Trenger hjelp til å fjerne Virtumonde / Vundu

Petterla · 21. april 2008

Ja da ser det bra ut

Bruk pcen litt kjører den greit må du gjøre dette.

Du kan fjerne combofix ved å skrive combofix /u fra kjør-vinduet. Denne kommandoen gjør at filer i karantene og backups blir slette. Systemgjenopprettingsmappa nullstilt etc.

Surf Trygt.

Nok en gang mange mange takk.

Kajo2k · 8. mai 2008

Nå sliter visst jeg også med dette. Prøvd å fjerne det selv, men jeg har fortsatt .dll feilmeldinger.

hijackthis:

Klikk for å se/fjerne innholdet nedenfor

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:30:20, on 08.05.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE

C:\Programfiler\F-Secure\Anti-Virus\fsgk32st.exe

C:\Programfiler\F-Secure\Anti-Virus\FSGK32.EXE

C:\Programfiler\F-Secure\BackWeb\7681197\program\fsbwsys.exe

C:\Programfiler\F-Secure\Common\FSMA32.EXE

C:\Programfiler\F-Secure\Anti-Virus\fssm32.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\F-Secure\Common\FSMB32.EXE

C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

C:\Programfiler\F-Secure\Common\FCH32.EXE

C:\Programfiler\F-Secure\Common\FNRB32.EXE

C:\Programfiler\F-Secure\Anti-Virus\fsqh.exe

C:\Programfiler\F-Secure\Common\FAMEH32.EXE

C:\Programfiler\F-Secure\FWES\Program\fsdfwd.exe

C:\Programfiler\F-Secure\Anti-Virus\fsrw.exe

C:\Programfiler\F-Secure\Common\FIH32.EXE

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\F-Secure\Anti-Virus\fsav32.exe

C:\WINDOWS\TBPanel.exe

C:\Programfiler\CyberLink\PowerDVD\PDVDServ.exe

C:\Programfiler\Logitech\iTouch\iTouch.exe

C:\Programfiler\Fellesfiler\Logitech\QCDriver3\LVCOMS.EXE

C:\Programfiler\Logitech\ImageStudio\LogiTray.exe

C:\Programfiler\F-Secure\Common\FSM32.EXE

C:\Programfiler\D-Tools\daemon.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Programfiler\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe

C:\PROGRA~1\F-Secure\ANTI-S~1\fsaw.exe

C:\Programfiler\Logitech\SetPoint\SetPoint.exe

C:\Programfiler\F-Secure\FSGUI\fsguidll.exe

C:\Programfiler\Fellesfiler\Logitech\khalshared\KHALMNPR.EXE

C:\Programfiler\Logitech\ImageStudio\LowLight.exe

C:\Programfiler\iPod\bin\iPodService.exe

C:\Programfiler\Opera\Opera.exe

C:\Programfiler\Windows Live\Messenger\msnmsgr.exe

C:\Programfiler\mIRC\mirc.exe

C:\Documents and Settings\All Users\Skrivebord\HJThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: PaltalkWebLogin - {502C3BA4-2C3E-4317-BC29-C0445E82B1F9} - C:\Programfiler\Common Files\Paltalk\PaltalkWebLogin.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: (no name) - {E25E5828-47DF-4BC7-81C2-1C828A9D181A} - C:\WINDOWS\system32\iifcATjI.dll (file missing)

O4 - HKLM\..\Run: [Gainward] C:\WINDOWS\TBPanel.exe /A

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [RemoteControl] C:\Programfiler\CyberLink\PowerDVD\PDVDServ.exe

O4 - HKLM\..\Run: [zBrowser Launcher] C:\Programfiler\Logitech\iTouch\iTouch.exe

O4 - HKLM\..\Run: [LVCOMS] C:\Programfiler\Fellesfiler\Logitech\QCDriver3\LVCOMS.EXE

O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Programfiler\Logitech\ImageStudio\ISStart.exe

O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Programfiler\Logitech\ImageStudio\LogiTray.exe

O4 - HKLM\..\Run: [F-Secure Manager] "C:\Programfiler\F-Secure\Common\FSM32.EXE" /splash

O4 - HKLM\..\Run: [F-Secure TNB] "C:\Programfiler\F-Secure\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programfiler\D-Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Programfiler\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [bM674fb046] Rundll32.exe "C:\WINDOWS\system32\ddnuboci.dll",s

O4 - HKLM\..\Run: [647c83da] rundll32.exe "C:\WINDOWS\system32\hveeiwgr.dll",b

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsgCenterExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\RealOneMessageCenter.exe" -osboot

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Startup: IMVU.lnk = D:\Games\Imvu\IMVUClient.exe

O4 - Global Startup: F-Secure Automatic Update.lnk = C:\Programfiler\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe

O4 - Global Startup: Logitech SetPoint.lnk = ?

O8 - Extra context menu item: &Block this popup - C:\Programfiler\F-Secure\Anti-Spyware\blockpopups.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: IE Shield - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programfiler\F-Secure\Anti-Spyware\ieshield.dll

O9 - Extra 'Tools' menuitem: IE Shield... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Programfiler\F-Secure\Anti-Spyware\ieshield.dll

O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Kajo\Start-meny\Programmer\>IMVU\Run IMVU.lnk (file missing)

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Programfiler\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1195234784968

O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1208892528390

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{B508E252-95FD-47DF-BB90-70236CE55AB5}: NameServer = 192.168.1.1

O20 - Winlogon Notify: hgGwUoPI - hgGwUoPI.dll (file missing)

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: app_filter - Unknown owner - C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

O23 - Service: F-Secure Automatic Update (BackWeb Plug-in - 7681197) - F-Secure Automatic Update - C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\SERVIC~1.EXE

O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corp. - C:\Programfiler\F-Secure\Anti-Virus\fsgk32st.exe

O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Programfiler\F-Secure\Common\FNRB32.EXE

O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

O23 - Service: fsbwsys - F-Secure Corp. - C:\Programfiler\F-Secure\BackWeb\7681197\program\fsbwsys.exe

O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Programfiler\F-Secure\FWES\Program\fsdfwd.exe

O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Programfiler\F-Secure\Common\FSMA32.EXE

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Programfiler\iPod\bin\iPodService.exe

O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

O23 - Service: ForceWare user log service (nSvcLog) - Unknown owner - C:\Programfiler\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--

End of file - 11075 bytes

combofix:

Klikk for å se/fjerne innholdet nedenfor

ComboFix 08-05-01.3 - Kajo 2008-05-08 21:33:30.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1044.18.972 [GMT 2:00]

Running from: C:\Documents and Settings\Kajo\Skrivebord\ComboFix.exe

* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((( Files Created from 2008-04-08 to 2008-05-08 )))))))))))))))))))))))))))))))

.

2008-05-08 00:37 . 2008-05-08 00:42 269 --a------ C:\WINDOWS\wininit.ini

2008-05-08 00:22 . 2008-05-08 00:22 2,112 --a------ C:\WINDOWS\system32\ohuikdaw.exe

2008-05-07 22:26 . 2008-05-08 00:20 109,807 --a------ C:\WINDOWS\BM674fb046.xml

2008-05-06 22:58 . 2008-05-08 21:02 <DIR> d-------- C:\Programfiler\mIRC

2008-05-06 22:58 . 2008-05-08 21:32 <DIR> d-------- C:\Documents and Settings\Kajo\Programdata\mIRC

2008-04-22 21:34 . 2008-04-22 21:34 <DIR> d-------- C:\Programfiler\Microsoft Silverlight

2008-04-11 20:46 . 2008-04-11 20:46 399,616 --a------ C:\WINDOWS\system32\drivers\EagleNt.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-04-21 21:57 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll

2008-04-21 18:26 --------- d-----w C:\Documents and Settings\Kajo\Programdata\Apple Computer

2008-04-19 13:18 --------- d--h--w C:\Programfiler\InstallShield Installation Information

2008-04-17 20:53 --------- d-----w C:\Programfiler\SystemRequirementsLab

2008-04-04 18:23 --------- d-----w C:\Programfiler\Fellesfiler\Real

2008-04-04 18:10 --------- d-----w C:\Programfiler\Real

2008-04-04 17:59 --------- d-----w C:\Documents and Settings\Kajo\Programdata\Media Player Classic

2008-03-31 21:55 --------- d-----w C:\Documents and Settings\Kajo\Programdata\Command & Conquer 3 Kane's Wrath

2008-03-31 21:52 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll

2008-03-20 08:11 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys

2008-03-12 11:10 633,344 ------w C:\WINDOWS\system32\gpprefcl.dll

2008-03-03 23:54 691,545 ----a-w C:\WINDOWS\unins000.exe

2008-03-01 13:05 826,368 ----a-w C:\WINDOWS\system32\wininet.dll

2008-02-20 06:52 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll

2008-02-20 05:39 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll

2007-08-13 15:45 87,608 ----a-w C:\Documents and Settings\Kajo\Programdata\inst.exe

2007-08-13 15:45 47,360 -c--a-w C:\Documents and Settings\Kajo\Programdata\pcouffin.sys

2007-03-27 18:49 1 -c--a-w C:\Documents and Settings\Kajo\SI.bin

.

((((((((((((((((((((((((((((( snapshot@2008-05-08_ 1.08.14.75 )))))))))))))))))))))))))))))))))))))))))

.

- 2008-05-07 23:04:03 2,048 --s-a-w C:\WINDOWS\bootstat.dat

+ 2008-05-08 18:42:38 2,048 --s-a-w C:\WINDOWS\bootstat.dat

- 2008-05-07 23:06:05 1,500 ----a-w C:\WINDOWS\UI\BIOSCTL.DAT

+ 2008-05-08 18:43:46 1,500 ----a-w C:\WINDOWS\UI\BIOSCTL.DAT

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E25E5828-47DF-4BC7-81C2-1C828A9D181A}]

C:\WINDOWS\system32\iifcATjI.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"WebCamRT.exe"="" []

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:03 15360]

"MsgCenterExe"="C:\Programfiler\Fellesfiler\Real\Update_OB\RealOneMessageCenter.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Gainward"="C:\WINDOWS\TBPanel.exe" [2005-07-25 10:39 2043904]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 18:14 8491008]

"nwiz"="nwiz.exe" [2007-10-04 18:14 1626112 C:\WINDOWS\system32\nwiz.exe]

"RemoteControl"="C:\Programfiler\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42 32768]

"zBrowser Launcher"="C:\Programfiler\Logitech\iTouch\iTouch.exe" [2004-03-18 10:33 892928]

"LVCOMS"="C:\Programfiler\Fellesfiler\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 18:54 127022]

"LogitechGalleryRepair"="C:\Programfiler\Logitech\ImageStudio\ISStart.exe" [2002-12-10 19:32 155648]

"LogitechImageStudioTray"="C:\Programfiler\Logitech\ImageStudio\LogiTray.exe" [2002-12-10 19:31 61440]

"F-Secure Manager"="C:\Programfiler\F-Secure\Common\FSM32.exe" [2005-10-26 03:51 122929]

"F-Secure TNB"="C:\Programfiler\F-Secure\TNB\TNBUtil.exe" [2004-05-27 10:57 684032]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]

"DAEMON Tools-1033"="C:\Programfiler\D-Tools\daemon.exe" [2004-08-22 17:05 81920]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 15:44 101136 C:\WINDOWS\KHALMNPR.Exe]

"SoundMan"="SOUNDMAN.EXE" [2007-04-16 16:28 577536 C:\WINDOWS\soundman.exe]

"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-04 18:14 81920]

"QuickTime Task"="C:\Programfiler\K-Lite Codec Pack\QuickTime\QTTask.exe" [2007-12-11 11:56 286720]

"iTunesHelper"="C:\Programfiler\iTunes\iTunesHelper.exe" [2007-12-11 13:10 267048]

"BM674fb046"="C:\WINDOWS\system32\ddnuboci.dll" [ ]

"647c83da"="C:\WINDOWS\system32\hveeiwgr.dll" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 02:03 15360]

C:\Documents and Settings\All Users\Start-meny\Programmer\Oppstart\

F-Secure Automatic Update.lnk - C:\Programfiler\F-Secure\BackWeb\7681197\program\F-Secure Automatic Update.exe [2006-08-20 23:27:43 32807]

Logitech SetPoint.lnk - C:\Programfiler\Logitech\SetPoint\SetPoint.exe [2007-07-23 20:44:08 688128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hgGwUoPI]

hgGwUoPI.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

norbat · 8. mai 2008

Start hjt, velg "Do a system scan only", sett merke framfor følgende linjer og klikk Fix checked:

O2 - BHO: (no name) - {E25E5828-47DF-4BC7-81C2-1C828A9D181A} - C:\WINDOWS\system32\iifcATjI.dll (file missing)

O4 - HKLM\..\Run: [bM674fb046] Rundll32.exe "C:\WINDOWS\system32\ddnuboci.dll",s

O4 - HKLM\..\Run: [647c83da] rundll32.exe "C:\WINDOWS\system32\hveeiwgr.dll",b

O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Kajo\Start-meny\Programmer\>IMVU\Run IMVU.lnk (file missing)

O20 - Winlogon Notify: hgGwUoPI - hgGwUoPI.dll (file missing)

Åpne Notisblokk og lim inn det som står i fet tekst under. Lagre fila på skrivebordet som CFScript

Dra fila over combofix-iconet. Combofix vil starte igjen:

File::

C:\WINDOWS\system32\ohuikdaw.exe

C:\WINDOWS\BM674fb046.xml

C:\WINDOWS\system32\gpprefcl.dll

Post den nye combofix-loggen

Kajo2k · 8. mai 2008

Klikk for å se/fjerne innholdet nedenfor

ComboFix 08-05-01.3 - Kajo 2008-05-08 23:14:41.4 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1044.18.946 [GMT 2:00]

Running from: C:\Documents and Settings\Kajo\Skrivebord\ComboFix.exe

Command switches used :: C:\Documents and Settings\Kajo\Skrivebord\CFScript.txt

* Created a new restore point

* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

C:\WINDOWS\BM674fb046.xml

C:\WINDOWS\system32\gpprefcl.dll

C:\WINDOWS\system32\ohuikdaw.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Documents and Settings\Kajo\Programdata\inst.exe