Ole hyvä ohje "HijackThis" Loki

tidi · #1 2 heinäkuu 2009, 13:46

Minulla ei ole hajuakaan miten lukea tämän voi joku ystävällisesti auttaa minua ystävällisesti jotain pielessä?

Logfile ja Trend Micro HijackThis v2.0.2
Scan tallennettu klo 07:57:12 PM, on 23/06/2009
Boot mode: Normal

Käynnissä olevista prosesseista:
C: \ Program Files (x86) \ Ares \ Ares.exe
C: \ Program Files (x86) \ HP \ Digital Imaging \ bin \ hpqtra08.exe
C: \ Program Files (x86) \ HP \ QuickPlay \ QPService.exe
C: \ Program Files (x86) \ Hewlett-Packard \ HP Quick Launch Buttons \ QLBCTRL.exe
C: \ Program Files (x86) \ HP \ HP Software Update \ hpwuSchd2.exe
C: \ Program Files (x86) \ Hewlett-Packard \ HP Wireless Assistant \ HPWAMain.exe
C: \ Program Files (x86) \ Hewlett-Packard \ HP Wireless Assistant \ WiFiMsg.exe
C: \ Program Files (x86) \ Daemon Tools \ daemon.exe
C: \ Program Files (x86) \ Common Files \ Real \ Update_OB \ realsched.exe
C: \ Program Files (x86) \ Kiwee Toolbar \ 2.8.167 \ kwtbaim.exe
C: \ Program Files (x86) \ Lavasoft \ Ad-Aware \ AAWTray.exe
C: \ Program Files (x86) \ Common Files \ Research In Motion \ Auto Update \ RIMAutoUpdate.exe
C: \ Program Files (x86) \ Java \ jre6 \ bin \ jusched.exe
C: \ Program Files (x86) \ iTunes \ iTunesHelper.exe
C: \ Program Files \ ALWIL Software \ Avast4 \ ashDisp.exe
C: \ Program Files (x86) \ Hewlett-Packard \ Shared \ HpqToaster.exe
C: \ Windows \ SysWOW64 \ conime.exe
C: \ Program Files \ Widcomm \ Bluetooth Software \ BluetoothHeadsetProxy.exe
C: \ Windows \ SysWOW64 \ DllHost.exe
C: \ Program Files (x86) \ HP \ Digital Imaging \ bin \ hpqSTE08.exe
C: \ Program Files (x86) \ Mozilla Firefox \ firefox.exe
C: \ Program Files (x86) \ Windows Live \ Messenger \ msnmsgr.exe
C: \ Program Files (x86) \ Trend Micro \ HijackThis \ juice.exe.exe

R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop
R1 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://ie.redirect.hp.com/svs/rdr?TY...lion&pf=laptop
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Search, SearchAssistant =
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Search, CustomizeSearch =
R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Toolbar, LinksFolderName =
O2 - BHO: (no name) - (02478D38-C3F9-4efb-9B51-7695ECA05670) - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Program Files (x86) \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEHelper.dll
O2 - BHO: (no name) - (5C255C8A-E604-49b4-9D64-90988571CECB) - (no file)
O2 - BHO: NCO 2.0 IE BHO - (602ADB0E-4AFF-4217-8AA1-95DAC4DFA408) - (no file)
O2 - BHO: Kiwee Toolbar - (6638A9DE-0745-4292-8A2E-AE530E7B9B3F) - C: \ Program Files (x86) \ Kiwee Toolbar \ 2.8.167 \ KiweeIEToolbar.dll
O2 - BHO: Windows Live Sign-in Helper - (9030D464-4C02-4ABF-8ECC-5164760863C6) - C: \ Program Files (x86) \ Common Files \ Microsoft Shared \ Windows Live \ WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - (AF69DE43-7D58-4638-B6FA-CE66B5AD205D) - C: \ Program Files (x86) \ Google \ GoogleToolbarNotifier \ 5.1.1309.3572 \ s wg.dll
O2 - BHO: Java (tm) Plug-In 2 SSV Helper - (DBC80044-A445-435b-BC74-9C25C1C588A9) - C: \ Program Files (x86) \ Java \ jre6 \ bin \ jp2ssv.dll
O2 - BHO: HP Smart BHO Class - (FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856) - C: \ Program Files (x86) \ HP \ Digital Imaging \ Smart Web Printing \ hpswp_BHO.dll
O2 - BHO: HP Print Clips - (FFFFFFFF-FF12-44C5-91EC-068E3AA1B2D7) - c: \ Program Files (x86) \ HP \ Smart Web Printing \ hpswp_framework.dll
O3 - Toolbar: (no name) - (7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA) - (no file)
O3 - Toolbar: Kiwee Toolbar - (6638A9DE-0745-4292-8A2E-AE530E7B9B3F) - C: \ Program Files (x86) \ Kiwee Toolbar \ 2.8.167 \ KiweeIEToolbar.dll
O4 - HKLM \ .. \ Run: [QPService] "C: \ Program Files (x86) \ HP \ QuickPlay \ QPService.exe"
O4 - HKLM \ .. \ Run: [QlbCtrl]% ProgramFiles (x86)% \ Hewlett-Packard \ HP Quick Launch Buttons \ QlbCtrl.exe / käynnistys
O4 - HKLM \ .. \ Run: [UCam_Menu] "C: \ Program Files (x86) \ Cyberlink \ YouCam \ MUITransfer \ MUIStartMenu.ex e" "C: \ Program Files (x86) \ Cyberlink \ YouCam" update "Ohjelmistot \ Cyberlink \ YouCam \ 1.0 "
O4 - HKLM \ .. \ Run: [hpqSRMon] C: \ Program Files (x86) \ HP \ Digital Imaging \ bin \ hpqSRMon.exe
O4 - HKLM \ .. \ Run: [HP Software Update] C: \ Program Files (x86) \ HP \ HP Software Update \ HPWuSchd2.exe
O4 - HKLM \ .. \ Run: [hpWirelessAssistant] C: \ Program Files (x86) \ Hewlett-Packard \ HP Wireless Assistant \ HPWAMain.exe
O4 - HKLM \ .. \ Run: [WAWifiMessage] C: \ Program Files (x86) \ Hewlett-Packard \ HP Wireless Assistant \ WiFiMsg.exe
O4 - HKLM \ .. \ Run: [Daemon Tools] "C: \ Program Files (x86) \ Daemon Tools \ daemon.exe"-lang 1033
O4 - HKLM \ .. \ Run: [TkBellExe] "C: \ Program Files (x86) \ Common Files \ Real \ Update_OB \ realsched.exe"-osboot
O4 - HKLM \ .. \ Run: [KiweeHook] "C: \ Program Files (x86) \ Kiwee Toolbar \ 2.8.167 \ kwtbaim.exe"
O4 - HKLM \ .. \ Run: [Adobe Reader Speed Launcher] "C: \ Program Files (x86) \ Adobe \ Reader 8.0 \ Reader \ Reader_sl.exe"
O4 - HKLM \ .. \ Run: [Ad-Watch] "C: \ Program Files (x86) \ Lavasoft \ Ad-Aware \ AAWTray.exe"
O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Program Files (x86) \ QuickTime \ QTTask.exe"-atboottime
O4 - HKLM \ .. \ Run: [BlackBerryAutoUpdate] C: \ Program Files (x86) \ Common Files \ Research In Motion \ Auto Update \ RIMAutoUpdate.exe / tausta
O4 - HKLM \ .. \ Run: [SunJavaUpdateSched] "C: \ Program Files (x86) \ Java \ jre6 \ bin \ jusched.exe"
O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Program Files (x86) \ iTunes \ iTunesHelper.exe"
O4 - HKLM \ .. \ Run: [avast!] C: \ PROGRA ~ 1 \ ALWILS ~ 1 \ Avast4 \ ashDisp.exe
O4 - HKCU \ .. \ Run: [Sidebar] C: \ Program Files \ Windows Sidebar \ sidebar.exe / autorun
O4 - HKCU \ .. \ Run: [ehTray.exe] C: \ Windows \ ehome \ ehTray.exe
O4 - HKCU \ .. \ Run: [aareina] "C: \ Program Files (x86) \ Ares \ Ares.exe"-h
O4 - HKCU \ .. \ Run: [Uniblue RegistryBooster 2] C: \ Program Files (x86) \ uniblue \ registrybooster 2 \ StartRegistryBooster.exe
O4 - HKCU \ .. \ Run: [swg] C: \ Program Files (x86) \ Google \ GoogleToolbarNotifier \ GoogleToolbarNo tifier.exe
O4 - HKCU \ .. \ Run: [Windows] JOOJIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIII0JIIJ IJI0IJ00C: \ Windows \ Services.exe
O4 - HKCU \ .. \ Run: [MsnMsgr] "C: \ Program Files (x86) \ Windows Live \ Messenger \ MsnMsgr.Exe" / tausta
O4 - HKUS \ S-1-5-19 \ .. \ Run: [Sidebar]% ProgramFiles% \ Windows Sidebar \ Sidebar.exe / detectMem (User 'LOCAL SERVICE')
O4 - HKUS \ S-1-5-19 \ .. \ Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll, ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS \ S-1-5-20 \ .. \ Run: [Sidebar]% ProgramFiles% \ Windows Sidebar \ Sidebar.exe / detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Bluetooth.lnk =?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C: \ Program Files (x86) \ HP \ Digital Imaging \ bin \ hpqtra08.exe
O9 - Extra button: Send to OneNote - (2670000A-7350-4f3c-8081-5663EE0C6C49) - C: \ PROGRA ~ 2 \ mikros ~ 2 \ Office12 \ ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S & loppu OneNote - (2670000A-7350-4f3c-8081-5663EE0C6C49) - C: \ PROGRA ~ 2 \ mikros ~ 2 \ Office12 \ ONBttnIE.dll
O9 - Extra button: HP Smart Valitse - (58ECB495-38F0-49cb-A538-10282ABF65E7) - c: \ Program Files (x86) \ HP \ Smart Web Printing \ hpswp_extensions.dll
O9 - Extra button: Research - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C: \ PROGRA ~ 2 \ mikros ~ 2 \ Office12 \ REFIEBAR.DLL
O9 - Extra button: Lähetä Bluetooth - (CCA281CA-C863-46ef-9331-5C8D4460577F) - C: \ Program Files \ Widcomm \ Bluetooth Software \ btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Lähetä & Bluetooth Device ... - (CCA281CA-C863-46ef-9331-5C8D4460577F) - C: \ Program Files \ Widcomm \ Bluetooth Software \ btsendto_ie.htm
O9 - Extra button: Selección inteligente de HP - (DDE87865-83C5-48c4-8357-2F5B1AA84522) - C: \ Program Files (x86) \ HP \ Digital Imaging \ Smart Web Printing \ hpswp_BHO.dll
O13 - Gopher Prefix:
O20 - Winlogon Notify:! SASWinLogon - C: \ Program Files (x86) \ SUPERAntiSpyware \ SASWINLO.dll
O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C: \ Program Files (x86) \ AGI \ common \ win32 \ PythonService.exe
O23 - Service: @% SystemRoot% \ system32 \ Alg.exe, -112 (ALG) - Unknown owner - C: \ Windows \ System32 \ alg.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C: \ Program Files (x86) \ Common Files \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe
O23 - Service: Ares Chat-palvelimen (AresChatServer) - Ares Development Group - C: \ Program Files (x86) \ Ares \ chatServer.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C: \ Program Files \ ALWIL Software \ Avast4 \ aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C: \ Program Files \ ALWIL Software \ Avast4 \ ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C: \ Program Files \ ALWIL Software \ Avast4 \ ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C: \ Program Files \ ALWIL Software \ Avast4 \ ashWebSv.exe
O23 - Service: Servicio Bonjour (Bonjour Service) - Apple Inc. - C: \ Program Files (x86) \ Bonjour \ mDNSResponder.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, LP - C: \ Program Files (x86) \ Hewlett-Packard \ HP Quick Launch Buttons \ Com4Qlb.exe
O23 - Service: @ dfsrres.dll, -101 (DFSR) - Unknown owner - C: \ Windows \ system32 \ DFSR.exe (file missing)
O23 - Service: GameConsoleService - WildTangent, Inc. - C: \ Program Files (x86) \ HP Games \ Omat HP Game Console \ GameConsoleService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C: \ Program Files (x86) \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c: \ Program Files (x86) \ Hewlett-Packard \ HP Health Check \ hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, LP - C: \ Program Files (x86) \ Hewlett-Packard \ Shared \ hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C: \ Program Files (x86) \ Common Files \ InstallShield \ Driver \ 1050 \ Intel 32 \ IDriverT.exe
O23 - Service: Servicio del iPod (iPod Service) - Apple Inc. - C: \ Program Files (x86) \ iPod \ bin \ iPodService.exe
O23 - Service: @ keyiso.dll, -100 (KeyIso) - Unknown owner - C: \ Windows \ system32 \ Lsass.exe (file missing)
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C: \ Program Files (x86) \ Lavasoft \ Ad-Aware \ AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C: \ Program Files (x86) \ Common Files \ LightScribe \ LSSrvc.exe
O23 - Service: @ comres.dll, -2797 (MSDTC) - Unknown owner - C: \ Windows \ System32 \ msdtc.exe (file missing)
O23 - Service: @% SystemRoot% \ System32 \ netlogon.dll, -102 (Netlogon) - Unknown owner - C: \ Windows \ system32 \ Lsass.exe (file missing)
O23 - Service: @% systemroot% \ system32 \ psbase.dll, -300 (ProtectedStorage) - Unknown owner - C: \ Windows \ system32 \ Lsass.exe (file missing)
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C: \ Program Files (x86) \ HP \ QuickPlay \ Kernel \ TV \ QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C: \ Program Files (x86) \ HP \ QuickPlay \ Kernel \ TV \ QPSched.exe
O23 - Service: Cyberlink RichVideo Service (CRVS) (RichVideo) - Unknown owner - C: \ Program Files (x86) \ Cyberlink \ Shared Files \ RichVideo.exe
O23 - Service: @% systemroot% \ system32 \ Locator.exe, -2 (RpcLocator) - Unknown owner - C: \ Windows \ system32 \ Locator.exe (file missing)
O23 - Service: @% SystemRoot% \ system32 \ samsrv.dll, -1 (SamSs) - Unknown owner - C: \ Windows \ system32 \ Lsass.exe (file missing)
O23 - Service: @% SystemRoot% \ system32 \ SLsvc.exe, -101 (slsvc) - Unknown owner - C: \ Windows \ system32 \ SLsvc.exe (file missing)
O23 - Service: @% SystemRoot% \ system32 \ snmptrap.exe, -3 (SNMPTRAP) - Unknown owner - C: \ Windows \ System32 \ snmptrap.exe (file missing)
O23 - Service: @% systemroot% \ system32 \ spoolsv.exe, -1 (taustatulostuspalvelun) - Unknown owner - C: \ Windows \ System32 \ spoolsv.exe (file missing)
O23 - Service: @% SystemRoot% \ system32 \ ui0detect.exe, -101 (UI0Detect) - Unknown owner - C: \ Windows \ system32 \ UI0Detect.exe (file missing)
O23 - Service: @% SystemRoot% \ system32 \ vds.exe, -100 (VDS) - Unknown owner - C: \ Windows \ System32 \ vds.exe (file missing)
O23 - Service: @% systemroot% \ system32 \ vssvc.exe, -102 (VSS) - Unknown owner - C: \ Windows \ system32 \ vssvc.exe (file missing)
O23 - Service: @% systemroot% \ system32 \ wbem \ wmiapsrv.exe, -110 (wmiApSrv) - Unknown owner - C: \ Windows \ system32 \ wbem \ WmiApSrv.exe (file missing)
O23 - Service: @% ProgramFiles% \ Windows Media Player \ wmpnetwk.exe, -101 (WMPNetworkSvc) - Unknown owner - C: \ Program Files (x86) \ Windows Media Player \ wmpnetwk.exe (file missing)
O23 - Service: XAudioService - Unknown owner - C: \ Windows \ system32 \ DRIVERS \ xaudio64.exe (file missing)

--
End of file - 12962 bytes

**evilfantasy** · #2 2 heinäkuu 2009, 14:16

Napsauta hiiren oikealla painikkeella HijackThis ja valitse Suorita järjestelmänvalvojana

Seuraava valitse Tee järjestelmän tarkistus vain

Aseta valintamerkki vieressä seuraavista maininnoista: (jos on)

O2 - BHO: (no name) - (5C255C8A-E604-49b4-9D64-90988571CECB) - (no file)
O2 - BHO: NCO 2.0 IE BHO - (602ADB0E-4AFF-4217-8AA1-95DAC4DFA408) - (no file)
O3 - Toolbar: (no name) - (7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA) - (no file)

Tärkeää: Sulje kaikki avoimet ikkunat lukuun ottamatta HijackThis ja valitse sitten Korjaa tarkastetaan.

Valmistuessaan poistua HijackThis.

----------

Jos sinulla on jo Malwarebytes Muista päivittää sen ennen kuin käynnistät scan!

Ladata Malwarebytes' Anti-Malware (MBAM)

Alternate MBAM latauslinkki

Kaksoisnapsauta mbam-setup.exe ja seuraa ohjeita asentaaksesi ohjelman.
Lopussa, varmista, että yksi tarkistusmerkkiä on viereen seuraavasti:
- Päivitä Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Valitse sitten Maali.
Jos päivitys löytyy, se lataa ja asentaa uusimman version.
Kun ohjelma on ladattu, valitse Suorittaa Quick ScanValitse sitten Scan.
Kun skannaus on valmis, valitse OK, Sitten Näytä tulokset Voit tarkastella tuloksia.
Olla varma, että kaikki on valittu, ja napsauta Poista valitut.
Kun desinfiointi on valmis, loki avautuu Muistioon ja sinua saatetaan kehottaa uudelleen. (Katso Extra huomautus)
Loki on automaattisesti tallennetaan MBAM ja voi tarkastella napsauttamalla Lokit välilehti MBAM.
Kopioi ja liitä koko raportin seuraavan vastauksen.

Extra Huomautus: Jos MBAM kohtaa tiedoston, joka on vaikea poistaa, näytetään 1 2 kehotteita, OK joko ja anna MBAM edetä desinfiointiin prosessi, jos pyydetään käynnistämään tietokone uudelleen, tee niin välittömästi.

tidi · #3 12 heinäkuu 2009, 19:29

Olen pahoillani i kesti niin kauan post vastausta tässä on MBAM loki näyttää melko hyvältä minusta, kiitos paljon mies todella arvostaa sitä

Malwarebytes' Anti-Malware 1.38
Tietokannan versio: 2325
Windows 6.0.6001 Service Pack 1

12/07/2009 10:26:34 pm
mbam-log-2009-07-12 (22-26-34). txt

Scan type: Quick Scan
Objektit skannattavan: 74665
Kulunut aika: 2 minute (s), 52 toinen (t)

Memory Processes Infected: 0
Memory Modules Infected: 0
Rekisteriavaimista Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(Ei haittaohjelmia kohteet havaitaan)

Memory Modules Infected:
(Ei haittaohjelmia kohteet havaitaan)

Rekisteriavaimista Infected:
(Ei haittaohjelmia kohteet havaitaan)

Registry Values Infected:
(Ei haittaohjelmia kohteet havaitaan)

Registry Data Items Infected:
(Ei haittaohjelmia kohteet havaitaan)

Kansiot Infected:
(Ei haittaohjelmia kohteet havaitaan)

Files Infected:
(Ei haittaohjelmia kohteet havaitaan)