[Løst] Hjelp, fått virus på pc'n min!

Alhe · 25. mai 2007

Heisann, hoppsann!

Er stygt, stygt redd for at jeg har fått en virus på pc'n min. Den hang på nettet i går kveld mens jeg var på trening, og da jeg kom hjem hadde en hel masse vanlige programmer poppet opp. Ingen andre i familien hadde rørt pc'n. Klikket de bare vekk, noe som kanskje var dumt, men la spesielt merke til adobe reader som ville ha meg til å logge meg på nett for å lage en slags bruker. Skrivebordet mitt hadde fått opprettet linker til hovefestivalen.no og adobe dokumentet. Når jeg gikk inn i Min datamaskin utforskeren begynte den å automatisk bla rundt i mappene mine uten at jeg hadde rørt noe. Samme har skjedd etter at jeg tok pc'n av internett også.

Andre i familien påstår å ha hørt maskinen spille Heavy Metal musikk mens jeg var borte, og lillesøsteren min hadde visstnok vært borte for å se hva det var for noe da hun hadde sett en animert "mann med pistol" på skjermen. Har ikke sett noe til dette selv, men maskinen henger ikke lenger på nett. Kan ikke skjønne noe annet en at dette er et virus.

Noen som kjenner seg igjen, og/eller vet hva jeg burde gjøre?

Endret 31. mai 2007 av Alhe

25. mai 2007

Hei!

Det første du kan gjøre er å laste ned SAS, installer, oppdater og kjør 'complete scan'.

Etter at SAS er scannet ferdig laster du ned Hijackthis. Du burde endre navnet på Hijackthis-filen til f.esk 'test.exe'. Deretter kjører du Hijackthis slik at den lager en logg.

du legger så ut Hijackthis loggen sammen med SAS loggen (Prefrence->Statistics/logs)

kosara21 · 26. mai 2007

www.adaware.com

Bushmills · 26. mai 2007

Har du antivirus og brannmur?

Ikke glem Ad-Aware, Spybot Search & Destroy og CWShredder.

Kjør ett søk med de programmene. Finner sikkert mye!

Endret 26. mai 2007 av Bushmills

27. mai 2007

Nye produkter har tatt over tronen som Ad-Aware og Spybot holdt før F.eks Superantispyware og AVG Antispyware.

Endret 27. mai 2007 av medlem-105082

Alhe · 28. mai 2007

Takk for hjelp

Har kjørt superantispyware og hijackthis nå. Sas fant noen adware tracking cookies og to saker til, men ellers ingenting jeg kan se.

Her er loggene:

SUPERantispyware

Klikk for å se/fjerne innholdet nedenfor

SUPERAntiSpyware Scan Log

http://www.superantispyware.com

Generated 05/28/2007 at 03:22 PM

Application Version : 3.8.1002

Core Rules Database Version : 3242

Trace Rules Database Version: 1253

Scan type : Complete Scan

Total Scan Time : 00:36:36

Memory items scanned : 158

Memory threats detected : 0

Registry items scanned : 4496

Registry threats detected : 2

File items scanned : 26126

File threats detected : 83

Adware.Tracking Cookie

C:\Documents and Settings\Aleksander\Cookies\aleksander@advertising[1].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][2].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@doubleclick[1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@xiti[1].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@zedo[1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@adtech[2].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@a[1].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@AdRotator[3].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][1].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][2].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@cgi-bin[3].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@adrevolver[3].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@adrevolver[2].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@hotlog[1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@mediaplex[1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@bluestreak[1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@247realmedia[1].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][1].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][2].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][1].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][2].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@advertstream[2].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][2].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@targetnet[2].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@serving-sys[2].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@revsci[2].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@hitbox[1].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@clicktorrent[2].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@specificclick[2].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@toplist[2].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][2].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@casalemedia[2].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@comedian[1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@888[1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@adfair[1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@tacoda[1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@bizrate[2].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][2].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@atdmt[2].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@tradedoubler[1].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][2].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@questionmarket[2].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@cassava[1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@tribalfusion[1].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@revenue[1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@burstnet[2].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@statcounter[2].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@ad[2].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][1].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][2].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@adverticum[1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@2o7[2].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@adbrite[2].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][1].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@fastclick[2].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@usenext[1].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][1].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][2].txt

C:\Documents and Settings\Aleksander\Cookies\aleksander@clicksor[2].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][1].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][2].txt

C:\Documents and Settings\Aleksander\Cookies\[email protected][1].txt

Adware.WhenU

HKCR\WUSE.1

HKCR\WUSE.1#WUSE_Id

Hijack This

Klikk for å se/fjerne innholdet nedenfor

Logfile of HijackThis v1.99.1

Scan saved at 16:14:09, on 28.05.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Documents and Settings\Aleksander\Skrivebord\Test\Test.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programfiler\Fellesfiler\Symantec Shared\coShared\Browser\1.0\NppBho.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O3 - Toolbar: Norton-verktøylinjen - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programfiler\Fellesfiler\Symantec Shared\coShared\Browser\1.0\UIBHO.dll

O4 - HKLM\..\Run: [ccApp] "C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [osCheck] "C:\Programfiler\Norton Internet Security\osCheck.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Programfiler\Java\jre1.5.0_11\bin\jusched.exe"

O4 - HKLM\..\Run: [eabconfg.cpl] C:\Programfiler\Compaq\EAB\EABSERVR.EXE /Start

O4 - HKLM\..\Run: [ATIPTA] C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Programfiler\D-Link\AirPlus G\AirGCFG.exe

O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programfiler\ANI\ANIWZCS2 Service\WZCSLDR2.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [DAEMON Tools] "C:\Programfiler\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = ?

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programfiler\Adobe\Reader 8.0\Reader\reader_sl.exe

O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Programfiler\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~2\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1173889963073

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1173889938237

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: !SASWinLogon - C:\Programfiler\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Programfiler\ANI\ANIWZCS2 Service\ANIWZCSdS.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Automatisk LiveUpdate-planlegging - Symantec Corporation - C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\VAScanner\comHost.exe

O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Programfiler\Norton Internet Security\isPwdSvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~2\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programfiler\Analog Devices\SoundMAX\SMAgent.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\AppCore\AppSvc32.exe

28. mai 2007

Kjør Hijackthis og slett:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Hvordan kjører pc'en? Plages du fortsatt?

Alhe · 28. mai 2007

Hei igjen

Det kan virke som symtomene bare skjer når pc'n henger på nett. Har ikke sett noe til dem mens jeg har kjørt systemsøkene, men har ikke hatt pc'n på nett siden dagen det skjedde.

Dumme meg kjørte Hijack This i sikkermodus, gidder dere ta en titt på denne?

Klikk for å se/fjerne innholdet nedenfor

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe

C:\Programfiler\Fellesfiler\Symantec Shared\AppCore\AppSvc32.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Programfiler\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe

C:\Programfiler\Java\jre1.5.0_11\bin\jusched.exe

C:\Programfiler\Compaq\EAB\EABSERVR.EXE

C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Programfiler\D-Link\AirPlus G\AirGCFG.exe

C:\Programfiler\ANI\ANIWZCS2 Service\WZCSLDR2.exe

C:\Programfiler\QuickTime\qttask.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\MSN Messenger\MsnMsgr.Exe

C:\Programfiler\DAEMON Tools\daemon.exe

C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Programfiler\Adobe\Reader 8.0\Reader\reader_sl.exe

C:\WINDOWS\system32\wuauclt.exe