Victim på min windows xp

saluttknall · 17. mars 2008

Tjallabaisen! En kis har ved hjelp av en internet-side hacket seg inn på min pc. Programmet han har brukt heter Victim. Jeg har prøvd å gå inn på siden for å se hva det er han har gjort og ifølge informasjonen på siden har han koblet seg opp mot min ftp-server og laget et passord eller noe slikt. Etter dette sendte han meg en exe-fil som jeg var dum nok til å åpne. Jeg tror det var den som åpnet for hackingen. Noen kompisser sier at han har brukt en "bakdør". Jeg har nå prøvd med diverse spyware-tjenester å fikse pcen men alle krever betaling og jeg vil helst fikse dette gratis. Hva bør jeg gjøre?

fenderebest · 17. mars 2008

Tja det første du kan gjøre er å se etter mistenkelige tilkoblinger med:

netstat -a i kommandolinjen.

Se hvilket program som kommuniserer via denne porten og fjern det

saluttknall · 17. mars 2008

Hvordan åpner man kommandolinjen? (Finnes det noen hurtigtaster for å åpne den?)

snippsat · 17. mars 2008

Hvordan åpner man kommandolinjen? (Finnes det noen hurtigtaster for å åpne den?)

Start->kjør->cmd

Last ned HijackThis legg i egen mappe på skrivebordet.

Start programmet og velg "Trykk scan og save log" .

Loggfilen kopierer du og limer inn i posten din.

Helst med skjult tekst [1skjul] logg her [1/skjul] fjern 1 for skjult tekst.

saluttknall · 17. mars 2008

Her er hva den fant [

Klikk for å se/fjerne spoilerteksten nedenfor

] Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:45:46, on 17.03.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\drivers\video\services.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Programfiler\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\Programfiler\ScanSoft\OmniPagePro14.0\WorkFlowTray.exe

C:\Programfiler\ScanSoft\OmniPagePro14.0\Opware14.exe

C:\Programfiler\ScanSoft\OmniPagePro14.0\OpScheduler.exe

c:\Programfiler\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe

C:\Programfiler\QuickTime\qttask.exe

C:\Programfiler\Nokia\Nokia PC Suite 6\LaunchApplication.exe

C:\Programfiler\HighCriteria\TotalRecorder\TotRecSched.exe

C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\Programfiler\Telenor\Online Start\Telenor.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

C:\Programfiler\Java\jre1.6.0_03\bin\jusched.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\WINDOWS\system32\crypserv.exe

C:\Programfiler\F-Secure Anti-Virus\fswsclds.exe

C:\Programfiler\LogMeIn\x86\LogMeInSystray.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ctfmon.exe

C:\JAWS510\jfw.exe

C:\Programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Programfiler\Creative\MediaSource\Detector\CTDetect.exe

C:\Programfiler\Windows Media Player\WMPNSCFG.exe

C:\Programfiler\LogMeIn\x86\RaMaint.exe

C:\Programfiler\LogMeIn\x86\LogMeIn.exe

C:\Programfiler\Fellesfiler\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\PC Connectivity Solution\ServiceLayer.exe

C:\WINDOWS\system32\wscntfy.exe

C:\JAWS510\JHookLdr.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Programfiler\BitTorrent\bittorrent.exe

C:\Programfiler\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\cmd.exe

C:\Programfiler\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.no/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.fujitsu-siemens.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programfiler\google\googletoolbar2.dll (file missing)

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programfiler\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O2 - BHO: Online Start Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Programfiler\Telenor\Online Start\IEFixItNowPlugin.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programfiler\google\googletoolbar2.dll (file missing)

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [snarvei til egenskapsside for High Definition Audio] HDAShCut.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] c:\Programfiler\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Programfiler\Fellesfiler\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

O4 - HKLM\..\Run: [WorkFlowTray] "C:\Programfiler\ScanSoft\OmniPagePro14.0\WorkFlowTray.exe"

O4 - HKLM\..\Run: [Opware14] "C:\Programfiler\ScanSoft\OmniPagePro14.0\Opware14.exe"

O4 - HKLM\..\Run: [OpScheduler] "C:\Programfiler\ScanSoft\OmniPagePro14.0\OpScheduler.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programfiler\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup

O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Programfiler\HighCriteria\TotalRecorder\TotRecSched.exe"

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [Telenor Online Start] "C:\Programfiler\Telenor\Online Start\Telenor.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Programfiler\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Programfiler\LogMeIn\x86\LogMeInSystray.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [Creative Detector] C:\Programfiler\Creative\MediaSource\Detector\CTDetect.exe /R

O4 - HKCU\..\Run: [WMPNSCFG] C:\Programfiler\Windows Media Player\WMPNSCFG.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - S-1-5-18 Startup: Advarsel.exe (User 'SYSTEM')

O4 - S-1-5-18 Startup: utlånsbetingelser.rtf (User 'SYSTEM')

O4 - .DEFAULT Startup: Advarsel.exe (User 'Default user')

O4 - .DEFAULT Startup: utlånsbetingelser.rtf (User 'Default user')

O4 - .DEFAULT User Startup: Advarsel.exe (User 'Default user')

O4 - .DEFAULT User Startup: utlånsbetingelser.rtf (User 'Default user')

O4 - Startup: Advarsel.lnk = C:\Programfiler\HMS Advarsel\Advarsel.exe

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.fujitsu-siemens.com

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1098953506825

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab

O20 - Winlogon Notify: c209f9drv - C:\WINDOWS\SYSTEM32\xmlst32.dll

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: Crypkey License - Unknown owner - C:\WINDOWS\SYSTEM32\crypserv.exe

O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Programfiler\F-Secure Anti-Virus\fswsclds.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: JFWService - Freedom Scientific BLV Group, LLC - C:\JAWS510\jfw.exe

O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Programfiler\LogMeIn\x86\RaMaint.exe

O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Programfiler\LogMeIn\x86\LogMeIn.exe

O23 - Service: ServiceLayer - Nokia. - C:\Programfiler\PC Connectivity Solution\ServiceLayer.exe

--

End of file - 9018 bytes

snippsat · 17. mars 2008

Start HijackThis finn disse linjene merk dem,så trykk fixed checked.

Klikk for å se/fjerne innholdet nedenfor

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programfiler\google\googletoolbar2.dll (file missing)

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programfiler\google\googletoolbar2.dll (file missing)

O4 - S-1-5-18 Startup: Advarsel.exe (User 'SYSTEM')

O4 - S-1-5-18 Startup: utlånsbetingelser.rtf (User 'SYSTEM'

O4 - .DEFAULT Startup: Advarsel.exe (User 'Default user')

O4 - .DEFAULT Startup: utlånsbetingelser.rtf (User 'Default user')

O4 - .DEFAULT User Startup: Advarsel.exe (User 'Default user')

O4 - .DEFAULT User Startup: utlånsbetingelser.rtf (User 'Default user')

O4 - Startup: Advarsel.lnk = C:\Programfiler\HMS Advarsel\Advarsel.exe

O20 - Winlogon Notify: c209f9drv - C:\WINDOWS\SYSTEM32\xmlst32.dll

Du har rester fra f-secure som kjører.

http://www.softpedia.com/get/Tweak/Uninsta...ller-Tool.shtml

Last Combofix ned ,legg på skrivebordet.

Ikke klikk på vindu mens programet kjører.

post logg C:\combofix.txt

Endret 18. mars 2008 av SNIPPSAT

saluttknall · 17. mars 2008

Når jeg merker et element i loggen og går på fix checked kommer det opp et jeg ikke har merket noe.

snippsat · 17. mars 2008

Du starter hjt og trykk scann.

Så finner du linjene og trykk fix checked.

Er det dette du har gjort?

saluttknall · 17. mars 2008

Da fikk jeg reparert filene. Jeg lastet ned combatfix, men får ikke åpnet exe-filen. Istedenfor kommer jeg inn i et program som heter Punktum som jeg aldri har vært i før.

snippsat · 17. mars 2008

program som heter Punktum

Hmm javel.

Restart og prøv igjen,det samme?

Prøv deckcard gjør det samme.

Hent Deckard legg på skrivebord.

Kjør dss.exe og følge veiledningen.

Når scanningen er ferdig, åpnes det en logg (main.txt). Den kopierer du og poster

Endret 18. mars 2008 av SNIPPSAT

Zeph · 18. mars 2008

Denne tråden var feilpostet og er blitt flyttet til riktig kategori.

saluttknall · 18. mars 2008

Her er loggfil

snippsat · 18. mars 2008

Hmm tror du må prøve igjen,ser ingen logg fil

saluttknall · 18. mars 2008

[

Klikk for å se/fjerne spoilerteksten nedenfor

]Deckard's System Scanner v20071014.68

Run by bruker on 2008-03-18 22:09:36

Computer is in Normal Mode.

--------------------------------------------------------------------------------

Total Physical Memory: 503 MiB (512 MiB recommended).

-- HijackThis (run as bruker.exe) ----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:09:37, on 18.03.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\drivers\video\services.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Programfiler\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

C:\Programfiler\ScanSoft\OmniPagePro14.0\WorkFlowTray.exe

C:\Programfiler\ScanSoft\OmniPagePro14.0\Opware14.exe

C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

C:\Programfiler\ScanSoft\OmniPagePro14.0\OpScheduler.exe

c:\Programfiler\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe

C:\Programfiler\QuickTime\qttask.exe

C:\Programfiler\Nokia\Nokia PC Suite 6\LaunchApplication.exe

C:\Programfiler\HighCriteria\TotalRecorder\TotRecSched.exe

C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVG7\avgemc.exe

C:\Programfiler\Telenor\Online Start\Telenor.exe

C:\Programfiler\Java\jre1.6.0_03\bin\jusched.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\WINDOWS\system32\crypserv.exe

C:\Programfiler\F-Secure Anti-Virus\fswsclds.exe

C:\Programfiler\LogMeIn\x86\LogMeInSystray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Programfiler\Creative\MediaSource\Detector\CTDetect.exe

C:\Programfiler\Windows Media Player\WMPNSCFG.exe

C:\Programfiler\LogMeIn\x86\RaMaint.exe

C:\Programfiler\LogMeIn\x86\LogMeIn.exe

C:\Programfiler\Fellesfiler\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\PC Connectivity Solution\ServiceLayer.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\JAWS510\jfw.exe

F:\dss.exe

C:\PROGRA~1\TRENDM~1\HIJACK~1\bruker.exe