Hvordan få vekk en trojan ?

Benbels · 16. juni 2008

Hei : )

Jeg har fått en trojan på pcen min så jeg trenger hjelp til å få fjernet den. Trojanen gjør så at hver gang jeg går inn på mine dokumenter eller enda lenger så får jeg opp meldingen "Attention, **mitt navn**. Some dangerous trojan horses detected in your system. Microsoft Windows XP files currupted. This may lead to the destruction of important files in C:\WINDOWS. Download protection software now!

Click OK to download the antispyware. (Recommended) Ja Nei"

Jeg vet ikke helt om dette er riktig sted å legge denne tråden men hvis det ikke er det så rett meg.

Trainman · 16. juni 2008

Last ned combofix fra denne siden. Ikke trykk i vinduet mens Combofix kjører.

Deretter laster du ned SAS, oppdater og kjør full scan.

Legg så ut en logg fra Hijackthis som du laster ned herfra.

Loggen legger du ut i forumet for Antivirusprogrammer og datasikkerhet.

Endret 16. juni 2008 av Trainman

Benbels · 16. juni 2008

Last ned combofix fra denne siden. Ikke trykk i vinduet mens Combofix kjører.

Deretter laster du ned SAS, oppdater og kjør full scan.

Legg så ut en logg fra Hijackthis som du laster ned herfra.

Loggen legger du ut i forumet for Antivirusprogrammer og datasikkerhet.

Takk, skal prøve dette imorgen

b-real · 17. juni 2008

Tråden er feilpostet så den flyttes fra 'Maskinen funker ikke' og til 'Antivirusprogrammer og datasikkerhet' da det er den rette kategorien for ditt problem og sjansene for at du får hjelp er større i korrekt kategori

Benbels · 17. juni 2008

Last ned combofix fra denne siden. Ikke trykk i vinduet mens Combofix kjører.

Deretter laster du ned SAS, oppdater og kjør full scan.

Legg så ut en logg fra Hijackthis som du laster ned herfra.

Loggen legger du ut i forumet for Antivirusprogrammer og datasikkerhet.

Tusen takk : ) Det funket som bare det

r2d290 · 17. juni 2008

Du bør poste loggene. Det er godt mulig at det er noen rester igjen som du ikke merker, men som kan gjøre mye rart med maskinen.

combofix-logg: c:/combofix.txt

SAS-logg: start programmet, velg: Preferences->statistics/logs

HijackThis: popper opp når du starter programmet, og velger "Do a systemscan and save a logfile"

Endret 17. juni 2008 av r2d290

Benbels · 18. juni 2008

Du bør poste loggene. Det er godt mulig at det er noen rester igjen som du ikke merker, men som kan gjøre mye rart med maskinen.

combofix-logg: c:/combofix.txt

SAS-logg: start programmet, velg: Preferences->statistics/logs

HijackThis: popper opp når du starter programmet, og velger "Do a systemscan and save a logfile"

Jeg forsto ingenting så jeg kommer nok ikke til å gjøre det der.

jarlefosen · 18. juni 2008

Han mente nok at du skulle laste opp loggene fra alle programmene dine her, slik at noen kan se gjennom dem og si om det er noe rester av trojaneren eller andre ting som ikke er så veldig hyggelige

Benbels · 18. juni 2008

Han mente nok at du skulle laste opp loggene fra alle programmene dine her, slik at noen kan se gjennom dem og si om det er noe rester av trojaneren eller andre ting som ikke er så veldig hyggelige

Ojja, men det kan jeg jo gjøre

Benbels · 18. juni 2008

Logg til Hijack

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:25:09, on 18.06.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

D:\Programfiler\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Programfiler\Bonjour\mDNSResponder.exe

C:\Programfiler\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\WINDOWS\system32\nvsvc32.exe

c:\Programfiler\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Programfiler\Fellesfiler\Ulead Systems\DVD\ULCDRSvr.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\D-Link\AirPlus G\AirGCFG.exe

C:\Programfiler\ANI\ANIWZCS2 Service\WZCSLDR2.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Programfiler\ESET\ESET NOD32 Antivirus\egui.exe

D:\Programfiler\iTunes\iTunesHelper.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Programfiler\Java\jre1.6.0_05\bin\jusched.exe

C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\iPod\bin\iPodService.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\WinRAR\WinRAR.exe

C:\Programfiler\Mozilla Firefox\firefox.exe

C:\Programfiler\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programfiler\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: VIPTToolbarManager Class - {1A2641AE-2C42-4C51-A05F-8ECEC3FDC94D} - D:\Programfiler\Visual IP Trace\VisualIPTraceIE.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O3 - Toolbar: Visual IP Trace - {E70C26AE-DFF1-40A8-8D37-19180F56F0AA} - D:\Programfiler\Visual IP Trace\VisualIPTraceIE.dll

O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Programfiler\D-Link\AirPlus G\AirGCFG.exe

O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programfiler\ANI\ANIWZCS2 Service\WZCSLDR2.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\system32\winsys2.exe

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [egui] "C:\Programfiler\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "D:\Programfiler\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Programfiler\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [Visualware Security Suite] "C:\Program Files\Visualware Security Suite\tscore.exe" -autostartup

O4 - HKLM\..\Run: [TkBellExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Programfiler\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [steam] "d:\programfiler\steam\steam.exe" -silent

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O20 - Winlogon Notify: !SASWinLogon - C:\Programfiler\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Programfiler\ANI\ANIWZCS2 Service\ANIWZCSdS.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Programfiler\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Programfiler\Bonjour\mDNSResponder.exe

O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Programfiler\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: Eset Service (ekrn) - ESET - C:\Programfiler\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programfiler\Fellesfiler\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Programfiler\iPod\bin\iPodService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Programfiler\Fellesfiler\Ulead Systems\DVD\ULCDRSvr.exe

--

End of file - 6250 bytes

Combofix logg

ComboFix 08-06-16.3 - Benjamin Belsten 2008-06-17 17:29:28.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1044.18.2490 [GMT 2:00]

Running from: C:\Documents and Settings\Benjamin Belsten\Skrivebord\ComboFix.exe

* Created a new restore point

* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Documents and Settings\Benjamin Belsten\Programdata\inst.exe

C:\RECYCLER\iexplorer.exe

C:\WINDOWS\system32\tapdfan.dll

C:\WINDOWS\system32\winsys.exe

.

((((((((((((((((((((((((( Files Created from 2008-05-17 to 2008-06-17 )))))))))))))))))))))))))))))))

.

2008-06-16 19:45 . 2008-06-16 19:45 <DIR> d-------- C:\Documents and Settings\Benjamin Belsten\Programdata\Grisoft

2008-06-16 19:45 . 2008-06-16 19:45 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\Grisoft

2008-06-16 19:45 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys

2008-06-16 17:59 . 2008-06-16 17:59 13,312 --a------ C:\WINDOWS\system32\busdgan.dll

2008-06-16 17:58 . 2008-06-16 17:58 13,312 --a------ C:\WINDOWS\system32\papdfan.dll

2008-06-16 17:52 . 2008-06-16 17:52 13,312 --a------ C:\WINDOWS\system32\tuplsan.dll

2008-06-16 17:48 . 2008-06-16 17:48 13,312 --a------ C:\WINDOWS\system32\tusdgim.dll

2008-06-16 17:47 . 2008-06-16 17:47 13,312 --a------ C:\WINDOWS\system32\bosdgan.dll

2008-06-16 17:47 . 2008-06-16 17:47 13,312 --a------ C:\WINDOWS\system32\baplso.dll

2008-06-16 17:46 . 2008-06-16 17:46 13,312 --a------ C:\WINDOWS\system32\tuplsim.dll

2008-06-11 19:00 . 2008-04-14 17:54 272,256 --------- C:\WINDOWS\system32\drivers\bthport.sys

2008-06-11 19:00 . 2008-04-14 17:54 272,256 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys

2008-06-08 15:39 . 2008-06-08 15:39 <DIR> d-------- C:\Documents and Settings\Benjamin Belsten\Programdata\DivX

2008-06-03 17:41 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl

2008-05-30 19:22 . 2008-05-30 19:22 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll

2008-05-30 19:22 . 2008-05-30 19:22 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe

2008-05-30 19:22 . 2008-05-30 19:22 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb

2008-05-30 19:19 . 2008-05-30 19:19 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll

2008-05-30 19:19 . 2008-05-30 19:19 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll

2008-05-25 18:13 . 2008-05-25 18:13 <DIR> d-------- C:\Programfiler\Fellesfiler\xing shared

2008-05-25 18:13 . 2008-05-25 18:13 <DIR> d-------- C:\Programfiler\Fellesfiler\Real

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-06-16 17:32 --------- d-----w C:\Documents and Settings\Benjamin Belsten\Programdata\uTorrent

2008-06-16 15:23 --------- d-----w C:\Programfiler\Fellesfiler\Adobe

2008-06-13 14:36 --------- d---a-w C:\Documents and Settings\All Users\Programdata\TEMP

2008-06-03 15:41 --------- d-----w C:\Programfiler\Java

2008-05-25 16:13 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll

2008-05-25 16:13 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll

2008-05-20 10:56 --------- d-----w C:\Documents and Settings\Benjamin Belsten\Programdata\Vso

2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys

2008-05-07 05:16 1,290,752 ----a-w C:\WINDOWS\system32\quartz.dll

2008-04-27 07:47 --------- d-----w C:\Programfiler\StepMania

2008-04-21 07:04 658,944 ----a-w C:\WINDOWS\system32\wininet.dll

2008-04-04 18:33 315,392 ----a-w C:\WINDOWS\HideWin.exe

2008-04-04 16:22 47,360 ----a-w C:\Documents and Settings\Benjamin Belsten\Programdata\pcouffin.sys

2008-03-25 04:51 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll

2008-03-25 04:51 166,688 ----a-w C:\WINDOWS\system32\msjint40.dll

2008-03-20 08:11 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys

2004-12-02 14:31 2,870 ----a-r C:\Programfiler\e100exp.txt

2004-10-07 12:50 814 ----a-r C:\Programfiler\sldfe.txt

2004-10-07 11:00 365,560 ----a-r C:\Programfiler\e100exp.sld

2004-10-07 05:47 33,112 ----a-r C:\Programfiler\e100exp.inf

2004-08-25 08:12 25,360 ----a-w C:\Programfiler\E100ENT.sys

2004-08-19 10:25 154,112 ----a-w C:\Programfiler\e100b325.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 14:00 15360]

"MsnMsgr"="C:\Programfiler\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

"Steam"="d:\programfiler\steam\steam.exe" [2008-04-26 20:40 1271032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"D-Link AirPlus G"="C:\Programfiler\D-Link\AirPlus G\AirGCFG.exe" [2005-11-23 15:04 1544192]

"ANIWZCS2Service"="C:\Programfiler\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2005-10-19 18:19 49152]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-28 18:43 8466432]

"nwiz"="nwiz.exe" [2007-06-28 18:43 1626112 C:\WINDOWS\system32\nwiz.exe]

"WinSys2"="C:\WINDOWS\system32\winsys2.exe" [2006-04-29 05:36 208896]

"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-28 18:43 81920]

"egui"="C:\Programfiler\ESET\ESET NOD32 Antivirus\egui.exe" [2008-02-20 11:06 1443072]

"QuickTime Task"="C:\Programfiler\QuickTime\qttask.exe" [2008-03-28 23:37 413696]

"iTunesHelper"="D:\Programfiler\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]

"RTHDCPL"="RTHDCPL.EXE" [2007-08-20 09:38 16384512 C:\WINDOWS\RTHDCPL.EXE]

"SunJavaUpdateSched"="C:\Programfiler\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

"Visualware Security Suite"="C:\Program Files\Visualware Security Suite\tscore.exe" [2008-04-11 22:10 92955]

"TkBellExe"="C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" [2008-05-25 18:13 185896]

"!AVG Anti-Spyware"="D:\Programfiler\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 14:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.divxa32"= msaud32_divx.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Programfiler\\uTorrent\\uTorrent.exe"=

"C:\\Programfiler\\Windows Live\\Messenger\\msnmsgr.exe"=

"C:\\Programfiler\\Windows Live\\Messenger\\livecall.exe"=

"C:\\Programfiler\\Bonjour\\mDNSResponder.exe"=

"D:\\Programfiler\\iTunes\\iTunes.exe"=

"D:\\Programfiler\\LimeWire\\LimeWire.exe"=

"C:\\Documents and Settings\\Benjamin Belsten\\Mine dokumenter\\Downloads\\Call of Duty 4 Modern Warfare Full-Rip Skullptura\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=

"D:\\Programfiler\\Steam\\SteamApps\\brownis\\counter-strike source\\hl2.exe"=

"D:\\Programfiler\\Steam\\Steam.exe"=

"C:\\Programfiler\\Mozilla Firefox\\firefox.exe"=

R1 epfwtdir;epfwtdir;C:\WINDOWS\system32\DRIVERS\epfwtdir.sys [2008-02-20 11:11]

S2 NOD32FiXTemDono;Eset Nod32 Boot;C:\WINDOWS\system32\regedt32.exe [2006-03-02 14:00]

S3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);"c:\Programfiler\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSONY_MEDIAMGR2 []

*Newly Created Service* - AVGASCLN

*Newly Created Service* - CATCHME

.

Contents of the 'Scheduled Tasks' folder

"2008-04-03 23:52:47 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"

- C:\Programfiler\Apple Software Update\SoftwareUpdate.exe

.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-06-17 17:31:14

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-06-17 17:32:19

ComboFix-quarantined-files.txt 2008-06-17 15:31:58

Pre-Run: 31,356,485,632 byte ledig

Post-Run: 31,511,433,216 byte ledig

128 --- E O F --- 2008-06-11 20:45:12

SAS logg

SUPERAntiSpyware Scan Log

http://www.superantispyware.com

Generated 06/17/2008 at 05:56 PM

Application Version : 4.15.1000

Core Rules Database Version : 3469

Trace Rules Database Version: 1460

Scan type : Complete Scan

Total Scan Time : 00:22:47

Memory items scanned : 343

Memory threats detected : 0

Registry items scanned : 4816

Registry threats detected : 0

File items scanned : 19528

File threats detected : 16

Adware.Tracking Cookie

C:\Documents and Settings\Benjamin Belsten\Cookies\benjamin belsten@adtech[1].txt

C:\Documents and Settings\Benjamin Belsten\Cookies\benjamin belsten@tradedoubler[2].txt

C:\Documents and Settings\Benjamin Belsten\Cookies\benjamin belsten@atdmt[2].txt

C:\Documents and Settings\Benjamin Belsten\Cookies\benjamin belsten@2o7[2].txt

C:\Documents and Settings\Benjamin Belsten\Cookies\benjamin [email protected][2].txt

C:\Documents and Settings\Benjamin Belsten\Cookies\benjamin belsten@advertising[2].txt

C:\Documents and Settings\Benjamin Belsten\Cookies\benjamin [email protected][1].txt

C:\Documents and Settings\Benjamin Belsten\Cookies\benjamin belsten@mediaplex[1].txt

C:\Documents and Settings\Benjamin Belsten\Cookies\benjamin [email protected][1].txt

C:\Documents and Settings\Benjamin Belsten\Cookies\benjamin belsten@cgi-bin[1].txt

C:\Documents and Settings\Benjamin Belsten\Cookies\benjamin belsten@serving-sys[1].txt

C:\Documents and Settings\Benjamin Belsten\Cookies\benjamin [email protected][2].txt

C:\Documents and Settings\Benjamin Belsten\Cookies\benjamin [email protected][1].txt

.adtech.de [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

track.adform.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.tradedoubler.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.indextools.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

clicktorrent.info [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.doubleclick.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.imrworldwide.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.interclick.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

ad.yieldmanager.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.adecn.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

ads4.blastro.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.advertstream.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.smartadserver.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.adviva.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.smartadserver.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.kontera.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.cgm.adbureau.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.bluestreak.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.atdmt.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.tacoda.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.edge.ru4.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.atwola.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.advertising.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.2o7.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.122.2o7.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.2o7.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.tribalfusion.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.estat.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.adbrite.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.revenue.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.casalemedia.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.revsci.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.specificclick.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.statcounter.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.specificclick.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.statcounter.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.specificclick.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

adserver.socialspark.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.ads.pointroll.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.telenor.112.2o7.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.ehg-dcshoes.hitbox.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.hitbox.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.quiksilver.112.2o7.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

e2.emediate.se [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

www.backcountry.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.backcountry.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

www.backcountry.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.divx.112.2o7.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.stats.adbrite.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.socialmedia.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

date.ventivmedia.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.metacafe.122.2o7.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.overture.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.adopt.euroclick.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.clickbank.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.downloadwarez.org [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

adstats.cdfreaks.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

www.backcountry.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.ehg-utilityboardsupplyllc.hitbox.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.networksolutions.112.2o7.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.mediaplex.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.deloitte.122.2o7.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

statse.webtrendslive.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.bizrate.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.e-2dj6wfkyskcjaap.stats.esomniture.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

eas.apm.emediate.eu [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.e-2dj6wjkyepazmho.stats.esomniture.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.e-2dj6wgl4upc5clo.stats.esomniture.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.partygaming.122.2o7.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.partypoker.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.serving-sys.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.bs.serving-sys.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

findexa.adbureau.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

www.fullreleases.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.msnportal.112.2o7.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.toplist.cz [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

stat.if.no [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

ad1.emediate.dk [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.gostats.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.pro-market.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.stat.katalysatormedia.no [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

media.adrevolver.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.adrevolver.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

media.adrevolver.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.burstnet.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

ads3.blastro.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.fastclick.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.adopt.specificclick.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.realmedia.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

www3.addfreestats.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.zedo.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.adserver.easyad.info [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.dmtracker.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

rotator.adjuggler.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.apmebf.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.microsoftgamestudio.112.2o7.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.247realmedia.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

ads.revsci.net [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.hotlog.ru [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.questionmarket.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

.insightexpressai.com [ C:\Documents and Settings\Benjamin Belsten\Programdata\Mozilla\Firefox\Profiles\d0faqg04.default\cookies.txt ]

Trojan.IExplore-Recycler/Fake

C:\SYSTEM VOLUME INFORMATION\_RESTORE{B070B0EE-7655-4295-811A-E4F14004B62C}\RP71\A0006813.EXE

Adware.WhenU

D:\PROGRAMFILER\DAEMON TOOLS\SETUPDTSB.EXE

Finner dere noe ?? ^^

r2d290 · 18. juni 2008

http://virusscan.jotti.org/

Last opp, og sjekk følgende fil: C:\Program Files\Visualware Security Suite\tscore.exe

Hvis noen av programmene melder om infeksjoner, limer du inn lista her i din neste post.

Start notisblokk og lim inn det som er i fet tekst under. Lagre fila på skrivebordet som CFScript

Dra og slipp fila over combofix-iconet. Combofix vil starte igjen.

File::

C:\WINDOWS\system32\busdgan.dll

C:\WINDOWS\system32\papdfan.dll

C:\WINDOWS\system32\tuplsan.dll

C:\WINDOWS\system32\tusdgim.dll

C:\WINDOWS\system32\bosdgan.dll

C:\WINDOWS\system32\baplso.dll

C:\WINDOWS\system32\tuplsim.dll

Post loggen den lager (c:\combofix.txt), + ny HijackThis-logg.

Fortell også om du merker noen fler problemer med maskinen.

Endret 18. juni 2008 av r2d290

Logg inn

Hvordan få vekk en trojan ?

Anbefalte innlegg

Benbels

Lenke til kommentar

Videoannonse

Trainman

Lenke til kommentar

Benbels

Lenke til kommentar

b-real

Lenke til kommentar

Benbels

Lenke til kommentar

r2d290

Lenke til kommentar

Benbels

Lenke til kommentar

jarlefosen

Lenke til kommentar

Benbels

Lenke til kommentar

Benbels

Lenke til kommentar

r2d290

Lenke til kommentar

Opprett en konto eller logg inn for å kommentere

Opprett konto

Logg inn

Populær nå

Woke i moderne underholdningsindustri 1 2 3 4 199

Hvem er aktive 0 medlemmer