[LØST]msn viruset :S

lay · 4. juni 2008

eg har trøkt på den berømte linken i msn og fått viruset!!!

eg lure på om det e nån som kan se igjennom ComboFix loggen min?

ComboFix 08-06-04.1 - 19020LANO1 2008-06-05 0:13:14.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1044.18.1345 [GMT 2:00]

Running from: C:\Documents and Settings\19020LANO1\Skrivebord\ComboFix.exe

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\WINDOWS\Downloaded Program Files\setup.inf

.

((((((((((((((((((((((((( Files Created from 2008-05-04 to 2008-06-04 )))))))))))))))))))))))))))))))

.

2008-06-03 00:09 . 2008-06-03 00:08 53,252 -r-hs---- C:\WINDOWS\ehSched.exe

2008-06-01 09:25 . 2004-08-04 01:03 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll

2008-06-01 09:25 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys

2008-06-01 09:25 . 2004-08-03 22:58 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys

2008-06-01 09:25 . 2001-10-06 14:02 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll

2008-05-26 23:03 . 2008-05-26 23:03 268 --ah----- C:\sqmdata17.sqm

2008-05-26 23:03 . 2008-05-26 23:03 244 --ah----- C:\sqmnoopt17.sqm

2008-05-22 21:36 . 2008-01-16 15:53 372,736 --a------ C:\Documents and Settings\19020LANO1\setup.exe

2008-05-22 21:36 . 2007-04-27 08:06 148,416 --a------ C:\Documents and Settings\19020LANO1\_setup.dll

2008-05-22 21:36 . 2008-01-16 16:01 561 --a------ C:\Documents and Settings\19020LANO1\layout.bin

2008-05-22 21:35 . 2007-04-18 16:06 535,552 --a------ C:\Documents and Settings\19020LANO1\ISSetup.dll

2008-05-18 19:01 . 2008-05-18 19:01 <DIR> d--h----- C:\WINDOWS\PIF

2008-05-12 16:51 . 2008-05-12 16:51 268 --ah----- C:\sqmdata16.sqm

2008-05-12 16:51 . 2008-05-12 16:51 244 --ah----- C:\sqmnoopt16.sqm

2008-05-12 14:12 . 2008-05-12 14:12 268 --ah----- C:\sqmdata15.sqm

2008-05-12 14:12 . 2008-05-12 14:12 244 --ah----- C:\sqmnoopt15.sqm

2008-05-12 00:18 . 2008-05-12 00:18 244 --ah----- C:\sqmnoopt14.sqm

2008-05-12 00:18 . 2008-05-12 00:18 232 --ah----- C:\sqmdata14.sqm

2008-05-05 14:45 . 2008-05-05 14:45 <DIR> d-------- C:\WINDOWS\system32\Adobe

2008-05-05 14:45 . 2008-03-19 18:26 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll

2008-05-05 14:45 . 2008-03-19 18:29 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll

2008-05-05 10:22 . 2008-05-05 14:45 1,287 --a------ C:\WINDOWS\mozver.dat

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-06-02 09:37 --------- d-----w C:\Programfiler\FirstClass

2008-05-25 00:10 --------- d--h--w C:\Programfiler\InstallShield Installation Information

2008-05-21 22:53 --------- d-----w C:\Documents and Settings\19020LANO1\Programdata\LimeWire

2008-05-11 22:21 --------- d-----w C:\Documents and Settings\19020LANO1\Programdata\dvdcss

2008-05-05 11:45 --------- d-----w C:\Programfiler\Diablo II

2008-04-16 16:39 --------- d-----w C:\Programfiler\Counter-Strike 1.6

2008-03-16 12:59 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll

2008-03-16 12:49 94,208 ----a-w C:\WINDOWS\DIIUnin.exe

2008-03-16 12:49 2,829 ----a-w C:\WINDOWS\DIIUnin.pif

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:03 15360]

"msnmsgr"="C:\Programfiler\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]

"DAEMON Tools Lite"="C:\Programfiler\DAEMON Tools Lite\daemon.exe" [2007-12-15 12:02 482760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hpWirelessAssistant"="C:\Programfiler\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-01-10 15:13 472776]

"QlbCtrl"="C:\Programfiler\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-05-07 09:47 159744]

"SynTPEnh"="C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe" [2007-06-07 17:47 827392]

"StartCCC"="C:\Programfiler\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]

"AccelerometerSysTrayApplet"="C:\WINDOWS\system32\AccelerometerSt.exe" [2007-01-24 14:28 124928]

"SoundMAXPnP"="C:\Programfiler\Analog Devices\Core\smax4pnp.exe" [2007-01-05 17:36 872448]

"SunJavaUpdateSched"="C:\Programfiler\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

"OfficeScanNT Monitor"="C:\Programfiler\Trend Micro\OfficeScan Client\pccntmon.exe" [2006-02-07 16:16 356352]

"Adobe Reader Speed Launcher"="C:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]

"Windows UDP Control Center"="ehSched.exe" [2008-06-03 00:08 53252 C:\WINDOWS\ehSched.exe]

C:\Documents and Settings\All Users\Start-meny\Programmer\Oppstart\

BTTray.lnk - C:\Programfiler\WIDCOMM\Bluetooth Software\BTTray.exe [2007-02-06 15:14:00 561213]

Microsoft Firewall Client Management.lnk - C:\Programfiler\Microsoft Firewall Client 2004\FwcMgmt.exe [2006-12-09 19:04:10 117568]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\0]

"Script"=Startup.bat

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-3799992752-535036049-2774849586-46262\Scripts\Logon\0\0]

"Script"=PushPrinterConnections.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"C:\\Programfiler\\EA GAMES\\Battlefield 2\\BF2.exe"=

"C:\\Programfiler\\LimeWire\\LimeWire.exe"=

"C:\\Programfiler\\Sierra Entertainment\\World in Conflict\\wic.exe"=

"C:\\Programfiler\\Sierra Entertainment\\World in Conflict\\wic_online.exe"=

"C:\\Programfiler\\Sierra Entertainment\\World in Conflict\\wic_ds.exe"=

"C:\\Programfiler\\LucasArts\\Star Wars Republic Commando\\GameData\\System\\SWRepublicCommando.exe"=

"C:\\Programfiler\\Counter-Strike 1.6\\hl.exe"=

"C:\\Programfiler\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Programfiler\\Windows Live\\Messenger\\livecall.exe"=

R2 FwcAgent;Firewall Client Agent;"C:\Programfiler\Microsoft Firewall Client 2004\FwcAgent.exe" [2006-12-09 19:04]

R2 NMSAccessU;NMSAccessU;C:\Programfiler\CDBurnerXP\NMSAccessU.exe [2007-05-04 09:27]

R2 SWIHPWMI;SWIHPWMI;C:\Programfiler\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe [2006-12-04 16:13]

R3 IFXTPM;IFXTPM;C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS [2007-01-23 19:13]

S3 HP24X;HP PC Card Smart Card Reader;C:\WINDOWS\system32\DRIVERS\HP24X.sys [2006-10-19 01:23]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{23db9098-f509-11dc-ab82-001a6bdbd523}]

\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{23db9099-f509-11dc-ab82-001a6bdbd523}]

\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47175ec0-b6fc-11dc-aae7-001a6bdbd523}]

\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{47175ec1-b6fc-11dc-aae7-001a6bdbd523}]

\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{627dd766-aa6d-11dc-aac0-001a738c0835}]

\Shell\AutoRun\command - E:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e49038f0-1eaf-11dd-abe6-001a6bdbd523}]

\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e49038f1-1eaf-11dd-abe6-001a6bdbd523}]

\Shell\AutoRun\command - F:\AutoRun.exe

*Newly Created Service* - CATCHME

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-06-05 00:14:31

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-06-05 0:15:39

ComboFix-quarantined-files.txt 2008-06-04 22:15:13

Pre-Run: 53,318,455,296 byte ledig

Post-Run: 53,570,658,304 byte ledig

122

Endret 5. juni 2008 av lay

norbat · 5. juni 2008

Åpne notisblokk og kopier inn det som står i fet skrift under, lagre fila på skrivebordet som CFScript.txt.

Dra deretter fila over Combofix-iconet. Combofix vil starte igjen. Post loggen.

File::

C:\WINDOWS\ehSched.exe

Registry::

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Windows UDP Control Center"=-

lay · 5. juni 2008

ComboFix 08-06-04.1 - 19020LANO1 2008-06-05 1:20:36.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1044.18.1372 [GMT 2:00]

Running from: C:\Documents and Settings\19020LANO1\Skrivebord\ComboFix.exe

Command switches used :: C:\Documents and Settings\19020LANO1\Skrivebord\CFScript.txt

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

C:\WINDOWS\ehSched.exe