Gå til innhold

Vanskelig virus og trojaner på dataen.

maheath

Av maheath
i IKT-drift og sikkerhet

Anbefalte innlegg

maheath

maheath

Skrevet
Skrevet (endret)

Hei, jeg skulle være tøff og lovet en venninne at å fjerne virus fra PCen - tenkte det var en smal sak. Snakk om å ta seg vann over hodet.... men må jo prøve.

 

Nå starter den ihvertfall. MEN:

 

- Kommer ikke på internett - prøver å lage ny forbindelse men ikke noe skjer

- Start-menyen og oppgavelinjen er vekke

- MBAM vil ikke starte - får error in vbalsgrid6.ocx så jeg kan ikke poste noe logg

- Avira vil ikke installere - den bare dør hen...

- DRWEB kjørte faktisk full scan, fant masse med Win32.Virut og dropper.agent.MJS eller noe som ligner ihvertfall

- Task manager kjører heldigvis så jeg kan kjøre ting derfra (Fil -> kjør)

- Og windows explorer kjører via windows-tast + E

- AVG ser ut til å kjøre, den finner bare karantener fra DRWEB

- Command prompt virker visst også, skal prøve å kjøre en sfc /scannow

- Får ikke kopiert ting fra minnepinnen så jeg kjører alt derfra. (Men etter DRWEB har PCen heldigvis sluttet å legge ut viruset som autostart der hver gang jeg plugger den inn.... )

 

Hvis det er tomt for virus - hvordan får jeg start-menyen og nett tilbake? Fant ikke noe tdssserv.sys i enhetsbehandling heller...

Edit: Kom på i natt at det var SP3 på den PCen, så jeg skal prøve å laste den ned og installere senere i dag. Kjørte jo repair windows med en SP2-CD for å få den til å starte i det hele tatt...

 

Combofix kjører og hijackthis kjører så jeg kan få noen logger:

 

 

Combofix:

Klikk for å se/fjerne innholdet nedenfor
ComboFix 09-06-04.04 - Karianne 04.06.2009 23:08.1 - NTFSx86

Kjører fra: E:\ComboFix.exe

 

ADVARSEL -DENNE MASKINEN HAR IKKE GJENOPPRETTINGSKONSOLLEN INSTALLERT !!

.

 

((((((((((((((((((((((((((((((((((((((( Andre slettinger )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\documents and settings\Thomas\Programdata\.#

c:\windows\system32\drivers\ucjjawqj.sys

c:\windows\system32\uniq.tll

 

.

((((((((((((((((((((((((((((((((((((((( Drivere/Tjenester )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Legacy_ASHEVTSVC

-------\Legacy_AVAST!ANTIVIRUS

-------\Legacy_BOONTY_GAMES

-------\Legacy_PROTECT

-------\Legacy_RESTORE

-------\Legacy_TERMSERVICEBROWSER

-------\Service_Boonty Games

-------\Service_protect

-------\Service_restore

-------\Service_TermServiceBrowser

 

 

((((((((((((((((((((((((((( Filer Opprettet Fra 2009-05-04 til 2009-06-04 )))))))))))))))))))))))))))))))))

.

 

2009-06-04 20:20 . 2009-05-26 11:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-06-04 20:20 . 2009-06-04 20:21 -------- d-----w- c:\programfiler\Malwarebytes' Anti-Malware

2009-06-04 20:20 . 2009-05-26 11:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-06-04 20:02 . 2009-06-04 20:02 117760 ----a-w- c:\documents and settings\Administrator.HJEMME\Programdata\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL

2009-06-04 20:02 . 2009-06-04 20:02 -------- d-----w- c:\documents and settings\Administrator.HJEMME\Programdata\SUPERAntiSpyware.com

2009-06-04 20:01 . 2009-06-04 20:01 -------- d--h--r- c:\documents and settings\Administrator.HJEMME\Siste

2009-06-04 18:33 . 2009-06-04 18:37 -------- d-----w- c:\documents and settings\Administrator.HJEMME\DoctorWeb

2009-06-04 17:40 . 2009-06-04 17:40 -------- d-----w- c:\documents and settings\Karianne\DoctorWeb

2009-06-04 17:38 . 2009-06-04 21:00 -------- d--h--r- c:\documents and settings\Karianne\Siste

2009-06-04 17:36 . 2009-06-04 17:36 -------- d-----w- c:\programfiler\CCleaner

2009-06-04 17:07 . 2009-06-04 21:15 117760 ----a-w- c:\documents and settings\Karianne\Programdata\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL

2009-06-04 17:07 . 2009-06-04 17:07 -------- d-----w- c:\documents and settings\Karianne\Programdata\SUPERAntiSpyware.com

2009-06-04 17:07 . 2009-06-04 17:07 -------- d-----w- c:\documents and settings\All Users\Programdata\SUPERAntiSpyware.com

2009-05-28 06:29 . 2009-05-28 06:29 32 --s-a-w- c:\windows\system32\1534863899.dat

2009-05-28 05:46 . 2009-05-28 05:46 -------- d-----w- c:\documents and settings\Administrator.HJEMME\Lokale innstillinger\Programdata\Identities

2009-05-28 05:27 . 2009-05-28 05:27 -------- d-----w- c:\documents and settings\Administrator.HJEMME\Programdata\Malwarebytes

2009-05-27 20:54 . 2009-05-27 20:54 -------- d-----w- c:\documents and settings\Karianne\Programdata\Malwarebytes

2009-05-27 20:22 . 2009-05-27 20:22 -------- d-----w- c:\documents and settings\Thomas\Programdata\Malwarebytes

2009-05-27 20:22 . 2009-05-27 20:22 -------- d-----w- c:\documents and settings\All Users\Programdata\Malwarebytes

2009-05-27 18:45 . 2009-05-27 18:45 -------- d-----w- c:\documents and settings\Thomas\Programdata\eejmgfka

2009-05-27 18:45 . 2009-05-27 18:45 -------- d-----w- c:\documents and settings\Thomas\Lokale innstillinger\Programdata\eejmgfka

2009-05-27 12:46 . 2009-05-27 12:46 -------- d-----w- c:\documents and settings\Karianne\Programdata\eejmgfka

2009-05-27 12:46 . 2009-05-27 12:46 -------- d-----w- c:\documents and settings\Karianne\Lokale innstillinger\Programdata\eejmgfka

2009-05-26 17:13 . 2009-05-26 17:13 -------- d-----w- c:\documents and settings\Karianne\Lokale innstillinger\Programdata\Identities

2009-05-26 13:37 . 2009-05-27 12:29 348 --s-a-w- c:\windows\system32\495665359.dat

2009-05-25 20:41 . 2004-08-04 12:00 41600 -c--a-w- c:\windows\system32\dllcache\weitekp9.dll

2009-05-25 20:41 . 2004-08-04 12:00 31360 -c--a-w- c:\windows\system32\dllcache\weitekp9.sys

2009-05-25 20:41 . 2004-08-04 12:00 48256 -c--a-w- c:\windows\system32\dllcache\w32.dll

2009-05-25 20:41 . 2004-08-04 12:00 86073 -c--a-w- c:\windows\system32\dllcache\voicesub.dll

2009-05-25 20:41 . 2004-08-04 12:00 426041 -c--a-w- c:\windows\system32\dllcache\voicepad.dll

2009-05-25 20:41 . 2004-08-04 12:00 76288 -c--a-w- c:\windows\system32\dllcache\uniime.dll

2009-05-25 20:39 . 2004-08-04 12:00 92416 -c--a-w- c:\windows\system32\dllcache\mga.sys

2009-05-25 20:38 . 2004-08-04 12:00 54528 -c--a-w- c:\windows\system32\dllcache\cap7146.sys

2009-05-25 20:03 . 2004-08-04 12:00 24661 -c--a-w- c:\windows\system32\dllcache\spxcoins.dll

2009-05-25 20:03 . 2004-08-04 12:00 24661 ----a-w- c:\windows\system32\spxcoins.dll

2009-05-25 20:03 . 2004-08-04 12:00 13312 -c--a-w- c:\windows\system32\dllcache\irclass.dll

2009-05-25 20:03 . 2004-08-04 12:00 13312 ----a-w- c:\windows\system32\irclass.dll

2009-05-21 16:32 . 2009-05-21 16:32 -------- d-----w- c:\documents and settings\Administrator.HJEMME\Lokale innstillinger\Programdata\Opera

2009-05-21 16:31 . 2009-05-21 16:31 71392 ----a-w- c:\documents and settings\Administrator.HJEMME\Lokale innstillinger\Programdata\GDIPFONTCACHEV1.DAT

2009-05-21 14:32 . 2009-05-21 14:32 -------- d-----w- c:\documents and settings\Administrator.HJEMME\Tracing

2009-05-21 07:56 . 2009-05-21 07:56 -------- d-----w- C:\program Files

2009-05-20 15:10 . 2009-05-28 05:41 -------- d-----w- c:\documents and settings\Administrator.HJEMME\Favoritter

2009-05-20 15:10 . 2009-05-26 12:34 -------- d-----w- c:\documents and settings\Administrator.HJEMME\Skrivebord

2009-05-20 15:09 . 2009-06-04 20:01 -------- d-----w- c:\documents and settings\Administrator.HJEMME

2009-05-19 17:07 . 2009-05-08 07:12 2051864 ----a-w- c:\documents and settings\All Users\Programdata\avg8\update\backup\avgcorex.dll

2009-05-19 17:07 . 2009-05-08 07:12 2302232 ----a-w- c:\documents and settings\All Users\Programdata\avg8\update\backup\avguiadv.dll

2009-05-19 17:07 . 2009-05-08 07:12 3399960 ----a-w- c:\documents and settings\All Users\Programdata\avg8\update\backup\avgui.exe

2009-05-19 17:07 . 2009-05-08 07:12 3288344 ----a-w- c:\documents and settings\All Users\Programdata\avg8\update\backup\setup.exe

2009-05-19 17:07 . 2009-05-08 07:12 354584 ----a-w- c:\documents and settings\All Users\Programdata\avg8\update\backup\avgxch32.dll

2009-05-19 17:07 . 2009-05-08 07:12 424472 ----a-w- c:\documents and settings\All Users\Programdata\avg8\update\backup\avgwdwsc.dll

2009-05-19 17:07 . 2009-05-08 07:12 312088 ----a-w- c:\documents and settings\All Users\Programdata\avg8\update\backup\avglngx.dll

2009-05-19 17:07 . 2009-05-08 07:12 177432 ----a-w- c:\documents and settings\All Users\Programdata\avg8\update\backup\avgmail.dll

2009-05-19 17:07 . 2009-05-08 07:12 486168 ----a-w- c:\documents and settings\All Users\Programdata\avg8\update\backup\avgrsx.exe

2009-05-19 17:06 . 2009-05-08 07:12 755992 ----a-w- c:\documents and settings\All Users\Programdata\avg8\update\backup\avginet.dll

2009-05-19 17:06 . 2009-05-08 07:12 1437464 ----a-w- c:\documents and settings\All Users\Programdata\avg8\update\backup\avgupd.dll

2009-05-19 17:01 . 2009-05-19 17:01 -------- d-----w- c:\windows\system32\wbem\Repository

2009-05-19 16:58 . 2009-05-19 16:59 -------- d-s---w- c:\documents and settings\Administrator

2009-05-19 16:58 . 2009-05-19 16:59 -------- d-----w- c:\documents and settings\Administrator\Lokale innstillinger

2009-05-19 16:58 . 2009-05-19 16:59 -------- d-----w- c:\documents and settings\Administrator\Programdata

2009-05-19 16:58 . 2009-05-19 16:59 -------- d-----w- c:\documents and settings\Administrator\Maler

2009-05-19 16:58 . 2009-05-19 16:59 -------- d-----w- c:\documents and settings\Administrator\Lokale innstillinger\Programdata\Microsoft

2009-05-19 05:36 . 2009-05-19 05:36 -------- d-----w- c:\windows\system32\config\systemprofile\Lokale innstillinger\Programdata\Conduit

2009-05-19 05:36 . 2009-05-20 05:34 -------- d-----w- c:\windows\system32\config\systemprofile\Lokale innstillinger\Programdata\iWin

2009-05-19 05:36 . 2009-05-19 16:59 -------- d-----w- c:\windows\system32\config\systemprofile\Lokale innstillinger\Programdata\Google

2009-05-11 18:03 . 2009-05-11 18:03 488960 ----a-w- c:\documents and settings\Thomas\Programdata\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\pmv302-0811070-0-main.dll

2009-05-11 18:03 . 2009-06-04 19:16 320000 ----a-w- c:\documents and settings\Thomas\Programdata\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-06-04 20:41 . 2009-01-09 19:34 1324 ----a-w- c:\windows\system32\d3d9caps.dat

2009-06-04 19:43 . 2009-01-09 19:07 150528 ----a-w- c:\windows\pchealth\UploadLB\Binaries\uploadm.exe

2009-06-04 19:43 . 2009-01-09 19:09 35328 ----a-w- c:\windows\pchealth\helpctr\binaries\notiflag.exe

2009-06-04 19:43 . 2009-01-09 19:07 18944 ----a-w- c:\windows\pchealth\helpctr\binaries\hscupd.exe

2009-06-04 19:43 . 2009-01-09 19:07 158208 ----a-w- c:\windows\pchealth\helpctr\binaries\msconfig.exe

2009-06-04 19:43 . 2009-01-09 19:09 99840 ----a-w- c:\windows\pchealth\helpctr\binaries\helphost.exe

2009-06-04 19:43 . 2009-01-09 19:07 768512 ----a-w- c:\windows\pchealth\helpctr\binaries\helpctr.exe

2009-06-04 19:43 . 2009-01-09 19:07 743936 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe

2009-06-04 19:16 . 2009-03-05 21:44 73728 ----a-w- c:\documents and settings\Thomas\Programdata\LimeWire\browser\xulrunner\xulrunner-stub.exe

2009-06-04 19:16 . 2009-03-05 21:44 102400 ----a-w- c:\documents and settings\Thomas\Programdata\LimeWire\browser\xulrunner\xulrunner.exe

2009-06-04 19:16 . 2009-03-05 21:44 266240 ----a-w- c:\documents and settings\Thomas\Programdata\LimeWire\browser\xulrunner\xpidl.exe

2009-06-04 19:16 . 2009-03-05 21:44 18944 ----a-w- c:\documents and settings\Thomas\Programdata\LimeWire\browser\xulrunner\xpt_dump.exe

2009-06-04 19:16 . 2009-03-05 21:44 14336 ----a-w- c:\documents and settings\Thomas\Programdata\LimeWire\browser\xulrunner\xpt_link.exe

2009-06-04 19:16 . 2009-03-05 21:44 77824 ----a-w- c:\documents and settings\Thomas\Programdata\LimeWire\browser\xulrunner\xpicleanup.exe

2009-06-04 19:16 . 2009-03-05 21:44 196608 ----a-w- c:\documents and settings\Thomas\Programdata\LimeWire\browser\xulrunner\updater.exe

2009-06-04 19:16 . 2009-03-05 21:44 14848 ----a-w- c:\documents and settings\Thomas\Programdata\LimeWire\browser\xulrunner\xpcshell.exe

2009-06-04 19:16 . 2009-03-05 21:44 163840 ----a-w- c:\documents and settings\Thomas\Programdata\LimeWire\browser\xulrunner\crashreporter.exe

2009-06-04 19:02 . 2009-05-26 20:31 73728 ----a-w- c:\documents and settings\Karianne\Programdata\LimeWire\browser\xulrunner\xulrunner-stub.exe

2009-06-04 19:02 . 2009-05-26 20:31 102400 ----a-w- c:\documents and settings\Karianne\Programdata\LimeWire\browser\xulrunner\xulrunner.exe

2009-06-04 19:02 . 2009-05-26 20:31 14336 ----a-w- c:\documents and settings\Karianne\Programdata\LimeWire\browser\xulrunner\xpt_link.exe

2009-06-04 19:02 . 2009-05-26 20:31 77824 ----a-w- c:\documents and settings\Karianne\Programdata\LimeWire\browser\xulrunner\xpicleanup.exe

2009-06-04 19:02 . 2009-05-26 20:31 266240 ----a-w- c:\documents and settings\Karianne\Programdata\LimeWire\browser\xulrunner\xpidl.exe

2009-06-04 19:02 . 2009-05-26 20:31 196608 ----a-w- c:\documents and settings\Karianne\Programdata\LimeWire\browser\xulrunner\updater.exe

2009-06-04 19:02 . 2009-05-26 20:31 18944 ----a-w- c:\documents and settings\Karianne\Programdata\LimeWire\browser\xulrunner\xpt_dump.exe

2009-06-04 19:02 . 2009-05-26 20:31 14848 ----a-w- c:\documents and settings\Karianne\Programdata\LimeWire\browser\xulrunner\xpcshell.exe

2009-06-04 19:02 . 2009-05-26 20:31 163840 ----a-w- c:\documents and settings\Karianne\Programdata\LimeWire\browser\xulrunner\crashreporter.exe

2009-06-04 18:58 . 2009-03-01 14:44 135168 ----a-w- c:\documents and settings\All Users\Programdata\PlayFirst\Games\PlayFirst.EXE

2009-06-04 18:41 . 2009-01-09 19:05 218112 ----a-w- c:\windows\system32\wbem\wmiprvse.exe

2009-06-04 18:41 . 2009-01-09 19:05 196608 ----a-w- c:\windows\system32\wbem\wmiadap.exe

2009-06-04 18:41 . 2009-01-09 19:05 117248 ----a-w- c:\windows\system32\wbem\wbemtest.exe

2009-06-04 18:41 . 2009-01-09 19:06 16896 ----a-w- c:\windows\system32\wbem\unsecapp.exe

2009-06-04 18:41 . 2009-01-09 19:05 36864 ----a-w- c:\windows\system32\wbem\scrcons.exe

2009-06-04 18:41 . 2009-01-09 19:05 16896 ----a-w- c:\windows\system32\wbem\mofcomp.exe

2009-06-04 18:37 . 2008-04-14 16:23 32768 ----a-w- c:\windows\system32\setupn.exe

2009-06-04 18:36 . 2009-01-09 19:05 123392 ----a-w- c:\windows\system32\mplay32.exe

2009-06-04 18:35 . 2004-08-04 12:00 8704 ----a-w- c:\windows\system32\eventvwr.exe

2009-06-04 18:34 . 2004-08-04 12:00 408576 ----a-w- c:\windows\system32\cmd.exe

2009-06-04 17:45 . 2004-08-04 12:00 71680 ----a-w- c:\windows\system32\blastcln.exe

2009-06-04 17:45 . 2004-08-04 12:00 14336 ----a-w- c:\windows\system32\auditusr.exe

2009-06-04 17:45 . 2004-08-04 12:00 11264 ----a-w- c:\windows\system32\attrib.exe

2009-06-04 17:45 . 2004-08-04 12:00 11264 ----a-w- c:\windows\system32\atmadm.exe

2009-06-04 17:45 . 2004-08-04 12:00 24576 ----a-w- c:\windows\system32\at.exe

2009-06-04 17:45 . 2004-08-04 12:00 19456 ----a-w- c:\windows\system32\arp.exe

2009-06-04 17:45 . 2004-08-04 12:00 98304 ----a-w- c:\windows\system32\ahui.exe

2009-06-04 17:45 . 2004-08-04 12:00 4096 ----a-w- c:\windows\system32\actmovie.exe

2009-06-04 17:45 . 2009-01-09 19:05 185344 ----a-w- c:\windows\system32\accwiz.exe

2009-06-04 17:44 . 2009-01-09 19:05 126464 ----a-w- c:\windows\system32\wbem\wmiapsrv.exe

2009-06-04 17:44 . 2009-01-09 19:06 13312 ----a-w- c:\windows\system32\wbem\winmgmt.exe

2009-06-04 17:44 . 2004-08-04 12:00 290304 ----a-w- c:\windows\system32\vssvc.exe

2009-06-04 17:44 . 2004-08-04 12:00 24576 ----a-w- c:\windows\system32\userinit.exe

2009-06-04 17:44 . 2004-08-04 12:00 18432 ----a-w- c:\windows\system32\ups.exe

2009-06-04 17:44 . 2004-08-04 12:00 157184 ----a-w- c:\windows\system32\taskmgr.exe

2009-06-04 17:44 . 2004-08-04 12:00 57856 ----a-w- c:\windows\system32\spoolsv.exe

2009-06-04 17:44 . 2004-08-04 12:00 90112 ----a-w- c:\windows\system32\smlogsvc.exe

2009-06-04 17:44 . 2004-08-04 12:00 42496 ----a-w- c:\windows\system32\shmgrate.exe

2009-06-04 17:44 . 2009-01-09 19:05 140288 ----a-w- c:\windows\system32\sessmgr.exe

2009-06-04 17:42 . 2004-08-04 12:00 44544 ----a-w- c:\windows\system32\alg.exe

2009-06-04 17:42 . 2009-01-09 19:24 77824 ----a-w- c:\windows\SOUNDMAN.EXE

2009-06-04 17:42 . 2004-08-04 12:00 1052672 ----a-w- c:\windows\explorer.exe

2009-05-28 06:39 . 2009-01-09 20:24 -------- d-----w- c:\documents and settings\All Users\Programdata\avg8

2009-05-28 06:29 . 2009-05-28 06:29 0 ----a-w- c:\windows\system32\6.tmp

2009-05-28 04:44 . 2004-08-04 12:00 67646 ----a-w- c:\windows\system32\perfc014.dat

2009-05-28 04:44 . 2004-08-04 12:00 399790 ----a-w- c:\windows\system32\perfh014.dat

2009-05-27 20:04 . 2009-05-27 20:04 120 ----a-w- c:\windows\system32\3B.tmp

2009-05-27 19:50 . 2009-02-23 14:18 -------- d-----w- c:\documents and settings\All Users\Programdata\Google Updater

2009-05-27 19:17 . 2009-05-27 19:17 120 ----a-w- c:\windows\system32\38.tmp

2009-05-27 18:42 . 2009-05-27 18:41 120 ----a-w- c:\windows\system32\37.tmp

2009-05-27 15:50 . 2009-05-27 15:50 0 ----a-w- c:\windows\system32\35.tmp

2009-05-27 15:50 . 2009-05-27 15:50 124 ----a-w- c:\windows\system32\33.tmp

2009-05-27 15:47 . 2009-05-27 15:47 0 ----a-w- c:\windows\system32\32.tmp

2009-05-27 15:47 . 2009-05-27 15:47 124 ----a-w- c:\windows\system32\2F.tmp

2009-05-27 12:32 . 2009-05-27 12:32 84 ----a-w- c:\windows\system32\2B.tmp

2009-05-27 05:15 . 2009-05-27 05:15 84 ----a-w- c:\windows\system32\28.tmp

2009-05-26 20:34 . 2009-05-26 20:31 -------- d-----w- c:\documents and settings\Karianne\Programdata\LimeWire

2009-05-26 18:20 . 2009-03-14 14:01 1 ----a-w- c:\documents and settings\Karianne\Programdata\OpenOffice.org\3\user\uno_packages\cache\stamp.sys

2009-05-26 17:16 . 2009-05-26 17:16 84 ----a-w- c:\windows\system32\25.tmp

2009-05-26 13:44 . 2009-05-26 13:44 0 ----a-w- c:\windows\system32\1E.tmp

2009-05-26 13:44 . 2009-05-26 13:44 0 ----a-w- c:\windows\system32\1B.tmp

2009-05-26 13:44 . 2009-05-26 13:44 124 ----a-w- c:\windows\system32\14.tmp

2009-05-26 13:44 . 2009-05-26 13:44 124 ----a-w- c:\windows\system32\12.tmp

2009-05-26 13:37 . 2009-05-26 13:37 0 ----a-w- c:\windows\system32\A6.tmp

2009-05-26 13:37 . 2009-05-26 13:37 124 ----a-w- c:\windows\system32\A5.tmp

2009-05-26 05:10 . 2009-05-26 05:10 120 ----a-w- c:\windows\system32\23.tmp

2009-05-26 05:10 . 2009-05-26 05:10 120 ----a-w- c:\windows\system32\19.tmp

2009-05-25 21:02 . 2004-08-04 12:00 212480 ----a-w- c:\windows\system32\drivers\ndis.sys

2009-05-25 21:00 . 2009-05-25 21:00 120 ----a-w- c:\windows\system32\16.tmp

2009-05-25 21:00 . 2009-05-25 21:00 120 ----a-w- c:\windows\system32\11.tmp

2009-05-25 20:35 . 2009-01-09 19:07 22796 ----a-w- c:\windows\system32\emptyregdb.dat

2009-05-21 13:25 . 2009-05-21 13:25 120 ----a-w- c:\windows\system32\36.tmp

2009-05-21 10:57 . 2009-05-21 10:57 164 ----a-w- c:\windows\system32\2A.tmp

2009-05-20 15:10 . 2009-05-20 15:10 84 ----a-w- c:\windows\system32\39.tmp

2009-05-20 15:10 . 2009-01-22 19:54 -------- d-----w- c:\programfiler\Lexmark 6200 Series

2009-05-20 11:09 . 2009-05-20 11:09 84 ----a-w- c:\windows\system32\10.tmp

2009-05-20 05:33 . 2009-01-22 20:23 -------- d-----w- c:\programfiler\QuickTime

2009-05-19 14:46 . 2009-05-19 14:46 0 ----a-w- c:\windows\system32\1A.tmp

2009-05-19 14:46 . 2009-05-19 14:46 192 ----a-w- c:\windows\system32\18.tmp

2009-05-18 19:56 . 2009-01-22 20:33 -------- d-----w- c:\documents and settings\Thomas\Programdata\LimeWire

2009-05-15 20:33 . 2009-01-26 15:27 1 ----a-w- c:\documents and settings\Thomas\Programdata\OpenOffice.org\3\user\uno_packages\cache\stamp.sys

2009-05-11 19:34 . 2009-01-22 19:55 -------- d-----w- c:\programfiler\Lx_cats

2009-05-08 07:12 . 2009-01-09 20:25 11952 ----a-w- c:\windows\system32\avgrsstx.dll

.

 

------- Sigcheck -------

 

[-] 2004-08-04 12:00 577024 BAB45056164CD9585E5E673A0DE78931 c:\windows\system32\user32.dll

[-] 2004-08-04 12:00 577024 BAB45056164CD9585E5E673A0DE78931 c:\windows\system32\dllcache\user32.dll

 

[-] 2004-08-04 12:00 82944 B169D7467910A23FACB7EE0D557ABB92 c:\windows\system32\ws2_32.dll

[-] 2004-08-04 12:00 82944 B169D7467910A23FACB7EE0D557ABB92 c:\windows\system32\dllcache\ws2_32.dll

 

[-] 2008-08-26 09:12 827904 98C80E9B356C50645C31B9F607543649 c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\wininet.dll

[-] 2008-10-16 01:06 666624 447E194390349284C2613274025C361D c:\windows\$hf_mig$\KB958215\SP3QFE\wininet.dll

[-] 2008-10-16 19:50 827904 8B0B339A2F3572C82331D84A2348DF8D c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll

[-] 2008-12-20 23:49 827904 484F946C80FB38855F59E13D676F36E4 c:\windows\$hf_mig$\KB961260-IE7\SP2QFE\wininet.dll

[-] 2009-03-03 00:17 828416 784F219A9692B09710CFE91A9F5E4C3D c:\windows\$hf_mig$\KB963027-IE7\SP3QFE\wininet.dll

[-] 2008-10-16 01:02 665600 DE9FB3FB88F5AEA5FC6D7F1DB11413A7 c:\windows\ie7\wininet.dll

[-] 2007-08-13 17:54 818688 A4A0FC92358F39538A6494C42EF99FE9 c:\windows\ie7updates\KB956390-IE7\wininet.dll

[-] 2008-08-26 08:30 826368 C1AD172CE43D33D3DAFE6F297E9D3C50 c:\windows\ie7updates\KB958215-IE7\wininet.dll

[-] 2008-10-16 20:33 826368 D5C68D18F2EC4C5F7425F8FF1C1607C2 c:\windows\ie7updates\KB961260-IE7\wininet.dll

[-] 2008-12-20 23:03 826368 57B6EA4018F6706462DCE6898C88E754 c:\windows\ie7updates\KB963027-IE7\wininet.dll

[-] 2008-08-26 08:30 826368 C1AD172CE43D33D3DAFE6F297E9D3C50 c:\windows\SoftwareDistribution\Download\32cdf8def2b341bd6ff320b7af8cbb7d\SP2GDR\wininet.dll

[-] 2008-08-26 09:12 827904 98C80E9B356C50645C31B9F607543649 c:\windows\SoftwareDistribution\Download\32cdf8def2b341bd6ff320b7af8cbb7d\SP2QFE\wininet.dll

[-] 2008-10-16 20:33 826368 D5C68D18F2EC4C5F7425F8FF1C1607C2 c:\windows\SoftwareDistribution\Download\b2d3e471d162afd9fa71ebdccacb7349\SP2GDR\wininet.dll

[-] 2008-10-16 19:50 827904 8B0B339A2F3572C82331D84A2348DF8D c:\windows\SoftwareDistribution\Download\b2d3e471d162afd9fa71ebdccacb7349\SP2QFE\wininet.dll

[-] 2004-08-04 12:00 655872 10F493204EBE9EAAD8664819E97C36CF c:\windows\system32\wininet.dll

[-] 2004-08-04 12:00 655872 10F493204EBE9EAAD8664819E97C36CF c:\windows\system32\dllcache\wininet.dll

 

[-] 2008-06-20 11:59 361600 AD978A1B783B5719720CFF204B666C8E c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys

[-] 2004-08-04 12:00 359040 1745B00FC1141404B28F4B94F69A8871 c:\windows\system32\dllcache\tcpip.sys

[-] 2004-08-04 12:00 359040 1745B00FC1141404B28F4B94F69A8871 c:\windows\system32\drivers\tcpip.sys

 

[-] 2004-08-04 12:00 501248 765B39061CA16D01ABFEA752C5E2DB8F c:\windows\system32\winlogon.exe

[-] 2009-06-04 18:40 501248 7EB1DF8095971A4AEA6527BC9E104A17 c:\windows\system32\dllcache\winlogon.exe

 

[-] 2009-05-25 21:02 212480 !HASH: COULD NOT OPEN FILE ! c:\windows\system32\dllcache\ndis.sys

[-] 2009-05-25 21:02 212480 A31311DE5E03811C79E0ADA584EE5ABB c:\windows\system32\drivers\ndis.sys

 

[-] 2004-08-04 12:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\system32\dllcache\ip6fw.sys

[-] 2004-08-04 12:00 29056 4448006B6BC60E6C027932CFC38D6855 c:\windows\system32\drivers\ip6fw.sys

 

[-] 2009-02-09 11:20 2067968 03BCDF3E7CC50EAA4DF9FFDC4CC178D3 c:\windows\$hf_mig$\KB956572\SP3QFE\ntkrnlpa.exe

[-] 2008-08-14 18:28 2067840 9FB08D3EAC41E7CDF0C1F5AD39F8E691 c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe

[-] 2004-08-04 12:00 2058624 3940FDFE93612E32B924930FA6CBDC48 c:\windows\system32\ntkrnlpa.exe

 

[-] 2009-02-10 17:19 2190976 0A00211A1F0AD77AAF57997E296836FA c:\windows\$hf_mig$\KB956572\SP3QFE\ntoskrnl.exe

[-] 2008-08-14 18:28 2190976 CCCEACCDF603068FB5FEA158356D1EC8 c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe

[-] 2004-08-04 12:00 2182784 C6AB83A76CB28D82E800FF4D2D975034 c:\windows\system32\ntoskrnl.exe

 

[-] 2009-06-04 17:42 1052672 1817E7643DF8F9FD113E5531D07407A7 c:\windows\explorer.exe

 

[-] 2009-06-04 19:38 111104 B0912DCA19BB096C05DDC0125FC3712B c:\windows\$hf_mig$\KB956572\SP3QFE\services.exe

[-] 2004-08-04 12:00 108544 B44F7F43D33E308D07BA54C23B897E20 c:\windows\system32\services.exe

[-] 2009-06-04 18:40 108544 9E39F0A11738BA3B0D3F01FA2AE97485 c:\windows\system32\dllcache\services.exe

 

[-] 2004-08-04 12:00 13312 8235198CDB70AAEB3C1435C1911641F9 c:\windows\system32\lsass.exe

[-] 2009-06-04 18:39 13312 3E63A104B9DB37C024E402D836B2B40A c:\windows\system32\dllcache\lsass.exe

 

[-] 2009-06-04 17:43 35840 4ADBF84A0E64183037A554237963475B c:\windows\system32\ctfmon.exe

[-] 2009-06-04 18:39 15360 55A4755CCD184A9F3D74AC4DD56C09E7 c:\windows\system32\dllcache\ctfmon.exe

 

[-] 2009-06-04 17:44 57856 896EDB63F1F72D8A991E0CD9AB8E785C c:\windows\system32\spoolsv.exe

[-] 2009-06-04 18:40 57856 37717DA956769EAFA12D1E0CF3BEA5AA c:\windows\system32\dllcache\spoolsv.exe

 

[-] 2009-06-04 18:38 111616 B294605F92D4B94FC3B6FEE80286741C c:\windows\system32\wuauclt.exe

 

[-] 2009-06-04 17:44 24576 D750D311148D30AB659BC0C6A5DCFBF8 c:\windows\system32\userinit.exe

[-] 2009-06-04 18:40 24576 501C885BD3DD9078FF89A6A7B99197AD c:\windows\system32\dllcache\userinit.exe

 

[-] 2004-08-04 12:00 294912 CDFDE4AC03BF56BF5B383C4F849D34E5 c:\windows\system32\termsrv.dll

[-] 2004-08-04 12:00 294912 CDFDE4AC03BF56BF5B383C4F849D34E5 c:\windows\system32\dllcache\termsrv.dll

 

[-] 2009-03-21 14:04 992768 9DB523045B2ED048E8EDE9776165B124 c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll

[-] 2004-08-04 12:00 984576 50FEF76905F65824A58073E663140617 c:\windows\system32\kernel32.dll

[-] 2004-08-04 12:00 984576 50FEF76905F65824A58073E663140617 c:\windows\system32\dllcache\kernel32.dll

 

[-] 2004-08-04 12:00 17408 24097802A77BE4C2CE1DF928211AE806 c:\windows\system32\powrprof.dll

[-] 2004-08-04 12:00 17408 24097802A77BE4C2CE1DF928211AE806 c:\windows\system32\dllcache\powrprof.dll

 

[-] 2004-08-04 12:00 110080 E68CFF083BEC05A7E716E00FF437A330 c:\windows\system32\imm32.dll

[-] 2004-08-04 12:00 110080 E68CFF083BEC05A7E716E00FF437A330 c:\windows\system32\dllcache\imm32.dll

 

[-] 2004-08-04 12:00 1550336 8793627B38B74DB31D3DE0EE2D2A2E87 c:\windows\system32\sfcfiles.dll

[-] 2004-08-04 12:00 1550336 8793627B38B74DB31D3DE0EE2D2A2E87 c:\windows\system32\dllcache\sfcfiles.dll

.

(((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret )))))))))))))))))))))))))))))))))))))))))))))

.

.

*Merk* tomme oppføringer & gyldige standardoppføringer vises ikke

REGEDIT4

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2F735F5B-74D2-4165-AF22-1EC35D008874}]

2004-08-04 12:00 103424 ----a-w- c:\windows\system32\fzigfhy.dll

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2009-06-04 35840]

"swg"="c:\programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-22 39408]

"SUPERAntiSpyware"="e:\superantispyware\SUPERANTISPYWARE.EXE" [2009-06-04 1826816]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-25 13680640]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-08 1947928]

"SunJavaUpdateSched"="c:\programfiler\Java\jre6\bin\jusched.exe" [2009-01-22 136600]

"Adobe Reader Speed Launcher"="c:\programfiler\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"iTunesHelper"="c:\programfiler\iTunes\iTunesHelper.exe" [2009-04-02 342312]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-25 86016]

"LXBUCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\LXBUtime.dll" [2004-11-02 69632]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-12-25 1657376]

"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2009-06-04 77824]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2009-06-04 35840]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-05-08 07:12 11952 ----a-w- c:\windows\system32\avgrsstx.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cfdffwme]

2004-08-04 12:00 103424 ----a-w- c:\windows\system32\fzigfhy.dll

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]

@="Driver"

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"FirewallOverride"=dword:00000001

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Programfiler\\AVG\\AVG8\\avgemc.exe"=

"c:\\Programfiler\\AVG\\AVG8\\avgupd.exe"=

"c:\\Programfiler\\LimeWire\\LimeWire.exe"=

"c:\\Programfiler\\iWin Games\\iWinGames.exe"=

"c:\\Programfiler\\iWin Games\\WebUpdater.exe"=

"c:\\Programfiler\\Java\\jre6\\bin\\java.exe"=

"c:\\Programfiler\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Programfiler\\Microsoft Games\\Rise of Nations\\rise.exe"=

"c:\\Programfiler\\Bonjour\\mDNSResponder.exe"=

"c:\\Programfiler\\iTunes\\iTunes.exe"=

 

R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-05-08 908568]

R3 USBAAPL;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl.sys [2009-03-26 36864]

S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-05-08 325896]

S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-05-08 108552]

S1 SASDIFSV;SASDIFSV;e:\superantispyware\SASDIFSV.SYS [2009-03-27 9968]

S1 SASKUTIL;SASKUTIL;e:\superantispyware\SASKUTIL.sys [2008-11-06 55024]

S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-05-08 298776]

S2 iWinTrusted;iWinTrusted;c:\programfiler\iWin Games\iWinTrusted.exe [2008-12-17 78104]

S3 SASENUM;SASENUM;e:\superantispyware\SASENUM.SYS [2008-11-06 7408]

 

 

--- Andre tjenester/drivere lastet i minnet ---

 

*Deregistered* - AFD

*Deregistered* - Apple Mobile Device

*Deregistered* - Arp1394

*Deregistered* - atapi

*Deregistered* - audstub

*Deregistered* - avg8wd

*Deregistered* - AvgLdx86

*Deregistered* - AvgMfx86

*Deregistered* - AvgTdiX

*Deregistered* - Beep

*Deregistered* - Bonjour Service

*Deregistered* - Cdfs

*Deregistered* - Fastfat

*Deregistered* - Fips

*Deregistered* - FltMgr

*Deregistered* - Ftdisk

*Deregistered* - Gpc

*Deregistered* - IpNat

*Deregistered* - IPSec

*Deregistered* - iWinTrusted

*Deregistered* - JavaQuickStarterService

*Deregistered* - KSecDD

*Deregistered* - mnmdd

*Deregistered* - Mouclass

*Deregistered* - MountMgr

*Deregistered* - MRxDAV

*Deregistered* - MRxSmb

*Deregistered* - Msfs

*Deregistered* - mssmbios

*Deregistered* - Mup

*Deregistered* - NDIS

*Deregistered* - NdisTapi

*Deregistered* - Ndisuio

*Deregistered* - NdisWan

*Deregistered* - NDProxy

*Deregistered* - NetBIOS

*Deregistered* - NetBT

*Deregistered* - Npfs

*Deregistered* - Ntfs

*Deregistered* - Null

*Deregistered* - NVSvc

*Deregistered* - PartMgr

*Deregistered* - ParVdm

*Deregistered* - PCIIde

*Deregistered* - PptpMiniport

*Deregistered* - PSched

*Deregistered* - RasAcd

*Deregistered* - Rasl2tp

*Deregistered* - RasPppoe

*Deregistered* - Raspti

*Deregistered* - Rdbss

*Deregistered* - RDPCDD

*Deregistered* - SASDIFSV

*Deregistered* - SASENUM

*Deregistered* - SASKUTIL

*Deregistered* - sr

*Deregistered* - swenum

*Deregistered* - Tcpip

*Deregistered* - TermDD

*Deregistered* - Update

*Deregistered* - VgaSave

*Deregistered* - VolSnap

*Deregistered* - Wanarp

*Deregistered* - WudfPf

*Deregistered* - X4HSX32

 

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

gezgjsny

.

Innholdet i mappen 'Scheduled Tasks' (planlagte oppgaver)

 

2009-05-16 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\programfiler\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

 

2009-05-28 c:\windows\Tasks\Google Software Updater.job

- c:\programfiler\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-01-22 04:26]

.

- - - - TOMME PEKERE FJERNET - - - -

 

HKLM-Run-EasyTuneV - c:\programfiler\Gigabyte\ET5\GUI.exe

HKLM-Run-lxbumon.exe - c:\programfiler\Lexmark 6200 Series\lxbumon.exe

HKLM-Run-EzPrint - c:\programfiler\Lexmark 6200 Series\ezprint.exe

HKLM-Run-QuickTime Task - c:\programfiler\QuickTime\qttask.exe

HKU-Default-Run-svc - c:\program files\ThunMail\testabd.exe

Notify-jwjrtrw - jwjrtrw32.dll

 

 

.

------- Tilleggsskanning -------

.

uStart Page = hxxp://www.sol.no/

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\programfiler\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

.

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-06-04 23:15

Windows 5.1.2600 Service Pack 2 NTFS

 

skanner skjulte prosesser ...

 

skanner skjulte autostart-oppføringer ...

 

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

LXBUCATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

 

skanner skjulte filer ...

 

skanning vellykket

skjulte filer: 0

 

**************************************************************************

.

------------------------ Andre Kjørende Prosesser ------------------------

.

c:\programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\programfiler\Bonjour\mDNSResponder.exe

c:\programfiler\Java\jre6\bin\jqs.exe

c:\windows\system32\nvsvc32.exe

c:\programfiler\AVG\AVG8\avgrsx.exe

c:\progra~1\AVG\AVG8\avgnsx.exe

c:\windows\system32\rundll32.exe

.

**************************************************************************

.

Tidspunkt ferdig: 2009-06-04 23:17 - maskinen ble startet på nytt

ComboFix-quarantined-files.txt 2009-06-04 21:17

 

Pre-Run: 228 831 588 352 byte ledig

Post-Run: 229 282 758 656 byte ledig

 

429 --- E O F --- 2009-05-14 01:02

 

 

 

Hijackthis:

Klikk for å se/fjerne innholdet nedenfor
Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:03:43, on 04.06.2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Programfiler\iWin Games\iWinTrusted.exe

C:\Programfiler\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\Programfiler\AVG\AVG8\avgrsx.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\Programfiler\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\taskmgr.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\ctfmon.exe

E:\HiJT.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sol.no/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: (no name) - {2F735F5B-74D2-4165-AF22-1EC35D008874} - c:\windows\system32\fzigfhy.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programfiler\AVG\AVG8\avgssie.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre6\bin\ssv.dll

O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programfiler\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programfiler\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Programfiler\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O2 - BHO: iWin Toolbar - {ce0c2586-da36-452b-acdb-320d9bcb19bf} - C:\Programfiler\iWin\tbiWi0.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programfiler\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programfiler\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Programfiler\AskSBar\bar\1.bin\ASKSBAR.DLL

O3 - Toolbar: iWin Toolbar - {ce0c2586-da36-452b-acdb-320d9bcb19bf} - C:\Programfiler\iWin\tbiWi0.dll

O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Programfiler\AskSBar\bar\1.bin\ASKSBAR.DLL

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programfiler\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [EasyTuneV] C:\Programfiler\Gigabyte\ET5\GUI.exe

O4 - HKLM\..\Run: [lxbumon.exe] "C:\Programfiler\Lexmark 6200 Series\lxbumon.exe"

O4 - HKLM\..\Run: [EzPrint] "C:\Programfiler\Lexmark 6200 Series\ezprint.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Programfiler\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programfiler\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Programfiler\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [services] C:\WINDOWS\services.exe

O4 - HKLM\..\Run: [LXBUCATS] rundll32 C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\LXBUtime.dll,_RunDLLEntry@16

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] E:\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

O4 - HKUS\S-1-5-21-1078081533-2025429265-725345543-1004\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User '?')

O4 - HKUS\S-1-5-21-1078081533-2025429265-725345543-1004\..\Run: [swg] C:\Programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User '?')

O4 - HKUS\S-1-5-21-1078081533-2025429265-725345543-1004\..\Run: [sUPERAntiSpyware] E:\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (User '?')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - S-1-5-21-1078081533-2025429265-725345543-1004 Startup: OpenOffice.org 3.0.lnk = C:\Programfiler\OpenOffice.org 3\program\quickstart.exe (User '?')

O4 - Startup: OpenOffice.org 3.0.lnk = C:\Programfiler\OpenOffice.org 3\program\quickstart.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo.../sysreqlab3.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1231533220781

O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownlo...iaSmartScan.cab

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/jre...ows-i586-jc.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programfiler\AVG\AVG8\avgpp.dll

O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Programfiler\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O20 - Winlogon Notify: cfdffwme - C:\WINDOWS\SYSTEM32\fzigfhy.dll

O20 - Winlogon Notify: jwjrtrw - jwjrtrw32.dll (file missing)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Application Management (AppMgmt) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Windows Audio (AudioSrv) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Programfiler\Bonjour\mDNSResponder.exe

O23 - Service: Boonty Games - BOONTY - C:\Programfiler\Fellesfiler\BOONTY Shared\Service\Boonty.exe

O23 - Service: Computer Browser (Browser) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Cryptographic Services (CryptSvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: DCOM Server Process Launcher (DcomLaunch) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: DHCP Client (Dhcp) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Logical Disk Manager (dmserver) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: DNS Client (Dnscache) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Wired AutoConfig (Dot3svc) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Tjenesten Extensible Authentication Protocol (EapHost) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Error Reporting Service (ERSvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: COM+-hendelsessystem (EventSystem) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Fast User Switching Compatibility (FastUserSwitchingCompatibility) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Google Software Updater (gusvc) - Google - C:\Programfiler\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Help and Support (helpsvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Human Interface Device Access (HidServ) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Health Key and Certificate Management Service (hkmsvc) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Programfiler\iPod\bin\iPodService.exe

O23 - Service: iWinTrusted - iWin Inc. - C:\Programfiler\iWin Games\iWinTrusted.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programfiler\Java\jre6\bin\jqs.exe

O23 - Service: Server (lanmanserver) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Workstation (lanmanworkstation) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: TCP/IP NetBIOS Helper (LmHosts) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: lxbu_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxbucoms.exe

O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe

O23 - Service: Agent for beskyttelse av nettverkstilgang (napagent) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Network Connections (Netman) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Network Location Awareness (NLA) (Nla) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Removable Storage (NtmsSvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Remote Access Auto Connection Manager (RasAuto) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Remote Access Connection Manager (RasMan) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Remote Procedure Call (RPC) (RpcSs) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Secondary Logon (seclogon) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: System Event Notification (SENS) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Shell Hardware Detection (ShellHWDetection) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: System Restore Service (srservice) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: SSDP Discovery Service (SSDPSRV) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Windows Image Acquisition (WIA) (stisvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Telephony (TapiSrv) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Terminal Services (TermService) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Terminal Services TermServiceBrowser (TermServiceBrowser) - Unknown owner - C:\WINDOWS\system32\5.tmp.exe (file missing)

O23 - Service: Themes - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Distributed Link Tracking Client (TrkWks) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Universal Plug and Play Device Host (upnphost) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Windows Time (W32Time) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: WebClient - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Windows Management Instrumentation (winmgmt) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Tjenesten Portable Media Serial Number (WmdmPmSN) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Windows Driver Foundation - User-mode Driver Framework (WudfSvc) - Unknown owner - C:\WINDOWS\system32\svchost.exe (file missing)

O23 - Service: Wireless Zero Configuration (WZCSVC) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

O23 - Service: Network Provisioning Service (xmlprov) - Unknown owner - C:\WINDOWS\System32\svchost.exe (file missing)

 

--

End of file - 14233 bytes

 

Endret av maheath
Lenke til kommentar

Videoannonse

Videoannonse
Annonse
norbat

norbat

Skrevet
Skrevet

Det er lov å være tøff. Problemet er at du/vedkommende er infisert med Virut (ting kan også tyde på en Conficer-infeksjon). Dette er noe av det verste man kan få og sannsynligheten for at denne infeksjonen ikke lar seg rense er stor. Om man skulle få renset, så er sjansen for at mange sitter igjen med korrupte systemfiler og ubrukelige program også stor. Mitt råd er derfor å kjøre en reinstallering av windows (ikke repair).

Lenke til kommentar
maheath

maheath

Skrevet
  • Forfatter
Skrevet

Takk for svar. :)

 

Joda er enig der, men jeg tar det som en utfordring og reinstallerer til sist hvis jeg ikke er helt sikker. :) Går det an å se av nye logger om det er helt rent eller ikke? Tar selvsagt rådet ditt og installerer på nytt hvis det er noe som helst tvil.

 

Fikk kopiert inn svchost.exe fra en annen PC, den var slettet. Da kom nettet tilbake og alt ser normalt ut. Avira ble installert og fant litt rester i system restore katalogene. Så installerte jeg XP SP3 og PCen virker nå OK.. skal kjøre en full MBAM og se også. Noe annet?

Lenke til kommentar
snippsat

snippsat

Skrevet
Skrevet (endret)

Det ser ikke så ille ut nå.

Kan du kjøre dr.web som dette.

Denne vriut infeksjonen vil vi være sikker på at er helt borte.

Er som sakt noe av det værre som som finnes der ute.

 

Last ned DrWeb og legg det på skrivebordet.

 

Restart i Sikker modus (trykkk flere gange på F8 under oppstart)

Ikke adminstrator men normal.

 

Kjør drweb-cureit.exe (si ja til å kjøre en express scan)

Når dette er ferdig klikker du på Option -> Change settings.

Under fanearket Scan, fjerner du haken ved Heuristic analysis.

Under fanearket Actions, skal alle punkt under Malware settes til Rename.

Velg partisjon du vil scanne og klikk deretter på den grønne pilen for

å starte scanningen. Velg "yes to all" når det finner noe for første gang.

 

Når scanningen er ferdig, gå til "file" – Trykk på- "Save Report list".

En fil med navn "drweb.csv" vil da ligge på skrivebordet. Den poster du senere

Endret av SNIPPSAT
Lenke til kommentar

Opprett en konto eller logg inn for å kommentere

Du må være et medlem for å kunne skrive en kommentar

Opprett konto

Det er enkelt å melde seg inn for å starte en ny konto!

Start en konto

Logg inn

Har du allerede en konto? Logg inn her.

Logg inn nå
Gå til emneliste

  • Hvem er aktive   0 medlemmer

    • Ingen innloggede medlemmer aktive
×
×
  • Opprett ny...