Treg maskin. HJT logg vedlagt, trenger hjelp.

[JDS1236]

Har en bærbar PC som har begynt å gå usedvanlig tregt. Ved f.eks scan i Spy-bot brukes 100% CPU. Kjører ad-aware og spy-bot jevnlig.

 

Her er Hijackthis logg. Kan noen drevne ta en titt og gi noen tips?

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Programfiler\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programfiler\Alwil Software\Avast4\aswUpdSv.exe

C:\Programfiler\Alwil Software\Avast4\ashServ.exe

C:\Programfiler\WIDCOMM\Bluetooth-programvare\bin\btwdins.exe

C:\Programfiler\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe

C:\Programfiler\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Cyberlink\Shared files\RichVideo.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

C:\Programfiler\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe

C:\Programfiler\Alwil Software\Avast4\ashMaiSv.exe

C:\Programfiler\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Programfiler\Windows Defender\MSASCui.exe

C:\Programfiler\Launch Manager\LaunchAp.exe

C:\Programfiler\Launch Manager\HotkeyApp.exe

C:\Programfiler\Launch Manager\OSD.exe

C:\Programfiler\Launch Manager\Wbutton.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\Windows Media Player\WMPNSCFG.exe

C:\Programfiler\Messenger\msmsgs.exe

C:\Programfiler\Internet Explorer\iexplore.exe

C:\Documents and settings\Jan Derek\Skrivebord\newsLeecher.exe

C:\Documents and settings\Jan Derek\Skrivebord\newsLeecher.exe

D:\Programfiler\Hijackthis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://nettavisen.no/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programfiler\google\googletoolbar1.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programfiler\google\googletoolbar1.dll

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [Windows Defender] "C:\Programfiler\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [LaunchAp] "C:\Programfiler\Launch Manager\LaunchAp.exe"

O4 - HKLM\..\Run: [HotkeyApp] "C:\Programfiler\Launch Manager\HotkeyApp.exe"

O4 - HKLM\..\Run: [CtrlVol] "C:\Programfiler\Launch Manager\CtrlVol.exe"

O4 - HKLM\..\Run: [LMgrOSD] "C:\Programfiler\Launch Manager\OSD.exe"

O4 - HKLM\..\Run: [Wbutton] "C:\Programfiler\Launch Manager\Wbutton.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [WMPNSCFG] C:\Programfiler\Windows Media Player\WMPNSCFG.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Send til &Bluetooth - C:\Programfiler\WIDCOMM\Bluetooth-programvare\btsendto_ie_ctx.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programfiler\WIDCOMM\Bluetooth-programvare\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programfiler\WIDCOMM\Bluetooth-programvare\btsendto_ie.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O14 - IERESET.INF: START_PAGE_URL=http://www.c2i.net/

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase9602.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1129548264819

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {8F48147B-78D9-40F9-ACC0-BDDE59B246F4} (AccountHelper Class) - http://www.tele2mail.com/static/apps/utils/AccountHelper.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://mppv2flash3.valueactive.com/RoyalVegas/FlashAX.cab

O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab31267.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programfiler\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: avast! Antivirus - Unknown owner - C:\Programfiler\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programfiler\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Programfiler\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programfiler\WIDCOMM\Bluetooth-programvare\bin\btwdins.exe

O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Programfiler\Home Cinema\PowerCinema\Kernel\TV\CLCapSvc.exe

O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Programfiler\Home Cinema\PowerCinema\Kernel\TV\CLSched.exe

O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Programfiler\Home Cinema\PowerCinema\Kernel\CLML_NTService\CLMLServer.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Programfiler\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programfiler\iPod\bin\iPodService.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programfiler\Cyberlink\Shared files\RichVideo.exe

O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

[norbat]

Umiddelbart er det ikke noe i loggen som tilsier at det er noen infeksjoner, men HJT-loggen kan ikke vise alt.

 

Følg gjerne langversjonen i følgende post: https://www.diskusjon.no/index.php?showtopic=691246.

 

Nederst på siden under langversjonen står det noe om en rootkit-sjekk. Kjør den også.

 

Edit: Når du poster HJT-loggen, er det fint om du tar med de øverste linjene også - de om versjonnr. , windowsversjon etc.

 

Edit: Ser du har lagt den til under. Fint. Det er greit å få vite at man f.eks har SP2 m.m installert.

Endret 17. april 2007 av norbat

[JDS1236]

Her er det:

 

Logfile of HijackThis v1.99.1

Scan saved at 20:02:51, on 17.04.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16414)

[JDS1236]

SAS logg:

 

SUPERAntiSpyware Scan Log

Generated 04/17/2007 at 10:04 PM

 

Application Version : 3.6.1000

 

Core Rules Database Version : 3220

Trace Rules Database Version: 1230

 

Scan type : Complete Scan

Total Scan Time : 00:44:16

 

Memory items scanned : 465

Memory threats detected : 0

Registry items scanned : 5857

Registry threats detected : 0

File items scanned : 43498

File threats detected : 16

 

Adware.Tracking Cookie

C:\Documents and settings\Jan Derek\Cookies\[email protected][1].txt

C:\Documents and settings\Jan Derek\Cookies\[email protected][2].txt

C:\Documents and settings\Jan Derek\Cookies\jan_derek@imrworldwide[2].txt

C:\Documents and settings\Elisabeth\Cookies\[email protected][1].txt

C:\Documents and settings\Elisabeth\Cookies\elisabeth@netmediagroup[1].txt

C:\Documents and settings\Elisabeth\Cookies\elisabeth@windowsmedia[1].txt

C:\Documents and settings\Elisabeth\Cookies\[email protected][1].txt

C:\Documents and settings\Elisabeth\Cookies\[email protected][1].txt

C:\Documents and settings\Elisabeth\Cookies\[email protected][3].txt

C:\Documents and settings\Elisabeth\Cookies\[email protected][2].txt

C:\Documents and settings\Elisabeth\Cookies\elisabeth@xiti[1].txt

C:\Documents and settings\Kirsten Marie\Cookies\kirsten [email protected][2].txt

C:\Documents and settings\Kirsten Marie\Cookies\[email protected][2].txt

C:\Documents and settings\Kirsten Marie\Cookies\kirsten_marie@azjmp[2].txt

C:\Documents and settings\Kirsten Marie\Cookies\kirsten_marie@imrworldwide[1].txt

C:\Documents and settings\Kirsten Marie\Cookies\kirsten_marie@smileycentral[2].txt

 

 

Rootkit fant ingenting. Under SAS scan lå CPU bruk for SAS på nærmere 100%. Kan vel ikke være normalt?

Endret 17. april 2007 av JDS1236

[norbat]

Har du installert noe programvare i det siste og kan du huske om cpu-bruken økte i forbindelse med det?

 

Har du sjekket manuelt for oppdateringer til windows?

 

Du kan sjekke systemfilene (feil/mangler) ved å gjøre følgende:

 

Klikk: Start->Kjør

Skriv: sfc /scannow (mellomrom mellom sfc og / )

Du trenger XP cd'n.

 

Hvis du har brukt CCleaner (fra langversjonen), kan du også klikke på arkfanen 'Saker'. Klikk på 'Se etter feil' (e.l). Reparer de feilene som dukker opp. Du trenger ikke å ta backup når du blir spurt om det. Kjør 'Saker' flere ganger, helt til det ikke finnes flere feil.

 

Når du ikke kjører noen programmer, er pc'n da rimelig 'normal'? (Ingen prosesser som bruker særlig med cpu - det ser du i oppgavebehandlingen ->Prosesser)

Endret 17. april 2007 av norbat

[JDS1236]

PC'en er fin når jeg ikke kjører noen programmer, ja. Bruker av og til lang tid på å slå seg av. KJørte nå nettopp flere programmer samtidig, og la merke til at prosessen "ashserv.exe" brukte endel CPU. Hva er det for noe?

 

Har kjørt CCleaner flere ganger. Har ikke XP'CDen tilgjengelig...

[norbat]

ashserv.exe hører til Avast antivirus.

 

Har du sjekket for Windows-oppdateringer?

Hvis ikke, sjekk det.

 

Sjekk om pc'n trenger diskdefragmentering

 

Edit: Se om du kan få lånt deg en XP cd'n (samme versjon) som du kan bruke til sfc-scanningen.

Endret 18. april 2007 av norbat