Gå til innhold

Fått trojansk hest via msn


Anbefalte innlegg

Skrevet

Hei godt folk!!!!

 

Jeg er lite kjent i dataverdenen. men nå fikk jeg en trojansk hest av msn-virus link. desverre. Har en HP 6735b om det er nyttig informasjon. Tusen takk til alle som vil hjelpe meg ut av knipen! :-(

 

mvh,

Videoannonse
Annonse
Skrevet

Hei godt folk!!!!

 

Jeg er lite kjent i dataverdenen. men nå fikk jeg en trojansk hest av msn-virus link. desverre. Har en HP 6735b om det er nyttig informasjon. Tusen takk til alle som vil hjelpe meg ut av knipen! :-(

 

mvh,

 

jeg trykket på en eller annen link om .gif eller noe ...

Scan type: Manual Scan

Event: Security Risk Found!

Risk: W32.Pilleuz

File: C:\RECYCLER\S-1-5-21-5783377503-6114429389-014534049-4156\yv8g67.exe

Location: C:\RECYCLER\S-1-5-21-5783377503-6114429389-014534049-4156

Computer: H-BB-HENKLI1

User: UNETT\henkli1

Action taken: Cleaned by Deletion

Date found: 7. mars 2010 21:55:58

 

Jeg får mange nå. sliter noe sykt. jeg lastet ned den linken/programmet du sendte iste, men det kom en eller annen error. ellers aner jeg ikke hva jeg skal gjøre nå

Skrevet

Skal ikke være noe problem det? Sikker på at du har gjort det riktig?

 

Da filtrerer viruset websider og blokkerer de den ikke liker :)

Skrevet

DDS (Ver_09-12-01.01) - NTFSx86

Run by at 22:56:48,71 on 07.03.2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.3.1252.47.1044.18.2813.1364 [GMT 1:00]

 

AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

 

============== Running Processes ===============

 

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Programfiler\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\Ati2evxx.exe

C:\Programfiler\WIDCOMM\Bluetooth Software\bin\btwdins.exe

svchost.exe

svchost.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

C:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\WINDOWS\system32\agrsmsvc.exe

C:\Programfiler\Symantec AntiVirus\DefWatch.exe

C:\Programfiler\Fellesfiler\InterVideo\RegMgr\iviRegMgr.exe

C:\Programfiler\Java\jre6\bin\jqs.exe

C:\Programfiler\Fellesfiler\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Programfiler\Symantec AntiVirus\SavRoam.exe

C:\Programfiler\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Programfiler\Symantec AntiVirus\Rtvscan.exe

C:\Programfiler\UPHClean\uphclean.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\Programfiler\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe

C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe

C:\PROGRA~1\SYMANT~1\VPTray.exe

C:\Programfiler\Hewlett-Packard\Shared\hpqwmiex.exe

C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe

C:\Programfiler\Java\jre6\bin\jusched.exe

C:\Programfiler\Windows Defender\MSASCui.exe

C:\Programfiler\Analog Devices\Core\smax4pnp.exe

C:\Programfiler\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe

C:\Programfiler\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Programfiler\Windows Live\Messenger\msnmsgr.exe

C:\Programfiler\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Programfiler\Skype\Phone\Skype.exe

C:\Programfiler\LimeWire\LimeWire.exe

C:\Programfiler\Skype\Plugin Manager\skypePM.exe

C:\Programfiler\Windows Live\Contacts\wlcomm.exe

C:\Programfiler\Spotify\Spotify.exe

C:\Programfiler\Symantec AntiVirus\vpc32.exe

C:\Programfiler\Internet Explorer\IEXPLORE.EXE

C:\Programfiler\Internet Explorer\IEXPLORE.EXE

C:\Programfiler\Skype\Toolbars\Shared\SkypeNames.exe

C:\Programfiler\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\explorer.exe

C:\Programfiler\Internet Explorer\IEXPLORE.EXE

C:\Programfiler\Internet Explorer\IEXPLORE.EXE

C:\Programfiler\Hewlett-Packard\Shared\hpqToaster.exe

C:\Documents and Settings\LocalService\Skrivebord\dds.scr

 

============== Pseudo HJT Report ===============

 

uStart Page = hxxp://www.skoleportalen.no/

uDefault_Page_URL = hxxp://lav.hfk.no

uURLSearchHooks: Free Lunch Design Toolbar: {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - c:\programfiler\free_lunch_design\tbFre1.dll

uWinlogon: Shell=c:\documents and settings\henkli1\programdata\ufxw.exe,explorer.exe,c:\recycler\s-1-5-21-5783377503-6114429389-014534049-4156\yv8g67.exe

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\programfiler\fellesfiler\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\programfiler\skype\toolbars\internet explorer\SkypeIEPlugin.dll

BHO: Free Lunch Design Toolbar: {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - c:\programfiler\free_lunch_design\tbFre1.dll

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\programfiler\microsoft\search enhancement pack\search helper\SearchHelper.dll

BHO: Påloggingshjelp for Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\programfiler\fellesfiler\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\programfiler\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\programfiler\google\googletoolbarnotifier\5.5.4723.1820\swg.dll

BHO: LimeWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\programfiler\ask.com\GenericAskToolbar.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\programfiler\java\jre6\bin\jp2ssv.dll

BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\programfiler\windows live\toolbar\wltcore.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\programfiler\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: Search Assistant: {f0626a63-410b-45e2-99a1-3f2475b2d695} - c:\programfiler\sgpsa\BHO.dll

BHO: Fast Browser Search Toolbar Helper: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\programfiler\fast browser search\ie\FBStoolbar.dll

TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\programfiler\windows live\toolbar\wltcore.dll

TB: Free Lunch Design Toolbar: {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - c:\programfiler\free_lunch_design\tbFre1.dll

TB: Fast Browser Search Toolbar: {1bb22d38-a411-4b13-a746-c2a4f4ec7344} - c:\programfiler\fast browser search\ie\FBStoolbar.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\programfiler\google\google toolbar\GoogleToolbar_32.dll

TB: LimeWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\programfiler\ask.com\GenericAskToolbar.dll

uRun: [msnmsgr] "c:\programfiler\windows live\messenger\msnmsgr.exe" /background

uRun: [skype] "c:\programfiler\skype\phone\Skype.exe" /nosplash /minimized

uRun: [swg] "c:\programfiler\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [yukkgww] c:\windows\system32\g9c1yjfaa6.exe

uRun: [riiduu] c:\windows\system32\2dyy6kk.exe

uRun: [AROReminder]

mRun: [soundMAX] c:\programfiler\analog devices\soundmax\Smax4.exe /tray

mRun: [QlbCtrl.exe] c:\programfiler\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start

mRun: [synTPEnh] c:\programfiler\synaptics\syntp\SynTPEnh.exe

mRun: [WatchDog] c:\programfiler\intervideo\dvd check\DVDCheck.exe

mRun: [ccApp] "c:\programfiler\fellesfiler\symantec shared\ccApp.exe"

mRun: [vptray] c:\progra~1\symant~1\VPTray.exe

mRun: [Adobe Reader Speed Launcher] "c:\programfiler\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [QuickTime Task] "c:\programfiler\quicktime\qttask.exe" -atboottime

mRun: [TkBellExe] "c:\programfiler\fellesfiler\real\update_ob\realsched.exe" -osboot

mRun: [sunJavaUpdateSched] "c:\programfiler\java\jre6\bin\jusched.exe"

mRun: [Windows Defender] "c:\programfiler\windows defender\MSASCui.exe" -hide

mRun: [soundMAXPnP] c:\programfiler\analog devices\core\smax4pnp.exe

mRun: [startCCC] "c:\programfiler\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun

mRun: [sGPUpdater] c:\programfiler\search guard plusu\sgpUpdaters.exe

mRun: [FBSearch] c:\programfiler\search guard plus\SearchGuardPlus.exe

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

dRun: [DWQueuedReporting] "c:\progra~1\felles~1\micros~1\dw\dwtrig20.exe" -t

StartupFolder: c:\docume~1\alluse~1\start-~1\progra~1\oppstart\dvdche~1.lnk - c:\programfiler\intervideo\dvd check\DVDCheck.exe

IE: E&ksporter til Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

IE: Google Sidewiki - c:\programfiler\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

IE: {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - c:\microgaming\poker\ladbrokesmpp\MPPoker.exe

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\programfiler\widcomm\bluetooth software\btsendto_ie.htm

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\programfiler\messenger\msmsgs.exe

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\programfiler\windows live\writer\WriterBrowserExtension.dll

IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\programfiler\skype\toolbars\internet explorer\SkypeIEPlugin.dll

IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\programfiler\skype\toolbars\internet explorer\SkypeIEPlugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/E/3/9/E39C664F-A8E3-4F69-A109-1AE9849204EE/OGAControl.cab

DPF: {15B782AF-55D8-11D1-B477-006097098764} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/authorware/awswaxd.cab

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1235482515796

DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} - hxxp://office.microsoft.com/officeupdate/content/opuc4.cab

DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\felles~1\skype\SKYPE4~1.DLL

Notify: AtiExtEvent - Ati2evxx.dll

Notify: NavLogon - c:\windows\system32\NavLogon.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

 

================= FIREFOX ===================

 

FF - ProfilePath -

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

 

---- FIREFOX POLICIES ----

c:\programfiler\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\programfiler\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".no");

 

============= SERVICES / DRIVERS ===============

 

R0 ahcix86;ahcix86;c:\windows\system32\drivers\ahcix86.sys [2009-2-24 174600]

R0 Amddfltr;Amd Disk Lower Filter Driver;c:\windows\system32\drivers\Amddfltr.sys [2009-2-24 15416]

R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [2008-3-28 24064]

R1 SAVRT;SAVRT;c:\programfiler\symantec antivirus\savrt.sys [2008-5-28 337280]

R1 SAVRTPEL;SAVRTPEL;c:\programfiler\symantec antivirus\Savrtpel.sys [2008-5-28 54656]

R2 ccEvtMgr;Symantec Event Manager;c:\programfiler\fellesfiler\symantec shared\ccEvtMgr.exe [2008-6-24 191848]

R2 ccSetMgr;Symantec Settings Manager;c:\programfiler\fellesfiler\symantec shared\ccSetMgr.exe [2008-6-24 169320]

R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-8-25 54752]

R2 SavRoam;SAVRoam;c:\programfiler\symantec antivirus\SavRoam.exe [2008-9-30 116664]

R2 Symantec AntiVirus;Symantec AntiVirus;c:\programfiler\symantec antivirus\Rtvscan.exe [2008-9-30 1956792]

R2 WinDefend;Windows Defender;c:\programfiler\windows defender\MsMpEng.exe [2006-11-3 13592]

R3 Com4QLBEx;Com4QLBEx;c:\programfiler\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2009-2-24 222512]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\programfiler\fellesfiler\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-8-28 102448]

R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2008-7-23 44800]

R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [2008-1-14 21632]

R3 NAVENG;NAVENG;c:\progra~1\felles~1\symant~1\virusd~1\20100307.007\naveng.sys [2010-3-7 84912]

R3 NAVEX15;NAVEX15;c:\progra~1\felles~1\symant~1\virusd~1\20100307.007\navex15.sys [2010-3-7 1324720]

S2 gupdate;Googles oppdateringstjeneste (gupdate);c:\programfiler\google\update\GoogleUpdate.exe [2010-2-11 135664]

S3 fsssvc;Windows Live Tryggere for familien-tjenesten;c:\programfiler\windows live\family safety\fsssvc.exe [2009-8-5 704864]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2009-2-24 14336]

 

============== File Associations ===============

 

regfile="regedit.exe" "%1"

 

=============== Created Last 30 ================

 

2010-03-07 20:53:21 0 d--h--r- c:\documents and settings\localservice\Siste

2010-03-07 20:53:20 0 d-----r- c:\documents and settings\localservice\Mine dokumenter

2010-03-07 20:51:51 0 d-----w- c:\programfiler\Advanced Registry Optimizer

2010-03-07 20:51:51 0 d-----w- c:\documents and settings\localservice\Skrivebord

2010-03-07 20:51:36 0 d-----w- c:\documents and settings\localservice\Start-meny

2010-03-07 20:23:27 0 d-sh--w- c:\documents and settings\localservice\PrivacIE

2010-03-07 20:23:03 0 d-----r- c:\documents and settings\localservice\Favoritter

2010-03-07 19:54:13 41472 --sh--r- c:\windows\system32\2dyy6kk.exe

2010-03-04 08:47:01 49152 --sh--r- c:\windows\system32\g9c1yjfaa6.exe

2010-03-03 23:24:30 0 d-----w- c:\programfiler\Ask.com

2010-03-03 23:23:40 0 d-----w- c:\programfiler\LimeWire

2010-02-11 22:28:03 0 d-----w- C:\Programdata

2010-02-11 20:43:24 68840 ----a-w- C:\GDIPFONTCACHEV1.DAT

2010-02-11 06:59:27 33280 -c----w- c:\windows\system32\dllcache\csrsrv.dll

2010-02-11 06:59:22 11264 -c----w- c:\windows\system32\dllcache\msrle32.dll

2010-02-11 06:59:19 344064 -c----w- c:\windows\system32\dllcache\mspaint.exe

2010-02-08 17:12:56 0 d-----w- c:\docume~1\alluse~1\progra~1\AVS4YOU

2010-02-08 17:04:15 0 d-----w- c:\programfiler\fellesfiler\AVSMedia

2010-02-08 17:04:11 974848 ----a-w- c:\windows\system32\mfc70.dll

2010-02-08 17:04:11 487424 ----a-w- c:\windows\system32\msvcp70.dll

2010-02-08 17:04:11 344064 ----a-w- c:\windows\system32\msvcr70.dll

2010-02-08 17:04:11 24576 ----a-w- c:\windows\system32\msxml3a.dll

2010-02-08 17:04:11 1700352 ----a-w- c:\windows\system32\GdiPlus.dll

2010-02-08 17:04:11 0 d-----w- c:\programfiler\AVS4YOU

2010-02-07 18:05:10 0 d-----w- c:\programfiler\Rockstar Games

 

==================== Find3M ====================

 

2010-02-24 08:16:06 181632 ------w- c:\windows\system32\MpSigStub.exe

2009-12-27 14:35:02 21504 ----a-w- c:\windows\jestertb.dll

2009-12-21 19:10:29 916480 ----a-w- c:\windows\system32\wininet.dll

2009-12-17 07:42:59 344064 ----a-w- c:\windows\system32\mspaint.exe

2009-12-14 07:10:20 33280 ----a-w- c:\windows\system32\csrsrv.dll

2009-12-09 10:12:16 2147328 ----a-w- c:\windows\system32\ntoskrnl.exe

2009-12-09 10:12:16 2025984 ----a-w- c:\windows\system32\ntkrnlpa.exe

2009-05-07 10:12:26 868352 --sha-w- c:\windows\system32\config\systemprofile\iecompatcache\index.dat

2009-05-13 11:54:41 245760 --sha-w- c:\windows\system32\config\systemprofile\ietldcache\index.dat

2009-05-13 11:54:41 32768 --sha-w- c:\windows\system32\config\systemprofile\privacie\index.dat

2009-05-07 10:12:26 32768 --sha-w- c:\windows\system32\config\systemprofile\programdata\microsoft\internet explorer\userdata\index.dat

 

fjerner den så snart som mulig nå. om det er negativt at den ligger på nett

Skrevet (endret)

Hent Combofix, og legg det på skrivebordet

 

Last ned vedlegget, legg det på skrivebordet:cfscript.txt

Dra deretter cfscript-fila over combofix-iconet og slipp. Combofix vil kjøre (se bildet under). Post loggen combofix lager.

 

6af2c97f0f4e497013ed9b32fc36b566.gif

Endret av norbat

Opprett en konto eller logg inn for å kommentere

Du må være et medlem for å kunne skrive en kommentar

Opprett konto

Det er enkelt å melde seg inn for å starte en ny konto!

Start en konto

Logg inn

Har du allerede en konto? Logg inn her.

Logg inn nå
  • Hvem er aktive   0 medlemmer

    • Ingen innloggede medlemmer aktive
×
×
  • Opprett ny...