win32/hoax.renos (hijacklog vedlagt)

Captain Goodvibes · 2. april 2006

Har fått noe dævelskap på maskinen min, og håper på noen tips for å få fjernet det. NOD32 popper stadig opp med beskjed om at jeg har virus som er:

"probably a variant of win32/hoax.renos application"

NOD setter så filen i karantene, men dette spretter likefullt opp igjen etter en times tid. Når jeg scanner etter virus får jeg ikke opp noe som virker galt.

Startsiden min i IE er endret til http://www.securitysafeguards.net/ og der hevder de følgende:

Attention! Your system is under control of remote computer with IP address 227.4.167.118. The remote computer has access to the following folders on your PC:

- \WINDOWS\System32

- \Program Files\Internet Explorer

- \My Documents

- Drive C:\ files

Click here to download official anti-spyware software

Jeg legger ved denne HijackThis loggen og håper noen klarer å lese noe ut av den!

Logfile of HijackThis v1.99.1

Scan saved at 23:50:10, on 02.04.2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

C:\Program Files\Eset\nod32krn.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\nvctrl.exe

C:\Program Files\Eset\nod32kui.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\ALCMTR.EXE

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe

C:\Program Files\D-Tools\daemon.exe

C:\Program Files\Steam\Steam.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Java\j2re1.4.2_01\bin\jucheck.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Documents and Settings\Admin\Desktop\HijackThis.exe

O2 - BHO: Nothing - {4da4616d-7e6e-4fd9-a2d5-b6c535733e22} - C:\WINDOWS\system32\hpE76D.tmp

O3 - Toolbar: BitComet Toolbar - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - C:\Program Files\BitComet Toolbar\v2.0.0.5\BitComet_Toolbar.dll (file missing)

O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe

O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033

O4 - HKCU\..\Run: [steam] "C:\Program Files\Steam\Steam.exe" -silent

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Centrebet Poker - {8A12431A-A23D-4a88-BEED-4EFC434B70D7} - C:\Program Files\Centrebet Poker\casino.exe

O9 - Extra 'Tools' menuitem: Centrebet Poker - {8A12431A-A23D-4a88-BEED-4EFC434B70D7} - C:\Program Files\Centrebet Poker\casino.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {1819853F-A3CA-4BC4-AD65-EC29D7448494} (CBPLauncher Class) - https://sports.centrebet.com/poker/centrebe...kerlauncher.cab

O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IPSUploader Control) - http://asp02.photoprintit.de/microsite/18/...IPSUploader.cab

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

b21a · 3. april 2006

Kjørte logen din gjennom en analyzer, kunne ikke se at du har noen spesielle problemer.

Resultatet finner du http://hjt.iamnotageek.com/parse.php?log=200435]her[/url]

Mulig du kanskje må slå av systemopprettingen før du scanner i safe mode. Bruker å hjelpe når jeg får gjenstridige spyware og slikt.

Du har husket å stoppe windows messenger?

berxter · 3. april 2006

Vel... Denne:

O2 - BHO: Nothing - {4da4616d-7e6e-4fd9-a2d5-b6c535733e22} - C:\WINDOWS\system32\hpE76D.tmp

tilkjennegir at alt slett ikke er som det skal være.

Her trenger vi

Ewido

Spysweeper. Spysweeper virker i en 14dg prøveperiode, og når maskina di er rein bør du avinstallere den og legge inn Spybot, Adaware e l.

Crapcleaner

Ewido: Begynn med å laste ned, installere og oppdatere. Når du installerer, hak vekk "Install background guard" og "Install scan via context menu." Ikke kjør enda.

Spysweeper: samme her, installer og oppdater; vent med å kjøre.

Crapcleaner: vent litt med den.

Restart i safe mode (f8 under oppstart)

Kjør Ewido

Kjør Spysweeper,

"Click Options on the left side.

Click the Sweep Options tab.

Under What to Sweep please put a check next to the following:

Sweep Memory

Sweep Registry

Sweep Cookies

Sweep All User Accounts

Enable Direct Disk Sweeping

Sweep Contents of Compressed Files

Sweep for Rootkits

Please UNCHECK Do not Sweep System Restore Folder."

restart på vanlig måte, kjør Crapcleaner.

Kjør en runde med Panda Activescan (google), husk see report/ save report.

Legg ut Pandaloggen og en ny HJT-logg.

Bernt K

Endret 3. april 2006 av berxter

Captain Goodvibes · 3. april 2006

Takker, går i gang nå - håper jeg slipper formatering :cry:

Log kommer

Captain Goodvibes · 4. april 2006

Ny HJT-Log

Logfile of HijackThis v1.99.1

Scan saved at 21:37:43, on 04.04.2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Eset\nod32kui.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\ALCMTR.EXE

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe

C:\Program Files\D-Tools\daemon.exe

C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

C:\Program Files\Java\j2re1.4.2_01\bin\jucheck.exe

C:\Program Files\Steam\Steam.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\ewido anti-malware\ewidoctrl.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

C:\Program Files\Eset\nod32krn.exe

C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\WINDOWS\System32\svchost.exe

C:\Documents and Settings\Admin\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hw.no/

O3 - Toolbar: BitComet Toolbar - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - C:\Program Files\BitComet Toolbar\v2.0.0.5\BitComet_Toolbar.dll (file missing)

O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe

O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [spySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray