hjelp - pcn henger seg i oppstartsfasen

[Alieu]

jeg booter pcn på vanlig måte, noe som går knirkefritt helt til desktopbilde kommer opp. vanligvis popper jo resten av ikonene opp og alt går smooth, men neida, pcn henger seg istede. ctrl tab del - ny oppgave - explorer, hjelper heller ikke, fordi det ikke eksisterer noe explorer.exe!!

 

(ja, maskinen er overfylt med spyware)

 

 

planen var da å formatere, men det lot seg ikke gjennomføre da pcn ikke finner noen hdd.....

 

noen tips?

[norbat]

Restart i sikker modus (tapp f8 under oppstart) og kjør en scan med antivirus - antispyware prog.

 

evt. kjør en systemgjenoppretting til en dato der ting virket ok

 

Det likeste er vel kanskje å ta backup av viktig data og kjør en reinstallering, men om du har forsøkt dette uten hell (finner ikke hdd...) så kan det kanskje tyde på at harddisken ikke har det helt bra.

[Kevlar]

Høres jo ut som windows har blitt buttf*cked av noe skummelt noe

 

Du får vel formatert hvis du booter fra win cd?

[propers404]

har du S-ATA eller IDE disk?? Du må innstalere driver for sata disken.

[warneck]

planen var da å formatere, men det lot seg ikke gjennomføre da pcn ikke finner noen hdd.....

7561010[/snapback]

 

Vær litt mer spesifikk. PCen finner ikke HDDen, når, og hvilken HDD er det snakk om ?

[fredblic]

hvis du har en annen pc i huset så går det ann å sette hardisken inn der og formatere den derfra.

[Alieu]

en liten scan av disken.. gjennom ctrl alt del kan jeg få tilgang til diskene. og det viser seg at c windows er full av driiiit. kjørte en ad aware scan og den fjerna en del ulumskheter, dog er det en del crap igjen. uansett...

 

SmitFraudFix v2.65

 

Scan done at 23:16:13,90, 23.12.2006

Run from C:\SmitfraudFix

OS: Microsoft Windows XP [Versjon 5.1.2600] - Windows_NT

Fix ran in normal mode

 

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix

!Attention, following keys are not inevitably infected!

 

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]

"{ab340860-fd81-4a65-b345-82eb77a66b5e}"="featherweed"

 

[HKEY_CLASSES_ROOT\CLSID\{ab340860-fd81-4a65-b345-82eb77a66b5e}\InProcServer32]

@="C:\WINDOWS\system32\jbtazy.dll"

 

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{ab340860-fd81-4a65-b345-82eb77a66b5e}\InProcServer32]

@="C:\WINDOWS\system32\jbtazy.dll"

 

 

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

 

 

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

 

GenericRenosFix by S!Ri

 

 

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

 

 

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

 

 

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

 

Registry Cleaning done.

 

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix

!Attention, following keys are not inevitably infected!

 

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]

"{ab340860-fd81-4a65-b345-82eb77a66b5e}"="featherweed"

 

[HKEY_CLASSES_ROOT\CLSID\{ab340860-fd81-4a65-b345-82eb77a66b5e}\InProcServer32]

@="C:\WINDOWS\system32\jbtazy.dll"

 

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{ab340860-fd81-4a65-b345-82eb77a66b5e}\InProcServer32]

@="C:\WINDOWS\system32\jbtazy.dll"

 

 

 

»»»»»»»»»»»»»»»»»»»»»»»» End

 

 

 

 

Logfile of HijackThis v1.99.1

Scan saved at 23:23:35, on 23.12.2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2600.0000)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

C:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Programfiler\Norton SystemWorks\Norton GoBack\GBPoll.exe

C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\taskmgr.exe

C:\WINDOWS\notepad.exe

C:\KillBox.exe

E:\WinRAR\WinRAR.exe

C:\DOCUME~1\JAN-DI~1\LOKALE~1\Temp\Rar$EX00.859\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O3 - Toolbar: Protection Bar - {bf1ced2c-4b3f-4079-a330-864eda5a4cff} - C:\Programfiler\Perfect Codec\iesplugin.dll (file missing)

O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [iTunesHelper] "E:\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [ATIPTA] "C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe"

O4 - HKLM\..\Run: [RefreshLock] E:\Refresh Lock\RefreshLock.exe

O4 - HKLM\..\Run: [Norman ZANDA] E:\RECYCLER\S-1-5-21-515967899-362288127-725345543-500\De1\Bin\Zlh.exe /LOAD /SPLASH

O4 - HKLM\..\Run: [ccApp] "C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [WinAntiVirusPro2006] "C:\Programfiler\WinAntiVirus Pro 2006\WinAV.exe"

O4 - HKLM\..\Run: [wa6pcw] "C:\Programfiler\Fellesfiler\WinAntiVirus Pro 2006\wa6pcw.exe" -c

O4 - HKLM\..\Run: [rtasks] C:\Programfiler\WinAntiVirus Pro 2006\rtasks.exe

O4 - HKCU\..\Run: [steam] "d:\sierra\steam\steam.exe" -silent

O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [msnmsgr] "C:\Programfiler\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [Octoshape Streaming Services] "C:\Programfiler\Octoshape Streaming Services\Jan-Didrik\launcher.exe" -inv:bootrun

O4 - HKCU\..\Run: [sysProtect Free] "C:\Programfiler\SysProtect Free\USYP.exe" /min

O4 - Startup: Microsoft Hurtigsøk.lnk = E:\Microsoft Office\Office\FINDFAST.EXE

O4 - Startup: Office Oppstart.lnk = E:\Microsoft Office\Office\OSA.EXE

O4 - Global Startup: CoreCenter.lnk = E:\MSI\Core Center\CoreCenter.exe

O4 - Global Startup: Hurtigstart for Adobe Reader.lnk = E:\Acrobat Reader 7\Reader\reader_sl.exe

O4 - Global Startup: Norton GoBack.lnk = C:\Programfiler\Norton SystemWorks\Norton GoBack\GBTray.exe

O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Programfiler\Norton SystemWorks\Norton Cleanup\WCQuick.lnk

O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Programfiler\Norton SystemWorks\Norton Cleanup\WCQuick.lnk

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab

O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1100908944406

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1126081193609

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://download.cdn.winsoftware.com/files/...eInstall_no.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab

O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - http://www.creative.com/su/ocx/15016/CTPID.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{85BB267C-C0F4-43E8-98E3-EC32043AB3DF}: NameServer = 217.13.7.140,217.13.4.24

O21 - SSODL: featherweed - {ab340860-fd81-4a65-b345-82eb77a66b5e} - C:\WINDOWS\system32\jbtazy.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

O23 - Service: Firewall service (FWSvc) - Unknown owner - C:\Programfiler\WinAntiVirus Pro 2006\FWSvc.exe (file missing)

O23 - Service: GoBack Polling Service (GBPoll) - Symantec Corporation - C:\Programfiler\Norton SystemWorks\Norton GoBack\GBPoll.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Programfiler\iPod\bin\iPodService.exe

O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - E:\Norman\Nvc\BIN\nipsvc.exe (file missing)

O23 - Service: Norman NJeeves - Unknown owner - E:\Norman\bin\NJEEVES.EXE (file missing)

O23 - Service: Norman ZANDA - Unknown owner - E:\Norman\Bin\Zanda.exe (file missing)

O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\NPROTECT.EXE

O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\Security Console\NSCSRVCE.EXE

O23 - Service: Norman Virus Control on-access component (nvcoas) - Unknown owner - E:\Norman\Nvc\bin\nvcoas.exe (file missing)

O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Unknown owner - E:\Norman\Nvc\BIN\NVCSCHED.EXE (file missing)

O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - E:\SiSoftware Sandra 2005\RpcDataSrv.exe

O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - E:\SiSoftware Sandra 2005\RpcSandraSrv.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programfiler\Analog Devices\SoundMAX\SMAgent.exe

O23 - Service: SPBBCSvc - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\NORTON~2\SPEEDD~1\NOPDB.EXE

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe

 

 

 

hva gjør jeg videre? hva skal jeg fjerne?

[azazel91]

da kan vere clutch-veieren som e begynt å bli slitt....eg måte kjøpe ny til mi maskin fordi den hang seg opp heile tida....etter de har den funka fint.

men de funka bedre viss du spandera ein vindusviskara og spyler veske....blir ikk så sjeten av at all oljen tyte utover hovudkortet og alt.....ambefaler de sterkt å kjøpe

[LA8464]

Hallo !

 

Har Stomperud91 startet Jula allerede ?

 

Ellers God Jul alle sammen !

[norbat]

hva gjør jeg videre? hva skal jeg fjerne?

7565537[/snapback]

 

Last ned SAS, installer og oppdater.

Last ned CCleaner, installer.

 

Avinstaller fra legg til/fjern programmer:

WinAntiVirus pro 2006

 

Kjør HJT og fix:

O3 - Toolbar: Protection Bar - {bf1ced2c-4b3f-4079-a330-864eda5a4cff} - C:\Programfiler\Perfect Codec\iesplugin.dll (file missing)

O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://download.cdn.winsoftware.com/files/...eInstall_no.cab

O21 - SSODL: featherweed - {ab340860-fd81-4a65-b345-82eb77a66b5e} - C:\WINDOWS\system32\jbtazy.dll

O23 - Service: Firewall service (FWSvc) - Unknown owner - C:\Programfiler\WinAntiVirus Pro 2006\FWSvc.exe (file missing)

 

Sørg for at du kan se skjulte filer og mapper (kontrollpanel->mappealt.->vis->"vis skjulte filer og mapper".

 

Restart i sikker modus (tapp f8 under oppstart)

 

Åpne Smitfraudfix-mappa di og kjør Smitfraudfix.cmd, tast 2 og la programmet rense.

 

Bruk utforsker og finn/slett (i bold):

C:\Programfiler\Perfect Codec\

C:\Programfiler\WinAntiVirus Pro 2006\

 

Kjør en rens med CCleaner

 

Kjør deretter en full scan med SAS

 

Restart i normal modus og post en ny HJT-logg

 

 

GOD JUL!

Endret 24. desember 2006 av norbat