HijackThis ja oudot tulokset

Shaqqi kirjoitti:

Koneeseen iski jonkin sortin virusaalto (liekö ihan lintuinfluenssaa? :P) ja meni hiukan sekaisin. Yhteensä muistaakseni kuusi erilaista troijalaista ja mato. Nyt v-torjuntaohjelma sanoo kaikki poistaneensa, HijackThisillä sain kuitenkin seuraavat tulokset:

Logfile of HijackThis v1.98.0
Scan saved at 15:30:57, on 20.3.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS.1\System32\smss.exe
C:\WINDOWS.1\system32\winlogon.exe
C:\WINDOWS.1\system32\services.exe
C:\WINDOWS.1\system32\lsass.exe
C:\WINDOWS.1\system32\svchost.exe
C:\WINDOWS.1\System32\svchost.exe
C:\WINDOWS.1\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\F-SECU~1\backweb\4476822\Program\SERVIC~1.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwsys.exe
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\F-Secure Internet Security\backweb\4476822\program\fsbwst.exe
C:\WINDOWS.1\system32\wuauclt.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\WINDOWS.1\system32\ctfmon.exe
C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
C:\WINDOWS.1\TEMP\IHTEMP\iuupd.exe
C:\WINDOWS.1\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HjT\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O1 - Hosts: 85.249.23.219 lloydstsb.co.uk
O1 - Hosts: 85.249.23.219 online.lloydstsb.co.uk
O1 - Hosts: 85.249.23.219 www.lloydstsb.co.uk
O1 - Hosts: 85.249.23.219 www.lloydstsb.com
O1 - Hosts: 85.249.23.219 www.lloydstsb.com
O1 - Hosts: 85.249.23.219 personal.barclays.co.uk
O1 - Hosts: 85.249.23.219 barclays.co.uk
O1 - Hosts: 85.249.23.219 ibank.barclays.co.uk
O1 - Hosts: 85.249.23.219 www.barclays.co.uk
O1 - Hosts: 85.249.23.219 www.nwolb.com
O1 - Hosts: 85.249.23.219 nwolb.com
O1 - Hosts: 85.249.23.219 hsbc.co.uk
O1 - Hosts: 85.249.23.219 www.hsbc.co.uk
O1 - Hosts: 85.249.23.219 abbey.com
O1 - Hosts: 85.249.23.219 www.abbey.com
O1 - Hosts: 85.249.23.219 www.abbey.co.uk
O1 - Hosts: 85.249.23.219 abbey.co.uk
O1 - Hosts: 85.249.23.219 cahoot.com
O1 - Hosts: 85.249.23.219 www.cahoot.com
O1 - Hosts: 85.249.23.219 www.cahoot.co.uk
O1 - Hosts: 85.249.23.219 cahoot.co.uk
O1 - Hosts: 85.249.23.219 www.co-operativebank.co.uk
O1 - Hosts: 85.249.23.219 co-operativebank.co.uk
O1 - Hosts: 85.249.23.219 www.co-operativebank.com
O1 - Hosts: 85.249.23.219 co-operativebank.com
O1 - Hosts: 85.249.23.219 welcome2.co-operativebankonline.co.uk
O1 - Hosts: 85.249.23.219 welcome6.co-operativebankonline.co.uk
O1 - Hosts: 85.249.23.219 welcome8.co-operativebankonline.co.uk
O1 - Hosts: 85.249.23.219 welcome10.co-operativebankonline.co.uk
O1 - Hosts: 85.249.23.219 www.smile.co.uk
O1 - Hosts: 85.249.23.219 smile.co.uk
O1 - Hosts: 85.249.23.219 www.cajamar.es
O1 - Hosts: 85.249.23.219 cajamar.es
O1 - Hosts: 85.249.23.219 www.cajamar.com
O1 - Hosts: 85.249.23.219 cajamar.com
O1 - Hosts: 85.249.23.219 www.unicaja.es
O1 - Hosts: 85.249.23.219 unicaja.es
O1 - Hosts: 85.249.23.219 www.unicaja.com
O1 - Hosts: 85.249.23.219 unicaja.com
O1 - Hosts: 85.249.23.219 www.caixagalicia.es
O1 - Hosts: 85.249.23.219 caixagalicia.es
O1 - Hosts: 85.249.23.219 www.caixagalicia.com
O1 - Hosts: 85.249.23.219 caixagalicia.com
O1 - Hosts: 85.249.23.219 activa.caixagalicia.es
O1 - Hosts: 85.249.23.219 www.caixapenedes.es
O1 - Hosts: 85.249.23.219 caixapenedes.es
O1 - Hosts: 85.249.23.219 www.caixapenedes.com
O1 - Hosts: 85.249.23.219 caixapenedes.com
O1 - Hosts: 85.249.23.219 bancae.caixapenedes.com
O1 - Hosts: 85.249.23.219 www.caixasabadell.es
O1 - Hosts: 85.249.23.219 caixasabadell.es
O1 - Hosts: 85.249.23.219 www.caixasabadell.net
O1 - Hosts: 85.249.23.219 caixasabadell.net
O1 - Hosts: 85.249.23.219 www.cajamadrid.es
O1 - Hosts: 85.249.23.219 cajamadrid.es
O1 - Hosts: 85.249.23.219 www.cajamadrid.com
O1 - Hosts: 85.249.23.219 cajamadrid.com
O1 - Hosts: 85.249.23.219 oi.cajamadrid.es
O1 - Hosts: 85.249.23.219 www.ccm.es
O1 - Hosts: 85.249.23.219 ccm.es
O1 - Hosts: 85.249.23.219 www.haspa.de
O1 - Hosts: 85.249.23.219 haspa.de
O1 - Hosts: 85.249.23.219 ssl2.haspa.de
O1 - Hosts: 85.249.23.219 www.dresdner-bank.de
O1 - Hosts: 85.249.23.219 dresdner-bank.de
O1 - Hosts: 85.249.23.219 www.dresdner-privat.de
O1 - Hosts: 85.249.23.219 postbank.de
O1 - Hosts: 85.249.23.219 www.postbank.de
O1 - Hosts: 85.249.23.219 banking.postbank.de
O1 - Hosts: 85.249.23.219 www.sparda-b.de
O1 - Hosts: 85.249.23.219 sparda-b.de
O1 - Hosts: 85.249.23.219 www.bankingonline.de
O1 - Hosts: 85.249.23.219 www.raiffeisenbank-erding.de
O1 - Hosts: 85.249.23.219 raiffeisenbank-erding.de
O1 - Hosts: 85.249.23.219 www.vr-networld-ebanking.de
O1 - Hosts: 85.249.23.219 vr-networld-ebanking.de
O1 - Hosts: 85.249.23.219 www.bnhof.de
O1 - Hosts: 85.249.23.219 bnhof.de
O1 - Hosts: 85.249.23.219 www.deutsche-bank.de
O1 - Hosts: 85.249.23.219 deutsche-bank.de
O1 - Hosts: 85.249.23.219 meine.deutsche-bank.de
O1 - Hosts: 85.249.23.219 www.citibank.de
O1 - Hosts: 85.249.23.219 citibank.de
O1 - Hosts: 85.249.23.219 www.dkb.de
O1 - Hosts: 85.249.23.219 dkb.de
O1 - Hosts: 85.249.23.219 www.sparkasse-regensburg.de
O1 - Hosts: 85.249.23.219 sparkasse-regensburg.de
O1 - Hosts: 85.249.23.219 www.berliner-bank.de
O1 - Hosts: 85.249.23.219 berliner-bank.de
O1 - Hosts: 85.249.23.219 www.berliner-sparkasse.de
O1 - Hosts: 85.249.23.219 berliner-sparkasse.de
O1 - Hosts: 85.249.23.219 www.wellsfargo.com
O1 - Hosts: 85.249.23.219 wellsfargo.com
O1 - Hosts: 85.249.23.219 www.bankofamerica.com
O1 - Hosts: 85.249.23.219 bankofamerica.com
O1 - Hosts: 85.249.23.219 www.usbank.com
O1 - Hosts: 85.249.23.219 usbank.com
O1 - Hosts: 85.249.23.219 www.bankone.com
O1 - Hosts: 85.249.23.219 bankone.com
O1 - Hosts: 85.249.23.219 www.citibank.com
O1 - Hosts: 85.249.23.219 citibank.com
O4 - HKLM\..\Run: [Windows Helper] C:\WINDOWS.1\system32\svchelper.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program Files\F-Secure Internet Security\FSGUI\FSSW.EXE" /reboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS.1\system32\ctfmon.exe
O4 - Global Startup: F-Secure 2006.lnk = C:\Program Files\F-Secure Internet Security\backweb\4476822\Program\fspex.exe
O8 - Extra context menu item: &Estä tämä kohoikkuna - C:\Program Files\F-Secure Internet Security\Anti-Spyware\blockpopups.htm
O9 - Extra button: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: (no name) - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra 'Tools' menuitem: Web-suodatin - {200DB664-75B5-47c0-8B45-A44ACCF73F01} - C:\Program Files\F-Secure Internet Security\FSPC\fspcmsie.dll
O9 - Extra button: IE-suojaus - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
O9 - Extra 'Tools' menuitem: IE-suojaus... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program Files\F-Secure Internet Security\Anti-Spyware\ieshield.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'winsflt.dll' missing
O16 - DPF: {94EB57FE-2720-496C-B33F-D9353C6E23F7} (F-Secure Online Scanner 2.1) - http://support.f-secure.com/ols/fscax.cab

Eli ihan rutosti vääriä hostin IP-osoitteita. (?) Koitin poistaa ne ohjelmalla -> tulivat takaisin, koitin myös ohjelman ehdottamaa Hosts-tiedoston poistoa -> tulivat takaisin. Mitenkä saisin ne poistettua? IE on pirun hidas ja Firéfox ei toimi ollenkaan.

kirjoitti:

Anonyymi

Kirjoita kommentti

5000

Lähetä