AMD\RAIDXpert\bin\RAIDXpertService.exe
    C:\Program Files\AMD\RAIDXpert\bin\RAIDXpert.exe
    C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
    C:\Program Files\AVG\AVG2014\avgidsagent.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe
    C:\Program Files\AVG\AVG2014\avgwdsvc.exe
    C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\AVG\AVG2014\avgui.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\Program Files\CCleaner\CCleaner.exe
    C:\Documents and Settings\Heimo\Application Data\BitTorrent\BitTorrent.exe
    C:\ASUS.SYS\config\DVMExportService.exe
    C:\Program Files\Java\jre7\bin\jqs.exe
    C:\Program Files\Adobe\Reader 11.0\Reader\Reader_sl.exe
    C:\Program Files\Nero\Update\NASvc.exe
    C:\Program Files\CDBurnerXP\NMSAccessU.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.1.7\ToolbarUpdater.exe
    C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.1.7\loggingserver.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\AVG\AVG2014\avgnsx.exe
    C:\Program Files\AVG\AVG2014\avgemcx.exe
    C:\WINDOWS\System32\wbem\unsecapp.exe
    C:\WINDOWS\System32\wbem\wmiapsrv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.splashtop.com/asusexp...NT%3A0000FF%3BGIMP%3A0000FF%3BFORID%3A1&hl=fi
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    R3 - URLSearchHook: (no name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)
    R3 - URLSearchHook: SearchHook Class - {BC86E1AB-EDA5-4059-938F-CE307B0C6F0A} - C:\Program Files\DeviceVM\Browser Configuration Utility\AddressBarSearch.dll
    O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
    O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
    O2 - BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
    O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\18.1.7.644\AVG Secure Search_toolbar.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
    O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
    O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\18.1.7.644\AVG Secure Search_toolbar.dll
    O3 - Toolbar: ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll
    O4 - HKLM\..\Run: [ASUS Update Checker] C:\Program Files\ASUS\ASUSUpdate\UpdateChecker\UpdateChecker.exe
    O4 - HKLM\..\Run: [Turbo Key] "C:\Program Files\ASUS\Turbo Key\TurboKey.exe"
    O4 - HKLM\..\Run: [TurboV] "C:\Program Files\ASUS\TurboV\TurboV.exe" -b
    O4 - HKLM\..\Run: [GPU NOS] "C:\Program Files\ASUS\GPU NOS\Gpu.exe" -b
    O4 - HKLM\..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe 1
    O4 - HKLM\..\Run: [BCU] "C:\Program Files\DeviceVM\Browser Configuration Utility\BCU.exe"
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [ZoneAlarm] "C:\Program Files\CheckPoint\ZoneAlarm\zatray.exe"
    O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe"
    O4 - HKLM\..\Run: [ISW] "C:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /icon="hidden"
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files\AVG\AVG2014\avgui.exe" /TRAYONLY
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Heimo\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
    O4 - HKCU\..\Run: [Advanced SystemCare 5] "C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe" /AutoStart
    O4 - HKCU\..\Run: [TBHostSupport] "C:\WINDOWS\system32\Rundll32.exe" "C:\Documents and Settings\Heimo\Local Settings\Application Data\TBHostSupport\TBHostSupport.dll",DLLRunTBHostSupportPlugin
    O4 - HKCU\..\Run: [CCleaner Monitoring] "C:\Program Files\CCleaner\CCleaner.exe" /MONITOR
    O4 - HKCU\..\Run: [BitTorrent] "C:\Documents and Settings\Heimo\Application Data\BitTorrent\BitTorrent.exe" /MINIMIZED
    O4 - HKCU\..\RunOnce: [Adobe Speed Launcher] 1428590993
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Paikallinen palve')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Verkkopalve')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
    O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\18.1.7\ViProtocol.dll
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
    O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe
    O23 - Service: Advanced SystemCare Service 5 (AdvancedSystemCareService5) - IObit - C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe
    O23 - Service: AMD RAIDXpert (AMD_RAIDXpert) - AMD - C:\Program Files\AMD\RAIDXpert\bin\RAIDXpertService.exe
    O23 - Service: ASUS System Control Service (AsSysCtrlService) - ASUSTeK Computer Inc. - C:\Program Files\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2014\avgidsagent.exe
    O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2014\avgwdsvc.exe
    O23 - Service: Browser Configuration Utility Service (BCUService) - DeviceVM, Inc. - C:\Program Files\DeviceVM\Browser Configuration Utility\BCUService.exe
    O23 - Service: Bonjour-palvelu (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Loogisen levyn hallinnan valvontapalvelu (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
    O23 - Service: DeviceVM Meta Data Export Service (DvmMDES) - DeviceVM - C:\ASUS.SYS\config\DVMExportService.exe
    O23 - Service: Tapahtumaloki (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
    O23 - Service: CD-levyjen kirjoittamisen IMAPI COM -palvelu (ImapiService) - Unknown owner - C:\WINDOWS\System32\imapi.exe
    O23 - Service: ZoneAlarm LTD Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Oracle Corporation - C:\Program Files\Java\jre7\bin\jqs.exe
    O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
    O23 - Service: @C:\Program Files\Nero\Update\NASvc.exe,-200 (NAUpdate) - Nero AG - C:\Program Files\Nero\Update\NASvc.exe
    O23 - Service: NMSAccess - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
    O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
    O23 - Service: ServiceLayer - Nokia - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Resurssilokit ja -hälytykset (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Program Files\CheckPoint\ZoneAlarm\vsmon.exe
    O23 - Service: Aseman tilannevedos (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
    O23 - Service: vToolbarUpdater18.1.7 - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\18.1.7\ToolbarUpdater.exe
    O23 - Service: WMI resurssisovitin (WmiApSrv) - Unknown owner - C:\WINDOWS\System32\wbem\wmiapsrv.exe

    --
    End of file - 12195 bytes
     
    tti82, Apr 9, 2015
    #1
  2. rick79

    rick79 Senior member

    Joined:
    Feb 15, 2009
    Messages:
    5,125
    Likes Received:
    547
    Trophy Points:
    193
    ihan ekana poistat tuon iobitin system care kikkareen pois koneelta, sen jälkeen lataat malware antibytes softan ja teet täyden tarkistuksen, sitten lataat adwcleanerin ja tarkastat koneen sillä.. Toki ois auttanu jos oisit kertonu mikä siinä koneessa on vikana.
     
    rick79, Apr 9, 2015
    #2
  3. tti82

    tti82 Member

    Joined:
    Nov 8, 2007
    Messages:
    12
    Likes Received:
    0
    Trophy Points:
    11
    oho, näköjään jäi teksi pois..sori

    eli koneella pystyy olemaan netissä n. 20min..sitten menee jumiin ja pitää sammuttaa virtanäppäimesta...
     
    tti82, Apr 9, 2015
    #3
  4. rick79

    rick79 Senior member

    Joined:
    Feb 15, 2009
    Messages:
    5,125
    Likes Received:
    547
    Trophy Points:
    193
    koneen osat olis hyvä tietää tai jos on merkkikone niin merkki ja tarkka malli
     
    rick79, Apr 9, 2015
    #4
  5. JoniS

    JoniS Active member

    Joined:
    Oct 6, 2008
    Messages:
    2,951
    Likes Received:
    261
    Trophy Points:
    93
    Kyseessähän voi olla ihan rautapuolen vikakin jos tuollaista tekee, joten koneen tiedot voisi olla jees saada niinkuin @rick79 mainitsikin jo.
     
    JoniS, Apr 10, 2015
    #5
  6. tti82

    tti82 Member

    Joined:
    Nov 8, 2007
    Messages:
    12
    Likes Received:
    0
    Trophy Points:
    11
    kone on kasattu..apout 5v sitten..tämmöiset tiedot tulee ccleanerista
    pentium dual-core CPU E6600 @ 3,06 GHz, 3,5gb ram, NVIDIA GeForce 8800gt
     
    tti82, Apr 10, 2015
    #6
  7. JoniS

    JoniS Active member

    Joined:
    Oct 6, 2008
    Messages:
    2,951
    Likes Received:
    261
    Trophy Points:
    93
    lataappa speccy -> https://www.piriform.com/speccy
    tuolta saa vähän tarkemmat tiedot, tosin tuossahan nuo pääasiassa oli mitä tarvii.

    ja tästä hwmonitor -> http://www.cpuid.com/softwares/hwmonitor.html
    tuolla näet lämmöt, lähinnä kiinnostaa prossun(CPU=E6600 ja näyttiksen(GPU=8800gt) lämmöt

    ota vaikka kuva kaappaukset molemmista softista ja laita ne tänne seuraavassa viestissä.

    E: ja tosiaan aja "custom scan" tuolla malwarebytes antimalwarella mitä @rick79 suositteli jo aiemmin, sen saat täältä -> https://www.malwarebytes.org/mwb-download/
     
    JoniS, Apr 10, 2015
    #7
  8. tti82

    tti82 Member

    Joined:
    Nov 8, 2007
    Messages:
    12
    Likes Received:
    0
    Trophy Points:
    11
    tässä hetkonen kestää..täytyy saada joku tulemaan paikanpäälle katsomaan..en saa ladattua mitään noista ohjelmista...saan vaan downloads kansioon ladattua tuon pohjan missä on tietokone,näyttö ja cd-levyn kuva...tuplaklikkaamalla tulee "avaa tiedosta, ---> suorita" 3sek lataamisen jälkeen tiimalasi häviää..eikä mitään tapahdu
     
    tti82, Apr 10, 2015
    #8

Share This Page