Trenger noen til å ta en titt på HJT logg

Anathema · 11. mars 2007

Kan noen se noen ugumberheter i denne?

Lyden min går til helvete rett som det er med en feilmelding om Svchost.. Lurer på om dette kan skyldes virus siden jeg har prøvd nesten alt annet for å fikse det.

Klikk for å se/fjerne innholdet nedenfor

Logfile of HijackThis v1.99.1

Scan saved at 1:33:53 AM, on 3/11/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\PROGRA~2\PC-CIL~1\PcCtlCom.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~2\PC-CIL~1\Tmntsrv.exe

C:\PROGRA~2\PC-CIL~1\TmPfw.exe

C:\Program Files\ASUS\ASUS DH Remote\AsRc.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\ASUS\ASUS DH Remote\AsDhRemote.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\LClock\LClock.exe

C:\Program Files\VisualTooltip\VisualToolTip.exe

C:\Program Files\Styler\Styler.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~2\PC-CIL~1\PcScnSrv.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\Steam\Steam.exe

C:\Program Files\ASUS WiFi-AP Solo\RtWLan.exe

C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe

C:\Program Files\Logitec\SetPoint\KEM.exe

C:\DOCUME~1\Joachim\LOCALS~1\Temp\{68AB8202-84CA-436E-A813-EFEA191C3B91}\Blaero Start Orb.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\PROGRA~2\PC-CIL~1\PccGuide.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\Program Files\Opera\Opera.exe

C:\Program Files\iTunes\iTunes.exe

C:\PROGRA~2\PC-CIL~1\tmproxy.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\HijackThis\HijackThis.exe

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll

O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot

O4 - HKLM\..\Run: [Ai Quicker Help] "C:\Program Files\ASUS\ASUS DH Remote\AsRc.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [pccguide.exe] "C:\Programmer\Pc-Cilling\pccguide.exe"

O4 - HKLM\..\Run: [system Files Updater] C:\WINDOWS\FlyakiteOSX\Tools\System Files Updater.exe /S

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe"

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe

O4 - HKLM\..\Run: [Vista Sidebar] C:\Program Files\Vista Sidebar\sidebar.exe

O4 - HKLM\..\Run: [VisualTooltip] C:\Program Files\VisualTooltip\VisualToolTip.exe

O4 - HKLM\..\Run: [blaero Start Orb] C:\Program Files\Blaero Start Orb\Blaero Start Orb.exe

O4 - HKLM\..\Run: [styler] C:\Program Files\Styler\Styler.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [OE] "C:\Programmer\Pc-Cilling\TMAS_OE\TMAS_OEMon.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [steam] "C:\Program Files\Steam\Steam.exe" -silent

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"

O4 - Global Startup: ASUS WiFi-AP Solo.lnk = ?

O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitec\SetPoint\KEM.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~2\PC-CIL~1\PcCtlCom.exe

O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~2\PC-CIL~1\PcScnSrv.exe

O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~2\PC-CIL~1\Tmntsrv.exe

O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~2\PC-CIL~1\TmPfw.exe

O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~2\PC-CIL~1\tmproxy.exe

norbat · 11. mars 2007

Hei,

Det er ingen ting i loggen som tyder på noen infeksjoner, men om du ikke har gjort det før, foreslår jeg en generell opprydding/scan:

Kjør HJT, sett merke framfor følgende linjer og klikk 'Fix checked':

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

Hent CCleaner. Start programmet. Gå til 'Valg'->'Avansert'. Fjern avkryssingen framfor: "bare slett midlertidige filer......." Klikk på 'Renser' og deretter 'Kjør CCleaner'.

Kjør også noen runder med 'Saker'.

Hent SAS, installer, oppdater og kjør en full (Complete) scan.

Hent Rootchk og legg det på skrivebordet. Kjør programmet. Det vil lage en loggfil.

Om loggene (rootchk og SAS:preferences->statistics/logs) viser noe, poster du disse sammen med en ny HJT-logg.

Endret 11. mars 2007 av norbat

Anathema · 11. mars 2007

Klikk for å se/fjerne innholdet nedenfor

********************************* ROOTCHK-(07-03-06)-LOG, by ejvindh

Sun 03/11/2007 13:27:30.86

The rootkits that are detected by this tool were not found.

********************************* ROOTCHK-LOG-end

Er hva Rootchk gir.. SAS fant ingen ting av bekymring. CC cleaner fjernet en hel del.

Ny HJT:

Klikk for å se/fjerne innholdet nedenfor

Logfile of HijackThis v1.99.1

Scan saved at 1:32:36 PM, on 3/11/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\PROGRA~2\PC-CIL~1\PcCtlCom.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~2\PC-CIL~1\Tmntsrv.exe

C:\PROGRA~2\PC-CIL~1\TmPfw.exe

C:\Program Files\ASUS\ASUS DH Remote\AsRc.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Java\jre1.5.0_10\bin\jusched.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\ASUS\ASUS DH Remote\AsDhRemote.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\LClock\LClock.exe

C:\Program Files\VisualTooltip\VisualToolTip.exe

C:\Program Files\Styler\Styler.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~2\PC-CIL~1\PcScnSrv.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\Steam\Steam.exe

C:\Program Files\ASUS WiFi-AP Solo\RtWLan.exe

C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe

C:\Program Files\Logitec\SetPoint\KEM.exe

C:\DOCUME~1\Joachim\LOCALS~1\Temp\{68AB8202-84CA-436E-A813-EFEA191C3B91}\Blaero Start Orb.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\PROGRA~2\PC-CIL~1\PccGuide.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\Program Files\iTunes\iTunes.exe

C:\PROGRA~2\PC-CIL~1\tmproxy.exe

C:\Program Files\uTorrent\utorrent.exe

C:\WINDOWS\system32\dwwin.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Opera\Opera.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe