Tämmöstä työntää, apu olisi tervetullutta: Logfile of HijackThis v1.99.1 Scan saved at 18:32:15, on 31.10.2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\System32\Ati2evxx.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\Explorer.EXE D:\WINDOWS\system32\spoolsv.exe D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe D:\Program Files\AVPersonal\AVGNT.EXE D:\Program Files\MessengerPlus! 3\MsgPlus.exe C:\Program Files\ASUS\Probe\AsusProb.exe D:\Program Files\Microsoft IntelliPoint\point32.exe D:\Program Files\Winamp\winampa.exe D:\Program Files\D-Tools\daemon.exe D:\Program Files\Common Files\Real\Update_OB\realsched.exe D:\WINDOWS\System32\rmctrl.exe D:\Program Files\iTunes\iTunesHelper.exe D:\Program Files\QuickTime\qttask.exe D:\Program Files\MSN Messenger\msnmsgr.exe D:\WINDOWS\Mixer.exe D:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE D:\Program Files\AVPersonal\AVWUPSRV.EXE D:\Program Files\ewido\security suite\ewidoctrl.exe D:\Program Files\ewido\security suite\ewidoguard.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\wincntrl.exe D:\Program Files\iPod\bin\iPodService.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe D:\WINDOWS\system32\cmd.exe D:\Program Files\DC++\DCPlusPlus.exe D:\Program Files\ACD Systems\ACDSee\ACDSee.exe D:\Program Files\Mozilla Firefox\firefox.exe D:\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [ATIPTA] "D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [AVGCtrl] "D:\Program Files\AVPersonal\AVGNT.EXE" /min O4 - HKLM\..\Run: [MessengerPlus3] "D:\Program Files\MessengerPlus! 3\MsgPlus.exe" O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe O4 - HKLM\..\Run: [C-Media Mixer] D:\Program Files\PCI Audio Applications\Bin\AudioRack.exe /MixerStartup O4 - HKLM\..\Run: [IntelliPoint] "D:\Program Files\Microsoft IntelliPoint\point32.exe" O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [RemoteControl] D:\WINDOWS\System32\rmctrl.exe O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [System Service] servu.exe O4 - HKLM\..\RunServices: [System Service] servu.exe O4 - HKCU\..\Run: [MessengerPlus3] "D:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart O4 - HKCU\..\Run: [SVCH Service] svch32.pif O4 - HKCU\..\Run: [HTML32 Help System] hhs32.pif O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\RunServices: [SVCH Service] svch32.pif O4 - HKCU\..\RunServices: [HTML32 Help System] hhs32.pif O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - D:\Program Files\AVPersonal\AVWUPSRV.EXE O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - D:\Program Files\ewido\security suite\ewidoguard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe O23 - Service: IpManager (IPtable) - Unknown owner - D:\WINDOWS\ipconfg32.exe (file missing) O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: Msdebugsrv1 (Msdebugsrv) - Unknown owner - D:\WINDOWS\dbg32hlp.exe (file missing) O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: MS Dns Service (WinNet) - Unknown owner - D:\WINDOWS\system32\wincntrl.exe
Sammuta prosessi tehtävienhallinnasta (ctrl+alt+del -> lopeta prosessi): wincntrl.exe Siirrä HjT omaan hakemistoon, vaikka D:\hjt\Hijackthis.exe Fixaa HjT:llä (do a system scan only, merkkaa nämä ja paina fix checked): O4 - HKLM\..\Run: [System Service] servu.exe O4 - HKLM\..\RunServices: [System Service] servu.exe O4 - HKCU\..\Run: [SVCH Service] svch32.pif O4 - HKCU\..\Run: [HTML32 Help System] hhs32.pif O4 - HKCU\..\RunServices: [SVCH Service] svch32.pif O4 - HKCU\..\RunServices: [HTML32 Help System] hhs32.pif O23 - Service: IpManager (IPtable) - Unknown owner - D:\WINDOWS\ipconfg32.exe (file missing) O23 - Service: Msdebugsrv1 (Msdebugsrv) - Unknown owner - D:\WINDOWS\dbg32hlp.exe (file missing) O23 - Service: MS Dns Service (WinNet) - Unknown owner - D:\WINDOWS\system32\wincntrl.exe Sitten käynnistä -> suorita -> services.msc -> ok -> etsi listalta IpManager Msdebugsrv1 MS Dns Service Tuplaklikkaa niitä, paina seis ja valitse käynnistymistavaksi "ei käytössä". Laita piilotiedostot näkyviin, ohje -> http://keskustelu.afterdawn.com/thread_view.cfm/248944 Käynnistä vikasietotilaan (F8 käynnistyksen yhteydessä) ja poista: servu.exe svch32.pif hhs32.pif (näitä ei välttämättä ole, etsi Etsi-toiminnolla ja valitse myös Lisävaihtoehdot -> Etsi piilotiedostoista ja -kansioista) D:\WINDOWS\==>ipconfg32.exe<== D:\WINDOWS\==>dbg32hlp.exe<==(näitäkään ei välttämättä ole) D:\WINDOWS\system32\==>wincntrl.exe<== Käynnistä uudelleen ja lähetä uusi HjT-loki.
Kiitoksia jo tähän väliin, ja tässäpä uusi loki: Logfile of HijackThis v1.99.1 Scan saved at 20:41:32, on 31.10.2005 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\System32\Ati2evxx.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\Explorer.EXE D:\WINDOWS\system32\spoolsv.exe D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe D:\Program Files\AVPersonal\AVGNT.EXE C:\Program Files\ASUS\Probe\AsusProb.exe D:\Program Files\Microsoft IntelliPoint\point32.exe D:\Program Files\Winamp\winampa.exe D:\Program Files\D-Tools\daemon.exe D:\Program Files\Common Files\Real\Update_OB\realsched.exe D:\WINDOWS\System32\rmctrl.exe D:\Program Files\iTunes\iTunesHelper.exe D:\Program Files\QuickTime\qttask.exe D:\WINDOWS\Mixer.exe D:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE D:\Program Files\AVPersonal\AVWUPSRV.EXE D:\Program Files\ewido\security suite\ewidoctrl.exe D:\Program Files\ewido\security suite\ewidoguard.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe D:\WINDOWS\System32\svchost.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe D:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe D:\Program Files\iPod\bin\iPodService.exe D:\WINDOWS\System32\wuauclt.exe D:\Hjt\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fi/ O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\Run: [ATIPTA] "D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [AVGCtrl] "D:\Program Files\AVPersonal\AVGNT.EXE" /min O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe O4 - HKLM\..\Run: [C-Media Mixer] D:\Program Files\PCI Audio Applications\Bin\AudioRack.exe /MixerStartup O4 - HKLM\..\Run: [IntelliPoint] "D:\Program Files\Microsoft IntelliPoint\point32.exe" O4 - HKLM\..\Run: [WinampAgent] D:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Program Files\D-Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [RemoteControl] D:\WINDOWS\System32\rmctrl.exe O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\WINDOWS\System32\msjava.dll O12 - Plugin for .spop: D:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: AntiVir Service (AntiVirService) - H+BEDV Datentechnik GmbH - D:\PROGRAM FILES\AVPERSONAL\AVGUARD.EXE O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe O23 - Service: AntiVir Update (AVWUpSrv) - H+BEDV Datentechnik GmbH, Germany - D:\Program Files\AVPersonal\AVWUPSRV.EXE O23 - Service: ewido security suite control - ewido networks - D:\Program Files\ewido\security suite\ewidoctrl.exe O23 - Service: ewido security suite guard - ewido networks - D:\Program Files\ewido\security suite\ewidoguard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - D:\Program Files\iPod\bin\iPodService.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - D:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - D:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
