Tydning av min HijackThis-logg

4 december, 2004

Hallå!

Någon som skulle vilja hjälpa mig med min logg?

Vad kan jag ta bort och vad ska vara kvar?

Tack på förhand

Henrik

Logfile of HijackThis v1.97.7

Scan saved at 13:54:07, on 2004-12-04

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program\Delade filer\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\pavsrv.exe

C:\WINDOWS\System32\AVENGINE.EXE

C:\WINDOWS\System32\svchosting.exe

C:\Program\Panda Software\Panda Antivirus Titanium\APVXDWIN.EXE

C:\WINDOWS\System32\wuruclt.exe

C:\Program\Panda Software\Panda Antivirus Titanium\pavProxy.exe

C:\Program\Internet Explorer\iexplore.exe

C:\Documents and Settings\Ägare\Skrivbord\HijackThis.exe

C:\WINDOWS\System32\Sygate.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.se/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://qsv8.hpwis.com/'>http://qsv8.hpwis.com/'>http://qsv8.hpwis.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qsv8.hpwis.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,Shellnext = http://qsv8.hpwis.com/

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [APVXDWIN] "C:\Program\Panda Software\Panda Antivirus Titanium\APVXDWIN.EXE" /s

O4 - HKLM\..\Run: [*windows update] wuruclt.exe

O4 - HKLM\..\Run: [Win32 USB2 Driver] svchosting.exe

O4 - HKLM\..\RunServices: [Microsoft Windows Media Player] mediaplayer.exe

O4 - HKLM\..\RunServices: [Microsoft Windows Security] spvsper.exe

O4 - HKLM\..\RunServices: [sygate Personal Firewall] Sygate.exe

O4 - HKLM\..\RunServices: [*windows update] wuruclt.exe

O4 - HKLM\..\RunServices: [Win32 USB2 Driver] svchosting.exe

O4 - HKCU\..\Run: [Win32 USB2 Driver] svchosting.exe

O4 - HKCU\..\Run: [*windows update] wuruclt.exe

O4 - HKLM\..\RunOnce: [Win32 USB2 Driver] svchosting.exe

O4 - HKCU\..\RunOnce: [Win32 USB2 Driver] svchosting.exe

O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Referensinformation (HKLM)

O16 - DPF: {19E28AFC-EAE3-4CE5-AC83-2407B42F57C9} (MSSecurityAdvisor Class) - http://protect.microsoft.com/security/protect/wsa/shared/CAB/x86/msSecAdv.cab?1102020096500

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1101937180906

O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/x86/unicode/iuctl.CAB?38322.9459722222

O17 - HKLM\System\CCS\Services\Tcpip\..\{FE93DB70-774C-48CE-A39A-ED05D02E822F}: NameServer = 81.216.65.11,81.216.65.12

4 december, 2004

Avsluta dom här processer

C:\WINDOWS\System32\svchosting.exe

C:\WINDOWS\System32\wuruclt.exe

C:\WINDOWS\System32\Sygate.exe

Sen scanna datorn här och ta bort det som hittas

http://housecall.trendmicro.com/

Efter det starta om datorn och skicka en ny Hijack logg med denna versionen

http://koti.mbnet.fi/pattaya1/HijackThis.exe

Skapa en ny mapp på C:/ och placera HijackThis.exe dit så C:/HjT/HijackThis.exe

Sen scanna och skicka loggen .

4 december, 2004

Jag har gjort det du sa. Här är den nya loggen:

Logfile of HijackThis v1.98.2

Scan saved at 15:35:47, on 2004-12-04

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program\Panda Software\Panda Antivirus Titanium\APVXDWIN.EXE

C:\Program\Delade filer\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\pavsrv.exe

C:\WINDOWS\System32\AVENGINE.EXE

C:\Program\Panda Software\Panda Antivirus Titanium\pavProxy.exe

C:\WINDOWS\system32\cmd.exe

C:\WINDOWS\system32\ftp.exe

C:\WINDOWS\explorer.exe

C:\HjT\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qsv8.hpwis.com/'>http://qsv8.hpwis.com/'>http://qsv8.hpwis.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://qsv8.hpwis.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qsv8.hpwis.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [APVXDWIN] "C:\Program\Panda Software\Panda Antivirus Titanium\APVXDWIN.EXE" /s

O4 - HKLM\..\RunServices: [Microsoft Windows Media Player] mediaplayer.exe

O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~2\OFFICE11\REFIEBAR.DLL

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1101937180906

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{FE93DB70-774C-48CE-A39A-ED05D02E822F}: NameServer = 81.216.65.11,81.216.65.12

4 december, 2004

Hittade Housecall scanner något?

Scanna med Hijack bocka i följande rader stäng Web-läsaren och alla andra öppna fönster och klicka FIX checked

O4 - HKLM\..\RunServices: [Microsoft Windows Media Player] mediaplayer.exe

Starta om sen och skicka en ny Hijack logg.

4 december, 2004

Ok, här är nya loggen. Housecall hittade 21 st smittade filer som den fixade. Varför finns det så många svchost.exe?

Logfile of HijackThis v1.98.2

Scan saved at 17:24:57, on 2004-12-04

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program\Panda Software\Panda Antivirus Titanium\APVXDWIN.EXE

C:\WINDOWS\System32\lssrv.exe

C:\Program\Delade filer\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\pavsrv.exe

C:\WINDOWS\System32\AVENGINE.EXE

C:\Program\Panda Software\Panda Antivirus Titanium\pavProxy.exe

C:\HjT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.se'>http://www.google.se

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qsv8.hpwis.com/'>http://qsv8.hpwis.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.se

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://qsv8.hpwis.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [APVXDWIN] "C:\Program\Panda Software\Panda Antivirus Titanium\APVXDWIN.EXE" /s

O4 - HKLM\..\Run: [Microsoft Services] lssrv.exe

O4 - HKLM\..\RunServices: [Microsoft Services] lssrv.exe

O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~2\OFFICE11\REFIEBAR.DLL

O16 - DPF: ppctlcab - http://ppupdates.ca.com/downloads/scanner/ppctlcab.cab

O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://ppupdates.ca.com/downloads/scanner/axscanner.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1101937180906

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{FE93DB70-774C-48CE-A39A-ED05D02E822F}: NameServer = 81.216.65.11,81.216.65.12

4 december, 2004

Det är helt normalt att ha 4-5 svchost.exe

Men ny har du fått en ny mask WORM_RBOT.CW

Har du ingen brandvägg?

Sätt dolda filer synliga titta här hur man gör

http://www.xtra.co.nz/help/0,,4155-1916458,00.html

Scanna med Hijack bocka i följande rader stäng Web-läsaren och alla andra öppna fönster och klicka FIX checked

O4 - HKLM\..\Run: [Microsoft Services] lssrv.exe

O4 - HKLM\..\RunServices: [Microsoft Services] lssrv.exe

Starta sen i felsäkert läge sök och ta bort

lssrv.exe

Starta sen normalt och skicka en ny logg.

4 december, 2004

Ok. När jag körde HjT kom den här loggen upp. Jag har alltså fått tillbaka allt skit som jag tog bort! =P

Nej, jag har ingen brandvägg. Har alltid kört Panda Titanium och det har funkat bra. Men vilken brandvägg är den bästa då? Vilken borde stoppa det här så att det inte kommer tillbaka när jag tar bort det.

Logfile of HijackThis v1.98.2

Scan saved at 18:19:40, on 2004-12-04

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program\Panda Software\Panda Antivirus Titanium\APVXDWIN.EXE

C:\WINDOWS\System32\lssrv.exe

C:\Program\Delade filer\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\system32\pavsrv.exe

C:\WINDOWS\System32\AVENGINE.EXE

C:\Program\Panda Software\Panda Antivirus Titanium\pavProxy.exe

C:\WINDOWS\System32\winupated.exe

C:\WINDOWS\System32\svchosting.exe

C:\WINDOWS\System32\wuaurlt.exe

C:\WINDOWS\System32\scvhosting.exe

C:\WINDOWS\System32\spvsper.exe

C:\WINDOWS\system32\cmd.exe

C:\WINDOWS\System32\avhost.exe