PC vil ikke connecte LimeWire, mIRC, Thunderbird

[SaiMANN]

Skulle gå på mIRC idag, med så nekta mIRC og connecte seg til noen servere, så prøvde jeg LimeWire, men den ville heller ikke koble seg til! Også skulle jeg skjekke mailen med Thunderbird, og den ville heller ikke koble seg til!

 

Tilslutt prøvde jeg med Laptopen min, og den hadde akkurat samme problemet!

 

Hva er det som egentlig skjer? Alt funka fint igår. Og siden det alle er interentt program, så skulle man nesten tro det var noe med routeren eller lignende. Har forresten prøvd og restarta routeren, men uten hell

[zjulik]

Kan du surfe? (Er det derfra du skriver?)

[SaiMANN]

Ja, Firefox funker helt fint! (på begge)

[zjulik]

Tjaj hvis det er to maskiner som ikke funker, vil jeg tro at tilbyderen din driver med noe arbeid på linja. Hvor har du internett/bredbånd?

 

Alternativt kan du ha fått virus/spyware - men det er ikke så sannsynlig at begge maskinene har fått det samtidig...

[SaiMANN]

Vi har Telenor trur jeg. Jeg driver jo og overfører saker og ting fra laptop til den andre og omvendt, så det kan jo hende at det har kommet noe på begge maskinene på den måten? Finner Norton antivirus spyware?

[zjulik]

1. Kjør en Housecall (sig)

2. Kjør Adaware Personal ( http://www.lavasoftusa.com/software/adaware/ )

3. Post deretter HijackThisloggen (sig)

 

Antivirus tar ikke spyware og omvendt, i alle fall ikke godt nok. Du må ha ett av hver.

[SaiMANN]

Kjører Housecall og Adaware nå, hijack loggen er her:

 

Logfile of HijackThis v1.99.1

Scan saved at 09:35:07, on 13.07.2005

Platform: Windows XP  (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\vvv.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe

C:\Program Files\D-Tools\daemon.exe

C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\WINDOWS\System32\phqghu.exe

C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

c:\windows\system32\wpggpq.exe

C:\Program Files\Winamp\winamp.exe

C:\Program Files\MSN Messenger\msnmsgr.exe

C:\PROGRA~1\Lavasoft\AD-AWA~1\Ad-Aware.exe

C:\WINDOWS\explorer.exe

C:\Documents and Settings\Simen\Desktop\hijackthis\HijackThis.exe

 

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

O1 - Hosts: 64.39.14.226 onlineaccounts2.abbeynational.co.uk

O1 - Hosts: 64.39.14.226 www3.aibgbonline.co.uk

O1 - Hosts: 64.39.14.226 www.bank.alliance-leicester.co.uk

O1 - Hosts: 64.39.14.226 login.iblogin.com

O1 - Hosts: 64.39.14.226 ww2.bankofscotlandhalifax-online.co.uk

O1 - Hosts: 64.39.14.226 inet.barclays.co.uk

O1 - Hosts: 64.39.14.226 iibank.barclays.co.uk

O1 - Hosts: 64.39.14.226 iibank.cahoot.com

O1 - Hosts: 64.39.14.226 www3.coventrybuildingsociety.co.uk

O1 - Hosts: 64.39.14.226 ww.hsbc.co.uk

O1 - Hosts: 64.39.14.226 login.ebank.offshore.hsbc.co.je

O1 - Hosts: 64.39.14.226 ww3.online-offshore.lloydstsb.com

O1 - Hosts: 64.39.14.226 ww3.online-business.lloydstsb.co.uk

O1 - Hosts: 64.39.14.226 ww3.online.lloydstsb.co.uk

O1 - Hosts: 64.39.14.226 ww3.online.lloydstsb.co.uk

O1 - Hosts: 64.39.14.226 ww3.online-business.lloydstsb.co.uk

O1 - Hosts: 64.39.14.226 ob2.nationet.com

O1 - Hosts: 64.39.14.226 ww3.onlinebanking.natwestoffshore.com

O1 - Hosts: 64.39.14.226 ww1.nwolb.com

O1 - Hosts: 64.39.14.226 ww1.onlinebanking.iombank.com

O1 - Hosts: 64.39.14.226 ww1.www.rbsdigital.com

O1 - Hosts: 64.39.14.226 welcome.smile.co.uk

O1 - Hosts: 64.39.14.226 login.365online.com

O1 - Hosts: 64.39.14.226 wvw.citizensbankonline.com

O1 - Hosts: 64.39.14.226 esecure.regionsnet.com

O1 - Hosts: 64.39.14.226 rollb.associatedbank.com

O1 - Hosts: 64.39.14.226 upb.unionplanters.com

O1 - Hosts: 64.39.14.226 www.onlinebanking.huntington.com

O1 - Hosts: 64.39.14.226 inet.southtrustonlinebanking.com

O1 - Hosts: 64.39.14.226 logon.personal.wamu.com

O1 - Hosts: 64.39.14.226 login.compassweb.com

O1 - Hosts: 64.39.14.226 logon.firstmeritib.com

O1 - Hosts: 64.39.14.226 login.ccfcuonline.org

O1 - Hosts: 64.39.14.226 ww3.etimebanker.bankofthewest.com

O1 - Hosts: 64.39.14.226 ww2.onlinebanking.lasallebank.com

O1 - Hosts: 64.39.14.226 wvw.totallyfreebanking.com

O1 - Hosts: 64.39.14.226 www.online.wellsfargo.com

O1 - Hosts: 64.39.14.226 www.onlinebanking.bankofoklahoma.com

O1 - Hosts: 64.39.14.226 accounts4.keybank.com

O1 - Hosts: 64.39.14.226 logon.bankone.com

O1 - Hosts: 64.39.14.226 www.secure.tdbanknorth.com

O1 - Hosts: 64.39.14.226 www.secure.mvnt4.com

O1 - Hosts: 64.39.14.226 ww.mynfbonline.com

O1 - Hosts: 64.39.14.226 login.forumcuonline.com

O1 - Hosts: 64.39.14.226 www.eds.usersonlnet.com

O1 - Hosts: 64.39.14.226 www.onlineid.bankofamerica.com

O1 - Hosts: 64.39.14.226 wvw.e-gold.com

O1 - Hosts: 64.39.14.226 pcbs.peoples.com

O1 - Hosts: 64.39.14.226 www.global1.onlinebank.com

O1 - Hosts: 64.39.14.226 ww2.mybranch.lafcu.com

O1 - Hosts: 64.39.14.226 login.webbanking.comerica.com

O1 - Hosts: 64.39.14.226 web.banking.firsttennessee.com

O1 - Hosts: 64.39.14.226 logon.members1st.org

O1 - Hosts: 64.39.14.226 www.cib.ibanking-services.com

O1 - Hosts: 64.39.14.226 www.miwebbusbank.ebanking-services.com

O1 - Hosts: 64.39.14.226 wvw.paypal.com

O1 - Hosts: 64.39.14.226 www.signin.ebay.com

O1 - Hosts: 64.39.14.226 wvw.etrade.com

O1 - Hosts: 64.39.14.226 ww4.fleethomelink.fleet.com

O1 - Hosts: 64.39.14.226 ww3.connect.skyfi.com

O1 - Hosts: 64.39.14.226 www6.usbank.com

O1 - Hosts: 64.39.14.226 www.bvi.bancodevalencia.es

O1 - Hosts: 64.39.14.226 extrant.banesto.es

O1 - Hosts: 64.39.14.226 banesnt.banesto.es

O1 - Hosts: 64.39.14.226 activia.caixagalicia.es

O1 - Hosts: 64.39.14.226 www.bancae.caixapenedes.com

O1 - Hosts: 64.39.14.226 login.caixasabadell.net

O1 - Hosts: 64.39.14.226 oii.cajamadrid.es

O1 - Hosts: 64.39.14.226 login.cajamar.es

O1 - Hosts: 64.39.14.226 login.ccm.es

O1 - Hosts: 64.39.14.226 ww.unicaja.es

O1 - Hosts: 64.39.14.226 www5.bancopopular.es

O1 - Hosts: 64.39.14.226 ww3.bbvanet.com

O1 - Hosts: 64.39.14.226 ww.bayernlb.de

O1 - Hosts: 64.39.14.226 ww2.berliner-volksbank.de

O1 - Hosts: 64.39.14.226 ww7.homebanking-berlin.de

O1 - Hosts: 64.39.14.226 portal09.commerzbanking.de

O1 - Hosts: 64.39.14.226 www.meine.deutsche-bank.de

O1 - Hosts: 64.39.14.226 ww2.dresdner-privat.de

O1 - Hosts: 64.39.14.226 ww.e-banking.helaba.de

O1 - Hosts: 64.39.14.226 ww.hsh-nordbank.de

O1 - Hosts: 64.39.14.226 www.my.hypovereinsbank.de

O1 - Hosts: 64.39.14.226 ww3.homebanking-berlin.de

O1 - Hosts: 64.39.14.226 ww3.homebanking-berlin.de

O1 - Hosts: 64.39.14.226 www.banking.lbbw.de

O1 - Hosts: 64.39.14.226 lrp.sparkasse-banking.de

O1 - Hosts: 64.39.14.226 ww3.homebanking-niedersachsen.de

O1 - Hosts: 64.39.14.226 www.onlinebanking.norisbank.de

O1 - Hosts: 64.39.14.226 www.banking.postbank.de

O1 - Hosts: 64.39.14.226 wvw.internetbanking.gad.de

O1 - Hosts: 64.39.14.226 ww1.portal.izb.de

O1 - Hosts: 64.39.14.226 wvw.kunden-service.lbs.de

O1 - Hosts: 64.39.14.226 ibanking.seb.de

O1 - Hosts: 64.39.14.226 bw7.sparkasse-banking.de

O1 - Hosts: 64.39.14.226 ww2.homebanking-sparkasse.de

O1 - Hosts: 64.39.14.226 ww2.vr-networld-ebanking.de

O1 - Hosts: 64.39.14.226 ww.bics.fr

O1 - Hosts: 64.39.14.226 www.co.caixabank.fr

O1 - Hosts: 64.39.14.226 ww.creditmutuel.fr

O1 - Hosts: 64.39.14.226 internetbank.intesabci.it

O1 - Hosts: 64.39.14.226 ww.extensive.bancalombarda.it

O2 - BHO: AuroraHandlerObj Class - {4AA870AC-8427-42a4-B92E-ECD956197489} - C:\WINDOWS\AuroraHandler.dll

O2 - BHO: UpdateCache Class - {6E28339B-7A2A-47B6-AEB2-46BA53782378} - C:\WINDOWS\System32\dllcache\explorer.dll

O2 - BHO: (no name) - {93770050-CD14-AF48-77C3-C63628249A3C} - C:\Program Files\cdapp\tucrhmxkas.dll (file missing)

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O2 - BHO: ADP UrlCatcher Class - {F4E04583-354E-4076-BE7D-ED6A80FD66DA} - C:\WINDOWS\System32\msbe.dll (file missing)

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe

O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033

O4 - HKLM\..\Run: [ssAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [sSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe

O4 - HKLM\..\Run: [symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

O4 - HKLM\..\Run: [VID INTERNET WEB DRIVERS FOR WIN32] phqghu.exe

O4 - HKLM\..\Run: [internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"

O4 - HKLM\..\Run: [uiyarzx] c:\windows\system32\wpggpq.exe r

O4 - HKLM\..\RunServices: [VID INTERNET WEB DRIVERS FOR WIN32] phqghu.exe

O4 - HKCU\..\Run: [sTYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide

O4 - HKCU\..\Run: [VID INTERNET WEB DRIVERS FOR WIN32] phqghu.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab

O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/MediaAcc...e/bridge-c9.cab

O16 - DPF: {42F2C9BA-614F-47C0-B3E3-ECFD34EED658} (Installer Class) - http://www.ysbweb.com/ist/softwares/v4.0/ysb_regular.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1121178919519

O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} (Loader2 Control) - http://static.topconverting.com/activex/download.ocx

O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: Local Security Authority Server (LSA Server) - Unknown owner - C:\WINDOWS\system32\vvv.exe

O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe

O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe

O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe

O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe

O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

O23 - Service: System Startup Service  (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

 

[zjulik]

Her var det saker.

 

O2 - BHO: AuroraHandlerObj Class - {4AA870AC-8427-42a4-B92E-ECD956197489} - C:\WINDOWS\AuroraHandler.dll Spyware

 

O2 - BHO: (no name) - {93770050-CD14-AF48-77C3-C63628249A3C} - C:\Program Files\cdapp\tucrhmxkas.dll (file missing) Manglende fil

 

O4 - HKLM\..\Run: [internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe" Spyware

 

O4 - HKLM\..\RunServices: [VID INTERNET WEB DRIVERS FOR WIN32] phqghu.exe

O4 - HKCU\..\Run: [VID INTERNET WEB DRIVERS FOR WIN32] phqghu.exe

O4 - HKLM\..\Run: [uiyarzx] c:\windows\system32\wpggpq.exe r

Alle ukjente, mest sannsynlig virus

 

O23 - Service: System Startup Service (SvcProc) - Unknown owner - C:\WINDOWS\svcproc.exe Trojanervirus

 

Dette gjør du:

1. CtrlAltDel/oppgavebehandling og stans følgende hvis de kjører:

phqghu.exe

wpggpq.exe

svcproc.exe

 

2. Start HijackThis og fjern alle nevnte linjer på listen øverst i dette innlegget.

Slett følgende:

c:\windows\system32\wpggpq.exe

C:\WINDOWS\svcproc.exe

 

3. Avinstaller om mulig Internet Optimizer

 

4. Kjør CrapCleaner (sig).

 

5. Omstart i Safe Mode og gjenta 1-2-3-4 hvis nødvendig. Nå sletter du også denne filen:

C:\WINDOWS\AuroraHandler.dll

Og du sletter denne mappen:

C:\Program Files\Internet Optimizer

 

6. Omstart i vanlig modus, en CrapCleaner til, og kjør en registerrens med f eks RegSupreme.

 

7. Tilslutt kjører du WinSockXPFix fra http://www.snapfiles.com/get/winsockxpfix.html

 

8. Vanlig omstart igjen.

Endret 13. juli 2005 av zjulik

[SaiMANN]

Alt er gjort! Hvilke program ambefaler du at jeg skal ha inne, og skjekke om det har kommet noe dritt inn på maskinen?

[zjulik]

Har du nett igjen?

 

Min maskin er beskyttet med (men det finnes andre muligheter!)...

Microsoft Antispyware (gratis beta)

NOD32 antivirus (gratisalternativer: AVG, Avast)

Outpost brannmur (gratisalternativ: Sygate Free)

+ Firefox med AdBlock-filter

+ nettvett

 

ALDRI åpne mail du ikke er helt sikker på.

IKKE klikke på linker i MSN du ikke er helt sikker på.

Scanne for spyware i alle fall 3 ganger i uken.

Virusscanne nedlastede filer.

Tømme søppel daglig (f eks CrapCleaner)

 

Bla ellers i sikkerhetsforumet her - mye gode tips.

[SaiMANN]

Niks! Det funker ikke nå heller.. har snakka med broder'n og han har samme problemet. Må være noe med routeren..?

 

EDIT: Starter en ny tråd. men problemet er at jeg ikke kommer "ut fra routeren".

Endret 14. juli 2005 av SaiMANN