Tässä tutkin koneen syvimpiä syövereitä ja havaitsin svchost.exe -tiedoston (piilotettuna) Windows -kansiossa (oli myös näkyvänä Windows/system32 -kansiossa). Joillain sivuilla varoiteltiin, että svchost muualla kun system32 -kansiossa on tod.näk. pöpö... Onko näin? Läpi on ajettu virustutkaa yms.. näkyykö HJT-logissa mitään siihen viittaavaa tms. vakavaa/huomioitavaa? - - - - - - Logfile of HijackThis v1.99.1 Scan saved at 20:20:59, on 26.1.2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\ewido\security suite\ewidoctrl.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\NORMAN\Nvc\BIN\NPFSVICE.EXE C:\Norman\bin\ZANDA.EXE C:\WINDOWS\system32\slserv.exe C:\WINDOWS\System32\svchost.exe C:\NORMAN\Nvc\BIN\NVCSCHED.EXE C:\NORMAN\Nvc\BIN\nvcoas.exe C:\Norman\bin\NJEEVES.EXE C:\Aston\aston.exe C:\Aston\XP\internat.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Norman\bin\ZLH.EXE C:\Program Files\D-Tools\daemon.exe C:\Program Files\Rainlendar\Rainlendar.exe C:\Program Files\SpeedFan\speedfan.exe C:\Program Files\IC Media Corp\ICM532\Launchpad.exe C:\Norman\Nvc\bin\cclaw.exe C:\Norman\Npf\BIN\npfmsg2.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\explorer.exe C:\HJT\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.cop.fi/index.asp R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxy.cop.fi/kirjasto.pac R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: Rainlendar.lnk = C:\Program Files\Rainlendar\Rainlendar.exe O4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Launchpad.lnk = ? O4 - Global Startup: Pikakuvake spywareblaster.exe.lnk = C:\Program Files\SpywareBlaster\spywareblaster.exe O16 - DPF: {001EE746-A1F9-460E-80AD-269E088D6A01} (Infotl Control) - http://site.ebrary.com/support/plugins/ebraryRdr.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1124358607218 O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://194.240.224.222/activex/AxisCamControl.cab O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: distributed.net client (dnetc) - Unknown owner - C:\WINDOWS\system32\iosdt\iosdt.exe (file missing) O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE O23 - Service: Norman Type-R - Unknown owner - C:\NORMAN\Nvc\BIN\NPFSVICE.EXE O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\bin\ZANDA.EXE O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\NORMAN\Nvc\BIN\nvcoas.exe O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\NORMAN\Nvc\BIN\NVCSCHED.EXE O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe - - - - - - - Edit: Kävin kokeilemassa http://www.virustotal.com -osoitteessa tuota svchost.exe:ä. Seuraava tulos: - - - - - - - AntiVir 6.33.0.77 01.26.2006 no virus found Avast 4.6.695.0 01.26.2006 no virus found AVG 718 01.26.2006 no virus found Avira 6.33.0.77 01.26.2006 no virus found BitDefender 7.2 01.26.2006 Backdoor.RBot.407A6F71 CAT-QuickHeal 8.00 01.25.2006 (Suspicious) - DNAScan ClamAV devel-20051123 01.26.2006 no virus found DrWeb 4.33 01.26.2006 no virus found eTrust-InoculateIT 23.71.60 01.25.2006 no virus found eTrust-Vet 12.4.2056 01.25.2006 no virus found Ewido 3.5 01.26.2006 no virus found Fortinet 2.54.0.0 01.26.2006 no virus found F-Prot 3.16c 01.25.2006 no virus found Ikarus 0.2.59.0 01.26.2006 no virus found Kaspersky 4.0.2.24 01.26.2006 Backdoor.Win32.Rbot.gen McAfee 4683 01.26.2006 W32/Sdbot.worm.gen.bg NOD32v2 1.1381 01.26.2006 a variant of Win32/Rbot Norman 5.70.10 01.26.2006 no virus found Panda 9.0.0.4 01.26.2006 Bck/Sdbot.GHT Sophos 4.01.0 01.26.2006 no virus found Symantec 8.0 01.26.2006 W32.Spybot.Worm TheHacker 5.9.3.081 01.26.2006 no virus found UNA 1.83 01.25.2006 no virus found VBA32 3.10.5 01.26.2006 no virus found - - - - - - -
Loki on puhdas. Tosiaan svchost jossain muualla, kuin system32 kansiossa on örkki, joten poista se. Jos ei muuten lähde, niin vikasietotilassa. Skannaa Ewidolla, ja laita sen löydöt tänne > http://keskustelu.afterdawn.com/thread_view.cfm/269186
Näyttäisi omasta mielestä aika selvältä... --------------------------------------------------------- ewido anti-malware - Scan report --------------------------------------------------------- + Created on: 23:53:17, 26.1.2006 + Report-Checksum: D1882AD + Scan result: :mozilla.6:C:\Documents and Settings\Teemu\Application Data\Mozilla\Firefox\Profiles\3l01kep7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.7:C:\Documents and Settings\Teemu\Application Data\Mozilla\Firefox\Profiles\3l01kep7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.8:C:\Documents and Settings\Teemu\Application Data\Mozilla\Firefox\Profiles\3l01kep7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.9:C:\Documents and Settings\Teemu\Application Data\Mozilla\Firefox\Profiles\3l01kep7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.10:C:\Documents and Settings\Teemu\Application Data\Mozilla\Firefox\Profiles\3l01kep7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.11:C:\Documents and Settings\Teemu\Application Data\Mozilla\Firefox\Profiles\3l01kep7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.12:C:\Documents and Settings\Teemu\Application Data\Mozilla\Firefox\Profiles\3l01kep7.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup :mozilla.89:C:\Documents and Settings\Teemu\Application Data\Mozilla\Firefox\Profiles\3l01kep7.default\cookies.txt -> Spyware.Cookie.Etracker : Cleaned with backup :mozilla.101:C:\Documents and Settings\Teemu\Application Data\Mozilla\Firefox\Profiles\3l01kep7.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup ::Report End
