[LØST] Wixawin's pop-ups problem...

[pilspostei]

Jadda, jeg er en av de heldige som har fått besøk av en aldri så liten pop-up-sak, som kjører en pop-up i tide og utide. Mest uproblematisk reklame, men likefult irriterende. Bruker oftest en gammel IE, men også Firefoxen spretter opp med en overaskende side nå og da...!

 

Etter en rask sjekk i dette fora ser jeg at dette er en problematikk som flere har vært ute for, og jeg har derfor gått i gjennom veiledningen som Norbat har lagt ut.

 

Da håper jeg noen kyndige kunne ta en titt og mene noe! :-)

 

Her er logg-filene:

 

MBAM-Log:

 

Malwarebytes' Anti-Malware 1.29

Database versjon: 1289

Windows 5.1.2600 Service Pack 1

 

19.10.2008 18:56:56

mbam-log-2008-10-19 (18-56-56).txt

 

Skanntype: Rask Skann

Objekter skannet: 46855

Tid tilbakelagt: 4 minute(s), 16 second(s)

 

Minneprosesser infisert: 0

Minnemoduler infisert: 2

Registernøkler infisert: 12

Registerverdier infisert: 1

Registerfiler infisert: 2

Mapper infisert: 0

Filer infisert: 18

 

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

 

Minnemoduler infisert:

C:\WINDOWS\system32\nnnmmnnN.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\hexefe.dll (Trojan.Vundo) -> Delete on reboot.

 

Registernøkler infisert:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{67a8e170-bc86-42bd-a005-6580f907502f} (Trojan.Vundo.H) -> Delete on reboot.

HKEY_CLASSES_ROOT\CLSID\{67a8e170-bc86-42bd-a005-6580f907502f} (Trojan.Vundo.H) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d8cadfe4-81e7-4424-887f-dc661b79eaff} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\urqpifwq (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{d8cadfe4-81e7-4424-887f-dc661b79eaff} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e1237123-e415-4dcf-9dd5-a19f59b346fb} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{e1237123-e415-4dcf-9dd5-a19f59b346fb} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

 

Registerverdier infisert:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{d8cadfe4-81e7-4424-887f-dc661b79eaff} (Trojan.Vundo) -> Quarantined and deleted successfully.

 

Registerfiler infisert:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\nnnmmnnn -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\nnnmmnnn -> Delete on reboot.

 

Mapper infisert:

(Ingen mistenkelige filer funnet)

 

Filer infisert:

C:\WINDOWS\system32\nnnmmnnN.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\Nnnmmnnn.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\Nnnmmnnn.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\urqPiFWQ.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\hexefe.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\System32\efcYOGyV.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\System32\geBrsSJc.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\System32\hgGwTlJY.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kttdoi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\System32\ljJATjgD.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\System32\ljJCSljJ.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mytkwkuy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\System32\pfmaokgi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\System32\pmnkIaaX.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\swukrkip.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\System32\iifcBRKD.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.

C:\usb_2000_1800.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

 

 

 

 

Combofix-log:

 

ComboFix 08-10-18.03 - Administrator 2008-10-19 19:03:46.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.280 [GMT 2:00]

Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe

* Created a new restore point

.

 

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\Documents and Settings\Guest\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML

C:\WINDOWS\system32\drivers\fad.sys

C:\WINDOWS\system32\ohrhkmss.ini

C:\WINDOWS\system32\purydass.ini

C:\WINDOWS\system32\shrcbcor.exe

 

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Legacy_NPF

-------\Service_NPF

 

 

((((((((((((((((((((((((( Files Created from 2008-09-19 to 2008-10-19 )))))))))))))))))))))))))))))))

.

 

2008-10-19 18:50 . 2008-10-19 18:50 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes

2008-10-19 18:49 . 2008-10-19 18:50 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware

2008-10-19 18:49 . 2008-10-19 18:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes

2008-10-19 18:49 . 2008-10-16 20:25 38,496 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys

2008-10-19 18:49 . 2008-10-16 20:25 15,504 --a------ C:\WINDOWS\system32\drivers\mbam.sys

2008-10-19 17:45 . 2008-10-19 17:45 <DIR> d-------- C:\Program Files\CCleaner

2008-10-19 17:44 . 2008-10-19 17:44 2,934,168 --a------ C:\Program Files\ccsetup212.exe

2008-10-18 21:40 . 2008-10-18 21:40 3,284 --a------ C:\WINDOWS\system32\ANIWZCS{E8477936-DA89-4658-BE6F-EE44CCD1C2D8}

2008-10-18 20:33 . 2008-10-18 20:33 <DIR> d-------- C:\Program Files\Common Files\DirectX

2008-10-18 20:27 . 2008-10-18 20:27 <DIR> d-------- C:\Program Files\EA GAMES

2008-10-18 16:25 . 2008-10-18 16:25 54,156 --ah----- C:\WINDOWS\QTFont.qfn

2008-10-18 16:25 . 2008-10-18 16:25 1,409 --a------ C:\WINDOWS\QTFont.for

2008-10-16 23:33 . 2008-10-16 23:34 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\DAEMON Tools Pro

2008-10-16 23:23 . 2008-10-16 23:34 <DIR> d-------- C:\Program Files\DAEMON Tools Pro

2008-10-16 22:47 . 2008-10-16 22:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\DAEMON Tools Pro

2008-10-16 22:42 . 2008-10-16 22:42 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys

2008-10-16 21:56 . 2008-10-16 21:56 <DIR> d-------- C:\Program Files\Common Files\EasyInfo

2008-10-14 18:20 . 2000-06-22 13:09 56,320 --a------ C:\WINDOWS\system32\iyvu9_32.dll

2008-10-14 18:19 . 2008-10-14 18:19 <DIR> d-------- C:\Program Files\LEGO Media

2008-10-14 18:18 . 1998-09-02 10:02 194,320 --a------ C:\WINDOWS\system32\qcut.dll

2008-10-14 18:18 . 1998-08-17 11:21 11,776 --a------ C:\WINDOWS\system32\mciqtz.drv

2008-10-14 18:18 . 1998-08-17 11:21 10,240 --a------ C:\WINDOWS\system32\vidx16.dll

2008-10-14 18:18 . 1998-08-17 11:21 5,672 --a------ C:\WINDOWS\system32\quartz.vxd

2008-10-14 18:18 . 2008-10-14 18:18 4,608 --a------ C:\WINDOWS\system32\w95inf32.dll

2008-10-14 18:18 . 2008-10-14 18:18 2,272 --a------ C:\WINDOWS\system32\w95inf16.dll

2008-10-13 18:51 . 2008-10-13 18:51 20,348,976 --a------ C:\Saitek_SST_Software_32.exe

2008-10-13 18:50 . 2008-10-13 18:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Saitek

2008-10-13 18:47 . 2008-10-13 18:47 3,043,331 --a------ C:\Saitek_R440_Force_Wheel_SD6_32.exe

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-10-18 23:46 --------- d-----w C:\Program Files\ReGetDx

2008-10-18 14:45 --------- d-----w C:\Program Files\LimeWire

2008-10-18 14:45 --------- d-----w C:\Program Files\Common Files\Adobe

2008-10-16 20:59 --------- d-----w C:\Program Files\GameHouse

2008-10-16 20:58 --------- d-----w C:\Program Files\WMR11

2008-10-16 20:41 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Azureus

2008-10-16 15:40 --------- d--h--w C:\Program Files\InstallShield Installation Information

2008-10-14 18:34 --------- d-----w C:\Program Files\Azureus

2008-01-14 22:39 42,344 -c--a-w C:\Documents and Settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT

2006-08-25 07:05 5,118,736 ----a-w C:\Program Files\Firefox Setup 1.5.0.6.exe

2006-08-11 09:27 2,537,184 ----a-w C:\Program Files\SetupEditPadLite.exe

2006-08-11 08:59 1,458,008 ----a-w C:\Program Files\ccsetup131.exe

2006-04-28 07:50 359,112 ----a-w C:\Program Files\LimeWireWin.exe

2006-02-19 20:08 4,093,568 ----a-w C:\Program Files\LimeWire 4.10.9 Pro.exe

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Pro Agent"="C:\Program Files\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 136136]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2003-03-11 155648]

"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2003-03-11 114688]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 49263]

"DrvLsnr"="C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08 69632]

"srmclean"="C:\Cpqs\Scom\srmclean.exe" [2001-07-24 36864]

"SetRefresh"="C:\Program Files\Compaq\SetRefresh\SetRefresh.exe" [2002-08-07 485376]

"CPQEASYACC"="C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe" [2001-12-15 32768]

"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 57344]

"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 143360]

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-02-23 278528]

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-05-07 155648]

"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]

"H2O"="C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe" [2005-10-23 385024]

"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-15 35328]

"D-Link AirPlus G"="C:\Program Files\D-Link\AirPlus G\AirGCFG.exe" [2005-11-23 1544192]

"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2005-10-19 49152]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2003-03-31 13312]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=hexefe.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"midi6"= usbns4x4.dll

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"C:\\PROGRA~1\\MOZILL~1\\FIREFOX.EXE"=

 

R1 aswSP;avast! Self Protection;C:\WINDOWS\System32\drivers\aswSP.sys [2008-05-16 78416]

R3 CLEDX;Team H2O CLEDX service;C:\WINDOWS\System32\DRIVERS\cledx.sys [2005-05-09 33792]

R3 SaiHFF04;SaiHFF04;C:\WINDOWS\System32\DRIVERS\SaiHFF04.sys [2007-05-01 132232]

R3 SaiIFF04;Immersion's HID USB Driver (FF04);C:\WINDOWS\System32\DRIVERS\SaiIFF04.sys [2007-05-01 16256]

S3 cxbu0wdm;CardMan 3x21;C:\WINDOWS\System32\DRIVERS\cxbu0wdm.sys [2005-12-05 80384]

S3 DCamUSBIView;I-View NV300M USB Camera WDM Version Driver;C:\WINDOWS\System32\DRIVERS\nv300m.sys [ ]

S3 FTLUND;Lundinova Filter Driver;C:\WINDOWS\System32\drivers\ftlund.sys [2003-02-24 6828]

S3 LMASFltr;LMASFltr;C:\WINDOWS\System32\drivers\LMASFltr.sys [2002-06-10 13684]

S3 MMAUSB;M Audio USB ASIO Driver;C:\WINDOWS\System32\Drivers\MMAUSB.SYS [2002-06-10 18135]

S3 USBAS4X4;M Audio USB Quattro Midi Driver;C:\WINDOWS\System32\drivers\usbas4x4.sys [2002-06-10 32544]

.

.

------- Supplementary Scan -------

.

FireFox -: Profile - C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\lp157ow2.default\

.

 

**************************************************************************

 

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-10-19 19:06:57

Windows 5.1.2600 Service Pack 1 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\scardsvr.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.exe

C:\compaq\EAKDRV\EAUSBKBD.exe

C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe

.

**************************************************************************

.

Completion time: 2008-10-19 19:09:31 - machine was rebooted

ComboFix-quarantined-files.txt 2008-10-19 17:09:27

 

Pre-Run: 17 151 246 336 bytes free

Post-Run: 17,185,402,880 bytes free

 

winxpsp1_en_pro_bf.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

 

152

 

 

Hijackthis-log:

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:22:43, on 19.10.2008

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\WINDOWS\System32\igfxtray.exe

C:\WINDOWS\System32\hkcmd.exe

C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe

C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe

C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe

C:\Program Files\Analog Devices\SoundMAX\SMTray.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\D-Link\AirPlus G\AirGCFG.exe

C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

C:\Program Files\DAEMON Tools Pro\DTProAgent.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE

C:\Compaq\EAKDRV\EAUSBKBD.EXE

C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe

C:\WINDOWS\System32\wuauclt.exe

C:\WINDOWS\explorer.exe

C:\Program Files\internet explorer\iexplore.exe

C:\Documents and Settings\Administrator\Desktop\New Folder\HiJackThis.exe

C:\Documents and Settings\Administrator\Desktop\New Folder\nuskaremtas.exe

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.compaq.com/1Q00CDT/0409/bl7.asp

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.compaq.com/1Q00CDT/0409/bl7.asp

O2 - BHO: ClickCatcher MSIE handler - {16664845-0E00-11D2-8059-000000000000} - C:\Program Files\Common Files\ReGet Shared\Catcher.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll

O3 - Toolbar: ReGet Bar - {17939A30-18E2-471E-9D3A-56DD725F1215} - C:\Program Files\ReGetDx\iebar.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\System32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"

O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe

O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe

O4 - HKLM\..\Run: [setRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe

O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [H2O] C:\Program Files\SyncroSoft\Pos\H2O\cledx.exe

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe

O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: Do&wnload by ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_Link.htm

O8 - Extra context menu item: Download A&ll by ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_All.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

O20 - AppInit_DLLs: hexefe.dll

O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

 

--

End of file - 6594 bytes

Endret 19. oktober 2008 av pilspostei

[r2d290]

Alt ser bra ut --- Loggene dine ser ut til å være rene. Hvordan kjører PC-en?

 

Nedenfor har jeg kommet med noen anbefalinger for hvordan du kan beskytte maskinen din bedre, ved å redusere sansynligheten for å bli infisert igjen. Det er viktig at du tar disse anbefalingene serriøst; disse få enkle stegene kan gjøre at du slipper de fleste malware-problemer.

 

1) Gå til http://windowsupdate.microsoft.com og last ned alle de "kritiske oppdateringene" for Windows. Dette vil tette igjen mange av sikkerhetshullene som angripere kan bruke til å få tilgang til maskinen din. Versjonen du har nå, ser ut til å være utdatert.

 

Skru på Automatic Updates under Start -> Kontrollpanel -> Automatiske Oppdateringer, eller gjør det til en vane å sjekke regelmessig om det er kommet noen nye Windows oppdateringerer. Dette er veldig viktig!

 

2) Du bør oppdatere Java

Det er viktig å bruke den seneste versjonen av Java, siden tidligere versjoner kan inneholde sikkerhetshull som vil øke sansynligheten for at du

blir infisert igjen. Det ser ut til at din verjson av Java er utdatert

 

Oppdatere Java:

• Trykk på følgende link, og last ned nyeste versjon av Java:http://java.com/en/download/index.jsp
  

[*]Gå til Start > Kontrollpanel > Legg til/fjern programmer.

[*]Søk i listen over alle tidligere versjoner av Java (JRE, J2SE Runtime, J2RE osv.... )

Alle disse versjonene bør ha dette bildet foran:

Velg alle du finner, og trykk på Fjern

[*]Deretter installerer du den Java-versjonen som du lastet ned i starten.

Fortell hvordan det gikk med oppdateringen, da problemer med oppdatering kan indikere flere malware på systemet ditt.

 

 

3) For å kunne beskytte deg mot spyware, bør du vurdere å kjøre en av disse gratisprogrammene :

 

SUPERAntiSpyware (Velg gratisversjonen)

En veiledning for SUPERAntiSpyware finner du her

 

Malwarebytes' Anti-Malware

En veiledning for Malwarebytes' Anti-Malware finner du her

 

Pass på å holde disse programmene oppdatert og kjør dem regelmessig, siden dette kan beskytte mot en del spyware.

 

4) Vurder å bruke en annen nettleser. Mozilla's Firefox' nettleser er veldig god; den er mye sikrere enn Internet Explorer, imun mot nesten alle nettleser-kaprere, og har den beste innebygde popup blokker (som en innebygd tjeneste!) jeg noen gang har sett. Hvis du er interissert, kan du laste ned Firefox fra:

http://www.mozilla.org/products/firefox/

 

5) Pass på å kjøre antivirusprogrammet ditt regelmessig, og hold det oppdatert.

 

 

Viktig: Pass på å ha kun ett antivirusprogram. Å ha fler programmer samtidig, vil føre til kollisjon.

 

 

6) Til slutt bør du få deg en brannmur. Noen gode brannmurer er:

 

- Comodo Firewall - Windows 2000/XP/Vista - 32/64 bit

- Keiro Sunbelt Firewall - Windows 2000/XP - 32bit

- ZoneAlarm Firewall - Windows 2000/XP/Vista - 32/64 bit

- Jetico Firewall - Windows 2000/XP/Vista - 32 bit

- PC Tools firewall Plus - Windows 2000/2003 Server/XP/Vista - 32bit

- Tallemu Online Armor - Windows 2000/2003/XP - 32bit

 

Sunbelt firewall, Online Armor og ZoneAlarm finnes også i betalte versjoner.

 

Du kan se en test over brannmurer her.

Bruk den når du velger hvilken brannmur du vil beholde.

 

Ta også gjerne en titt i "wil" sin artikkel: Hvordan får dere all Spywaren og Virusene?

 

7 Jeg ser at du bruker P2P-programmet LimeWire. Husk at ukritisk bruk av slike programmer lett kan føre til nye infeksjoner. Jeg anbefaler deg å avinstallere dette, å finne alternative måter å få tak i det du laster ned.

 

Dette vil forhåpentligvis ta seg av fremtidige problemer.

 

HUSK: gi tilbakemelding på hvordan PC-en kjører, hvordan det gikk med oppdatering av Windows og oppdatering av Java.

[pilspostei]

Hei, og tusen hjerntlig takk for hjelp! Gjorde de oppdateringene på OS og Java som du skrev. Venter litt med brannmur og antispyware til jeg er ferdig med dette.

 

1. PC'en ser ut til å kjøre fint nå.

 

2. Ingen problemer med å oppdatere Java, men den ble automatisk installert før jeg fikk fjernet de tidligere Java-versjonene...

 

3. Har allerede firefox. Bruker det også.

 

4. Kjører antivirus stadig vekk, med faste oppdateringer hver dag. Har bare Avast! antivurus.

 

5. Benytter ikke Limewire. Har fjernet det, men ser at det ligger noe igjen. Skal fjerne restene også! Finnes som du sier andre, og bedre alternativer...

 

Og igjen, tusen takk for hjelpen!

[r2d290]

0. Husk at du alerede har det ene antispyware-programmet jeg testet. Nemlig MBAM...

 

1. Fint å høre

 

2. Det går sikkert bra. Fint å høre at oppdateringen gikk fint.

 

3. Den er grei. Glemte å se over combofix-loggen. Da burde jeg selvasgt sett at du hadde firefox

 

4. Ja, jeg så at du bare hadde et antivirus-program, men jeg sier det så du ikke gjør det i fremtiden .)

 

5. Hvis det er noen rester du ikke får fjernet, kan vi gjøre det vha. combofix/hijackthis

 

6. Bare hyggelig å hjelpe

 

Combofix må avinstalleres.

 

Gå til Start > Kjør

Skriv følgende i boksen:

• combofix /u
  

PS: legg merke til mellomrommet mellom X og /u

 

Trykk Enter.

 

Denne kommandoen vil:

• Fjerne følgende:
  • ComboFix og dets tilhørende filer og mapper.
    VundoFix backups, hvis de eksisterer.
    Mappen C:\Deckard, hvis den eksisterer
    Mappen C:\OtMoveIt, hvis den eksisterer
    

  [*] Nullstille klokke-instillingene.

   

  [*] Skjule filetternavn hvis det er nødvendig.

   

  [*] Skjule System/Skjulte filer og mapper hvis det er nødvendig.

   

  [*] Nullstille systemgjennoprettingspunkter.

 

Dersom du mener at problemet med maskinen din er løst, kan du endre emnetittelen din, ved å trykke på i førsteposten din, og velge full endring. Øverst der emnetittelen din er, skriver du:

[LØST]

foran emnetittelen din.

 

Eks: [LØST] Har fått virus på maskinen

 

Dette vil være med på å holde forumet mer oversiktlig for supporterne, samt at nye folk som får samme problemet lettere vil finne en passende tråd å se i.

 

-Surf trygt-

[pilspostei]

Takk igjen!

 

Combofix er ute av maskina, sammen med pop-up'ene...

 

I'm happy!

 

Da blir det å få inn en brannmur!

[r2d290]

Hvis du vil ha tips, ville jeg ha valgt Online Armor eller Comodo...

[pilspostei]

Hvis du vil ha tips, ville jeg ha valgt Online Armor eller Comodo...

 

Sjekka testen du linka til, og Comodo gjorde det veldig bra. Fikk installert det, og det virker meget bra!

 

Ikke noe problemer med maskina nå, og jeg fikk gjort en høyst nødvendig oppdatering av sikkerheten på den.