Voisko joku vilkaista tätä hjt-logia

Discussion in 'Virukset ja haittaohjelmat' started by Lifestyle, Mar 28, 2006.

  1. Lifestyle

    Lifestyle Member

    Joined:
    Mar 28, 2006
    Messages:
    16
    Likes Received:
    0
    Trophy Points:
    11
    Elikkä ohjelmat toimii hitaasti, prosessikäppyrä näyttää sataa ja koneen tuuletin huutaa täysillä koko aika vaik ei käyttäs mitää ohjelmaa. Voisitteko auttaa. Kiitoksia etukäteen jo paljon.

    Logfile of HijackThis v1.99.1
    Scan saved at 19:44:58, on 28.3.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Launch Manager\LaunchAp.exe
    C:\Launch Manager\HotkeyApp.exe
    C:\Launch Manager\OSD.exe
    C:\Launch Manager\OSDCtrl.exe
    C:\Launch Manager\Wbutton.exe
    C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\Program Files\RF Wireless Mouse\cm20.exe
    C:\WINDOWS\system32\rmctrl.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
    C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
    C:\Launch Manager\WButton.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Omistaja\Omat tiedostot\Unzipped\hijackthis_199\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [LaunchAp] C:\Launch Manager\LaunchAp.exe
    O4 - HKLM\..\Run: [HotkeyApp] C:\Launch Manager\HotkeyApp.exe
    O4 - HKLM\..\Run: [LMgrVolOSD] C:\Launch Manager\OSD.exe
    O4 - HKLM\..\Run: [LMgrOSD] C:\Launch Manager\OSDCtrl.exe
    O4 - HKLM\..\Run: [Wbutton] "C:\Launch Manager\Wbutton.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [CtrlVol] C:\Launch Manager\CtrlVol.exe
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [Start RF Wireless Mouse] C:\Program Files\RF Wireless Mouse\cm20.exe
    O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\system32\rmctrl.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Search - http://kn.bar.need2find.com/KN/menusearch.html?p=KN
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O17 - HKLM\System\CCS\Services\Tcpip\..\{A1387680-86B8-4600-BE31-4B926934F86F}: NameServer = 195.222.32.10,195.222.32.20
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
     
  2. tapiiri

    tapiiri Regular member

    Joined:
    Jun 11, 2005
    Messages:
    1,142
    Likes Received:
    0
    Trophy Points:
    46
    onko palvelimesi sarajevossa?
     
  3. Lifestyle

    Lifestyle Member

    Joined:
    Mar 28, 2006
    Messages:
    16
    Likes Received:
    0
    Trophy Points:
    11
    Tuzlassa. Kun olen täällä töissä. Mut samaa bosniaa tämäkin on kuin sarajevo. Mistäs sen oikein näkee??? :)
     
  4. tapiiri

    tapiiri Regular member

    Joined:
    Jun 11, 2005
    Messages:
    1,142
    Likes Received:
    0
    Trophy Points:
    46
    Toi 017 rivi:
    O17 - HKLM\System\CCS\Services\Tcpip\..\{A1387680-86B8-4600-BE31-4B926934F86F}: NameServer = 195.222.32.10,195.222.32.20

    inetnum: 195.222.32.0 - 195.222.32.63
    netname: BIHNET
    descr: Public Enterprise of BH Telecom
    descr: Sarajevo

    Lokissa oli noi:

    Eli scannaa hijackilla ja ruksaa:

    O8 - Extra context menu item: &Search - http://kn.bar.need2find.com/KN/menusearch.html?p=KN
    O18 - Filter: text/html - {2AB289AE-4B90-4281-B2AE-1F4BB034B647} - (no file)

    Sammuta muut ikkunat ja paina Fix checked.

    Boottaa kone.

    Lataa ja tallenna Blacklight työpöydällesi;
    http://www.f-secure.com/blacklight/try.shtml

    Tupla-klikkaa blbeta.exe, hyväksy sopimus, klikkaa > Scan, sitten > Next

    Näet listan kaikesta mitä löytyi. Työpöydällesi myös ilmestyy loki jonka nimi on fsbl.xxxxxxx.log (xxxxxxx;n tilalla on luultavimmin numeroita).

    Kopioi ja liitä tämä loki seuraavaan vastaukseesi. Älä valitse "Rename" optiota vielä! Haluamme nähdä login ensin, koska hyviä tiedostoja saattaa olla mukana, kuten "wbemtest.exe".
     
  5. Lifestyle

    Lifestyle Member

    Joined:
    Mar 28, 2006
    Messages:
    16
    Likes Received:
    0
    Trophy Points:
    11
    Kiitoksia paljon Alan puuhastelee. Pitäiskö hommata lasit. Kun en itse edes tota huomannut et palvelinkin näkyy, niin yritä sit itse etsiä vikaa koneesta. :)
     
  6. Lifestyle

    Lifestyle Member

    Joined:
    Mar 28, 2006
    Messages:
    16
    Likes Received:
    0
    Trophy Points:
    11
    Poistin ne rivit lokista jne... Kone tahmoo edelleen buuttauksen jälkeen. :( Täs tää kopio:

    03/28/06 21:54:09 [Info]: BlackLight Engine 1.0.33 initialized
    03/28/06 21:54:09 [Info]: OS: 5.1 build 2600 (Service Pack 2)
    03/28/06 21:54:09 [Note]: 7019 4
    03/28/06 21:54:09 [Note]: 7005 0
    03/28/06 21:54:15 [Note]: 7006 0
    03/28/06 21:54:15 [Note]: 7011 1316
    03/28/06 21:54:16 [Note]: FSRAW library version 1.7.1015
    03/28/06 21:55:49 [Note]: 7007 0

    Siis jos tätä tarkoitit???



     
  7. Lifestyle

    Lifestyle Member

    Joined:
    Mar 28, 2006
    Messages:
    16
    Likes Received:
    0
    Trophy Points:
    11
    Työpöydälle ei ilmesty muuta kuin notepad tiedosto jota et varmaan tarkoittanut.
     
  8. tapiiri

    tapiiri Regular member

    Joined:
    Jun 11, 2005
    Messages:
    1,142
    Likes Received:
    0
    Trophy Points:
    46
    Blacklight loki ok.

    Toi 018 mikä fiksattiin on rxtoolbar :in kuuluva ja on örkki.

    Lataa Ewido : http://keskustelu.afterdawn.com/thread_view.cfm/269186
    Päivitä se. Älä scannaa vielä.

    Käynnistä kone vikasietotilaan ja scannaa Ewidolla Full system scan tallena raportti.


    Tyhjää temp hakemisto ja poista nuo:

    C:\WINDOWS\temp\
    C:\programfiles\ >>rxtoolbar\ < jos löytyy
    >> sfcont.dll < jos löytyy.

    Sitten voisit putsata rekisteriä jollain ohjelmalla, esim easycleaner
    http://personal.inet.fi/business/toniarts/files/EClea2_0.exe

    Boottaa kone putsauksien jälkeen ja laita uusi hijack this loki ja Ewidon raportti.
    F-secure on raskas ohjelma ja hidastaa konetta kanssa.
     
  9. blade81

    blade81 Active member

    Joined:
    Jul 28, 2003
    Messages:
    1,287
    Likes Received:
    0
    Trophy Points:
    66
    Lähtikö nuo hjt:llä fixatut rivit varmasti? Spybotin TeaTimerilla on välillä tapana estää fixaukset.
     
  10. Lifestyle

    Lifestyle Member

    Joined:
    Mar 28, 2006
    Messages:
    16
    Likes Received:
    0
    Trophy Points:
    11
    Kyllä ne mun mielestä lähti, kun katsoin uudestaan. Mut nyt alan ajaa noita eilisiä tehtäviä. Jäi eilen illalla kesken kun täälläkin joutuu töitä tekee. :) Laitan uuden login raportin sit tulee teille.
     
  11. Lifestyle

    Lifestyle Member

    Joined:
    Mar 28, 2006
    Messages:
    16
    Likes Received:
    0
    Trophy Points:
    11
    Täs ewoden raportti:

    ---------------------------------------------------------
    ewido anti-malware - Scan report
    ---------------------------------------------------------

    + Created on: 23:07:04, 29.3.2006
    + Report-Checksum: C1AF038D

    + Scan result:

    HKLM\SOFTWARE\AKSoft -> Adware.AkSoft : Cleaned with backup
    HKU\S-1-5-21-2943473358-2916719167-3180070804-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{59879FA4-4790-461C-A1CC-4EC4DE4CA483} -> Adware.RXToolbar : Cleaned with backup


    ::Report End

    Ja täs hjt viimeisin logi:

    Logfile of HijackThis v1.99.1
    Scan saved at 10:36:17, on 30.3.2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    C:\Program Files\ewido anti-malware\ewidoctrl.exe
    C:\Program Files\ewido anti-malware\ewidoguard.exe
    C:\Program Files\F-Secure\BackWeb\7681197\Program\F-Secure Automatic Update.exe
    C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
    C:\Program Files\F-Secure\Common\FSMA32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
    C:\Program Files\F-Secure\Common\FSMB32.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\F-Secure\Common\FCH32.EXE
    C:\Program Files\F-Secure\Common\FAMEH32.EXE
    C:\Program Files\F-Secure\Common\FNRB32.EXE
    C:\Program Files\F-Secure\Common\FIH32.EXE
    C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
    C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Launch Manager\LaunchAp.exe
    C:\Launch Manager\HotkeyApp.exe
    C:\Launch Manager\OSD.exe
    C:\Launch Manager\OSDCtrl.exe
    C:\Launch Manager\Wbutton.exe
    C:\Program Files\Microsoft AntiSpyware\gcasServ.exe
    C:\Program Files\F-Secure\Common\FSM32.EXE
    C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
    C:\Program Files\F-Secure\FSGUI\fsguiexe.exe
    C:\Program Files\RF Wireless Mouse\cm20.exe
    C:\WINDOWS\system32\rmctrl.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Omistaja\Työpöytä\hijackthis_199\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [LaunchAp] C:\Launch Manager\LaunchAp.exe
    O4 - HKLM\..\Run: [HotkeyApp] C:\Launch Manager\HotkeyApp.exe
    O4 - HKLM\..\Run: [LMgrVolOSD] C:\Launch Manager\OSD.exe
    O4 - HKLM\..\Run: [LMgrOSD] C:\Launch Manager\OSDCtrl.exe
    O4 - HKLM\..\Run: [Wbutton] "C:\Launch Manager\Wbutton.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [CtrlVol] C:\Launch Manager\CtrlVol.exe
    O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [Start RF Wireless Mouse] C:\Program Files\RF Wireless Mouse\cm20.exe
    O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\system32\rmctrl.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O17 - HKLM\System\CCS\Services\Tcpip\..\{A1387680-86B8-4600-BE31-4B926934F86F}: NameServer = 195.222.32.10,195.222.32.20
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE
    O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
    O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
    O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
    O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\F-Secure\BackWeb\7681197\program\fsbwsys.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE

    Kiitoksia taas etukäteen kaikille. :)
     
  12. tapiiri

    tapiiri Regular member

    Joined:
    Jun 11, 2005
    Messages:
    1,142
    Likes Received:
    0
    Trophy Points:
    46
    Lokisi ovat kunnossa :)
     
  13. Lifestyle

    Lifestyle Member

    Joined:
    Mar 28, 2006
    Messages:
    16
    Likes Received:
    0
    Trophy Points:
    11
    Kiitoksia kaikille vaivaa nähneille. :)
     
  14. tapiiri

    tapiiri Regular member

    Joined:
    Jun 11, 2005
    Messages:
    1,142
    Likes Received:
    0
    Trophy Points:
    46
    Ole hyvä.
     

Share This Page