Kan noen se på loggene mine ?

Knar · 8. november 2008

Herlig å ha besøk som laster ned virus på PC'n. Det ble lasta ned en exe-fil som ble kjørt og deretter ble sletta før jeg fikk tak i den. Har vært mye tvilsom aktivitet i ettertid.. Grafikk tearing i spill og pop-ups i firefox (noe jeg aldri har hatt før).

Ble fortalt at filen var en "codec" som fulgte med denne ukas episode av Heroes. Bare at det ikke var noen Heroes episode denna uka.

Håper noen her kan hjelpe meg å analysere loggene:

Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:20:57, on 08.11.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Hardware\Mouse\point32.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\boyfriend\Desktop\Brenn\BRENN.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url="http://go.microsoft.com/fwlink/?LinkId=69157"]http://go.microsoft.com/fwlink/?LinkId=69157[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [url="http://go.microsoft.com/fwlink/?LinkId=54896"]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [url="http://go.microsoft.com/fwlink/?LinkId=54896"]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Common Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 3919 bytes

Combofix:

ComboFix 08-11-07.01 - boyfriend 2008-11-08 17:16:37.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.1570 [GMT 1:00]
Running from: c:\documents and settings\boyfriend\Desktop\ComboFix.exe

[color="RED"][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((   Files Created from 2008-10-08 to 2008-11-08  )))))))))))))))))))))))))))))))
.

2008-11-08 16:53 . 2008-11-08 16:53	<DIR>	d--------	c:\program files\Malwarebytes' Anti-Malware
2008-11-08 16:53 . 2008-11-08 16:53	<DIR>	d--------	c:\documents and settings\boyfriend\Application Data\Malwarebytes
2008-11-08 16:53 . 2008-11-08 16:53	<DIR>	d--------	c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-08 16:53 . 2008-10-22 16:10	38,496	--a------	c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-08 16:53 . 2008-10-22 16:10	15,504	--a------	c:\windows\system32\drivers\mbam.sys
2008-11-06 17:46 . 2008-11-06 17:47	<DIR>	d--------	c:\program files\Winamp
2008-11-06 17:46 . 2008-11-08 05:44	1,065	--a------	c:\windows\winamp.ini
2008-11-05 15:47 . 2008-11-05 15:47	268	--ah-----	C:\sqmdata05.sqm
2008-11-05 15:47 . 2008-11-05 15:47	244	--ah-----	C:\sqmnoopt05.sqm
2008-11-05 15:47 . 2008-11-05 15:47	172	--ah-----	C:\sqmnoopt06.sqm
2008-11-05 15:47 . 2008-11-05 15:47	172	--ah-----	C:\sqmdata06.sqm
2008-11-05 14:47 . 2008-11-05 14:47	268	--ah-----	C:\sqmdata04.sqm
2008-11-05 14:47 . 2008-11-05 14:47	244	--ah-----	C:\sqmnoopt04.sqm
2008-11-05 02:10 . 2008-11-05 02:10	268	--ah-----	C:\sqmdata03.sqm
2008-11-05 02:10 . 2008-11-05 02:10	244	--ah-----	C:\sqmnoopt03.sqm
2008-11-05 02:06 . 2008-11-05 02:06	268	--ah-----	C:\sqmdata02.sqm
2008-11-05 02:06 . 2008-11-05 02:06	244	--ah-----	C:\sqmnoopt02.sqm
2008-11-05 02:04 . 2008-11-05 02:09	96,976	--a------	c:\windows\system32\drivers\klin.dat
2008-11-05 02:04 . 2008-11-05 02:04	87,855	--a------	c:\windows\system32\drivers\klick.dat
2008-11-05 02:03 . 2008-11-05 02:03	<DIR>	d--------	c:\program files\Kaspersky Lab
2008-11-05 02:03 . 2008-11-08 17:05	<DIR>	d--------	c:\documents and settings\All Users\Application Data\Kaspersky Lab
2008-11-05 02:03 . 2008-11-08 17:03	2,426,400	--ahs----	c:\windows\system32\drivers\fidbox.dat
2008-11-05 02:03 . 2008-11-08 17:03	245,792	--ahs----	c:\windows\system32\drivers\fidbox2.dat
2008-11-05 02:03 . 2008-11-08 17:03	20,036	--ahs----	c:\windows\system32\drivers\fidbox.idx
2008-11-05 02:03 . 2008-11-08 17:03	1,920	--ahs----	c:\windows\system32\drivers\fidbox2.idx
2008-11-05 02:01 . 2008-11-05 02:01	268	--ah-----	C:\sqmdata01.sqm
2008-11-05 02:01 . 2008-11-05 02:01	244	--ah-----	C:\sqmnoopt01.sqm
2008-11-05 01:53 . 2008-11-05 01:53	268	--ah-----	C:\sqmdata00.sqm
2008-11-05 01:53 . 2008-11-05 01:53	244	--ah-----	C:\sqmnoopt00.sqm
2008-11-05 01:19 . 2008-11-05 01:19	<DIR>	d--------	c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-11-04 20:02 . 2008-11-04 20:02	108,336	--a------	c:\windows\system32\mswinsck.ocx
2008-11-01 17:45 . 2008-11-01 17:45	<DIR>	d--------	c:\documents and settings\All Users\Application Data\Fallout3
2008-11-01 17:44 . 2008-11-01 17:44	<DIR>	d--------	c:\program files\MSBuild
2008-11-01 17:42 . 2008-11-01 17:42	<DIR>	d--------	c:\windows\system32\XPSViewer
2008-11-01 17:42 . 2008-11-01 17:42	<DIR>	d--------	c:\program files\Reference Assemblies
2008-11-01 17:41 . 2006-06-29 13:07	14,048	---------	c:\windows\system32\spmsg2.dll
2008-11-01 17:40 . 2008-11-01 17:40	<DIR>	d--------	c:\windows\system32\xlive
2008-11-01 17:40 . 2008-11-01 17:40	<DIR>	d--------	c:\program files\Bethesda Softworks
2008-10-31 22:40 . 2008-10-31 22:40	<DIR>	d--------	c:\program files\CCleaner
2008-10-31 22:20 . 2008-11-05 14:48	<DIR>	d--------	c:\program files\Spybot - Search & Destroy
2008-10-31 22:20 . 2008-11-08 17:10	<DIR>	d--------	c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-29 03:50 . 2008-10-29 03:50	<DIR>	d--------	c:\documents and settings\All Users\Application Data\media center programs
2008-10-29 02:54 . 2008-10-29 02:54	<DIR>	d--------	c:\program files\Funcom
2008-10-29 02:54 . 2008-10-29 02:54	<DIR>	d--------	c:\documents and settings\All Users\Application Data\Funcom
2008-10-24 03:08 . 2008-10-15 17:34	337,408	-----c---	c:\windows\system32\dllcache\netapi32.dll
2008-10-24 02:00 . 2008-10-25 01:14	<DIR>	d--h-----	c:\windows\$hf_mig$
2008-10-23 16:18 . 2008-10-23 16:18	<DIR>	d--------	c:\program files\Ubisoft
2008-10-23 16:17 . 2008-10-23 16:17	<DIR>	d--------	c:\documents and settings\boyfriend\Application Data\InstallShield
2008-10-22 18:13 . 2008-10-22 18:13	<DIR>	d--------	c:\windows\system32\scripting
2008-10-22 18:13 . 2008-10-22 18:13	<DIR>	d--------	c:\windows\system32\en
2008-10-22 18:13 . 2008-10-22 18:13	<DIR>	d--------	c:\windows\system32\bits
2008-10-22 18:11 . 2008-10-22 18:11	<DIR>	d--------	c:\windows\ServicePackFiles
2008-10-21 17:27 . 2008-10-21 17:27	<DIR>	d--------	c:\documents and settings\boyfriend\Application Data\Ubisoft
2008-10-21 17:27 . 2008-10-21 17:27	<DIR>	d--------	c:\documents and settings\All Users\Application Data\Ubisoft
2008-10-21 17:22 . 2008-10-21 17:23	<DIR>	d--h-----	c:\windows\msdownld.tmp
2008-10-21 17:22 . 2008-10-21 17:22	<DIR>	d--------	c:\windows\Logs
2008-10-21 16:53 . 2008-10-21 16:53	<DIR>	d--------	c:\program files\7-Zip
2008-10-20 22:16 . 2008-04-14 01:11	1,888,992	---------	c:\windows\system32\ati3duag.dll
2008-10-20 22:04 . 2008-08-14 11:11	2,189,184	-----c---	c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-20 22:04 . 2008-08-14 11:09	2,145,280	-----c---	c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-20 22:04 . 2008-08-14 10:33	2,066,048	-----c---	c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-20 22:04 . 2008-08-14 10:33	2,023,936	-----c---	c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-20 22:04 . 2008-09-15 13:12	1,846,400	-----c---	c:\windows\system32\dllcache\win32k.sys
2008-10-20 22:04 . 2008-09-08 11:41	333,824	-----c---	c:\windows\system32\dllcache\srv.sys
2008-10-20 18:33 . 2008-10-20 18:33	<DIR>	d--------	c:\documents and settings\All Users\Application Data\Blizzard
2008-10-15 16:24 . 2008-10-15 16:28	<DIR>	d--------	c:\program files\Thief - Deadly Shadows
2008-10-15 02:03 . 2008-10-15 02:03	<DIR>	d--------	c:\program files\Logitech
2008-10-15 02:03 . 2008-10-15 02:03	<DIR>	d--------	c:\program files\Common Files\Logitech
2008-10-15 02:03 . 2008-10-15 02:03	<DIR>	d--------	c:\documents and settings\All Users\Application Data\Logitech
2008-10-15 01:58 . 2008-04-14 01:11	21,504	--a------	c:\windows\system32\hidserv.dll
2008-10-15 01:58 . 2008-04-13 19:39	14,592	--a------	c:\windows\system32\drivers\kbdhid.sys

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-08 00:40	---------	d-----w	c:\documents and settings\boyfriend\Application Data\uTorrent
2008-11-01 16:45	---------	d--h--w	c:\program files\InstallShield Installation Information
2008-10-21 18:39	---------	d-----w	c:\program files\Common Files\Blizzard Entertainment
2008-10-21 07:36	---------	d-----w	c:\program files\games
2008-10-21 07:34	---------	d-----w	c:\documents and settings\All Users\Application Data\Apple Computer
2008-09-28 12:41	---------	d-----w	c:\program files\uTorrent
2008-09-28 12:26	---------	d-----w	c:\documents and settings\boyfriend\Application Data\vlc
2008-09-28 12:08	---------	d-----w	c:\program files\VideoLAN
2008-09-28 12:06	---------	d-----w	c:\program files\Sun
2008-09-17 07:55	453,152	----a-w	c:\windows\system32\nvudisp.exe
2008-09-16 19:27	453,152	----a-w	c:\windows\system32\NVUNINST.EXE
2008-09-15 12:12	1,846,400	----a-w	c:\windows\system32\win32k.sys
2008-09-08 10:41	333,824	----a-w	c:\windows\system32\drivers\srv.sys
2008-08-20 05:30	666,112	----a-w	c:\windows\system32\wininet.dll
2008-08-14 10:09	2,145,280	----a-w	c:\windows\system32\ntoskrnl.exe
2008-08-14 09:33	2,023,936	----a-w	c:\windows\system32\ntkrnlpa.exe
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2006-09-14 157592]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Launch LGDCore"="c:\program files\Common Files\Logitech\G-series Software\LGDCore.exe" [2006-07-23 1126400]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2008-07-29 206088]
"nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe]
"CTHelper"="CTHELPER.EXE" [2005-08-07 c:\windows\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2005-08-07 c:\windows\system32\CTXFIHLP.EXE]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\games\\Battlefield 2142\\BF2142.exe"=
"c:\\Program Files\\games\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\games\\FEAR\\FEAR.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 32784]
R3 ha20x2k;Creative 20X HAL Driver;c:\windows\system32\drivers\ha20x2k.sys [2005-08-07 1093632]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]
S3 PciCon;PciCon;H:\PciCon.sys [ ]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6a1802b7-a82c-11dd-8dd5-0016171fdc86}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com j:
\Shell\Open\command - j:\resycled\boot.com j:

*Newly Created Service* - CATCHME
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\boyfriend\Application Data\Mozilla\Firefox\Profiles\k6ydzf6v.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.digg.com
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [url="http://www.gmer.net"]http://www.gmer.net[/url]
Rootkit scan 2008-11-08 17:18:05
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-11-08 17:18:40
ComboFix-quarantined-files.txt  2008-11-08 16:18:38
ComboFix2.txt  2008-11-08 16:07:30

Pre-Run: 57 158 803 456 bytes free
Post-Run: 57,141,039,104 bytes free

165	--- E O F ---	2008-10-25 00:14:53

Malwarebytes fant ingen ting. Alt av tips og råd mottas med stor takk.

Endret 8. november 2008 av Knar

raWrz · 8. november 2008

ser greit detta her

Knar · 8. november 2008

ser greit detta her

Takk for raskt svar

Får vel deep formatere hele faenskapet da for NOE plager maskina. Skulle gitt venstre lillefinger mot adressen til han som la ut den torrenten ;D

raWrz · 8. november 2008

ser greit detta her

Takk for raskt svar

Får vel deep formatere hele faenskapet da for NOE plager maskina. Skulle gitt venstre lillefinger mot adressen til han som la ut den torrenten ;D

ikke formater da jeg ikke leste hele posten din skal jeg ta en grundigere sjekk :whistle:

Knar · 8. november 2008

ser greit detta her

Takk for raskt svar

Får vel deep formatere hele faenskapet da for NOE plager maskina. Skulle gitt venstre lillefinger mot adressen til han som la ut den torrenten ;D

ikke formater da jeg ikke leste hele posten din skal jeg ta en grundigere sjekk

hæhæ! Setter pris på ærligheten ;D

raWrz · 8. november 2008

Sjekk følgende filer på virustotal ( http://www.virustotal.com/ ):

C:\sqmnoopt04.sqm

C:\sqmdata03.sqm

C:\sqmdata02.sqm

Endret 8. november 2008 av Submit

Knar · 8. november 2008

Sjekk følgende filer på virustotal ( http://www.virustotal.com/ ):
C:\sqmnoopt04.sqm

C:\sqmdata03.sqm

C:\sqmdata02.sqm

De var også rene..

raWrz · 8. november 2008

Sjekk følgende filer på virustotal ( http://www.virustotal.com/ ):
C:\sqmnoopt04.sqm

C:\sqmdata03.sqm

C:\sqmdata02.sqm

De var også rene..

kan du ikke laste de opp også får vi se ikke altid Mbam fjerner alt og kopier lim inn det som kommer opp

(finens ingen programmer som hvet om alle virus )

Tosha0007 · 8. november 2008

kan du ta ein runde med SUPERAntiSpyware og sjå om den finn noko Malwarebyte's ikkje finn.

SUPERAntiSpyware Free Edition

SUPERAntiSpyware Free Edition er et utmerket program til å fjerne malware på maskinen din. Det tar omtrent 30 minutter på kjøre et fullt scan. Følg veiledningen nedenfor for hvordan du installerer og bruker programmet:

Last ned SUPERAntiSpyware Free Edition fra følgende side: http://www.superantispyware.com/downloadfi...ANTISPYWAREFREE
Lagre fila på Skrivebordet
Dobbelklikk på fila SUPERAntiSpyware.exe for å starte installasjonen. Følg vanlig prossedyre for installasjon av program.

*********

Trykk på "Yes" når du blir spurt om å se etter de nyeste oppdateringene.
Vær tolmodig mens programmet laster ned oppdateringene.
I det neste vinduet som spretter opp, trykker du "Next"
Fortsett å trykke på "Next" til du ser ordet "Finish"; da skal du trykke på "Finish".
Trykk på "Protect Home Page (recommended)".
Når programmet starter opp, velger du Scan Your Computer.
Sett en hake i feltet der det står "Perform A Complete System Scan" og trykk "Next".
Den vil nå søke gjennom maskinen etter malware.
Når søket er ferdig, fjerner du alt den har funnet. Når alt er fjernet, avslutter du programmet.

Senere i veiledningen blir du spurt om å poste SUPERAntiSpyware logg. Den finner du på følgende måte:

Start programmet, Velg: Preferences->Statistics/logs

PS: Du kan godt la være å kopiere inn cookiene. Disse forteller ingenting om malware er fjernet, men avslører bl.a hvilke internettsider du har vært inne på i det siste.

edit: eg ska sjå nøyare på loggane seinare når eg har betre tid

Endret 8. november 2008 av tosha0007

Knar · 8. november 2008

kan du ta ein runde med SUPERAntiSpyware og sjå om den finn noko Malwarebyte's ikkje finn.

SUPERAntiSpyware Free Edition

SUPERAntiSpyware Free Edition er et utmerket program til å fjerne malware på maskinen din. Det tar omtrent 30 minutter på kjøre et fullt scan. Følg veiledningen nedenfor for hvordan du installerer og bruker programmet:

Last ned SUPERAntiSpyware Free Edition fra følgende side: http://www.superantispyware.com/downloadfi...ANTISPYWAREFREE

Lagre fila på Skrivebordet

Dobbelklikk på fila SUPERAntiSpyware.exe for å starte installasjonen. Følg vanlig prossedyre for installasjon av program.

*********

Trykk på "Yes" når du blir spurt om å se etter de nyeste oppdateringene.

Vær tolmodig mens programmet laster ned oppdateringene.

I det neste vinduet som spretter opp, trykker du "Next"

Fortsett å trykke på "Next" til du ser ordet "Finish"; da skal du trykke på "Finish".

Trykk på "Protect Home Page (recommended)".

Når programmet starter opp, velger du Scan Your Computer.

Sett en hake i feltet der det står "Perform A Complete System Scan" og trykk "Next".

Den vil nå søke gjennom maskinen etter malware.

Når søket er ferdig, fjerner du alt den har funnet. Når alt er fjernet, avslutter du programmet.

Senere i veiledningen blir du spurt om å poste SUPERAntiSpyware logg. Den finner du på følgende måte:

Start programmet, Velg: Preferences->Statistics/logs
PS: Du kan godt la være å kopiere inn cookiene. Disse forteller ingenting om malware er fjernet, men avslører bl.a hvilke internettsider du har vært inne på i det siste.

edit: eg ska sjå nøyare på loggane seinare når eg har betre tid

Da var det gjort. Fant 11 tracking cookies bare..

SUPERAntiSpyware Scan Log
[url="http://www.superantispyware.com"]http://www.superantispyware.com[/url]

Generated 11/08/2008 at 10:48 PM

Application Version : 4.21.1004

Core Rules Database Version : 3628
Trace Rules Database Version: 1612

Scan type       : Complete Scan
Total Scan Time : 00:15:47

Memory items scanned      : 342
Memory threats detected   : 0
Registry items scanned    : 4031
Registry threats detected : 0
File items scanned        : 12785
File threats detected     : 11

Adware.Tracking Cookie
.siba.112.2o7.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\95fos4sl.default\cookies.txt ]
.specificclick.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\95fos4sl.default\cookies.txt ]
.specificclick.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\95fos4sl.default\cookies.txt ]
.specificclick.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\95fos4sl.default\cookies.txt ]
.specificclick.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\95fos4sl.default\cookies.txt ]
.specificclick.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\95fos4sl.default\cookies.txt ]
.specificclick.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\95fos4sl.default\cookies.txt ]
.xiti.com [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\95fos4sl.default\cookies.txt ]
ads.revsci.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\95fos4sl.default\cookies.txt ]
track.adform.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\95fos4sl.default\cookies.txt ]
track.adform.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\95fos4sl.default\cookies.txt ]

raWrz · 8. november 2008

Sjekk følgende filer på virustotal ( http://www.virustotal.com/ ):
C:\sqmnoopt04.sqm

C:\sqmdata03.sqm

C:\sqmdata02.sqm

Tosha0007 · 9. november 2008

han har allereie sjekka dei filene, innlegg 7.

Til Submit:

søker du på google ser du at norbat har godtatt disse filene. http://www.google.com/search?client=opera&...-8&oe=utf-8

snippsat · 9. november 2008

sqm-filer er cache filer fra Windows Live Messenger.

Filene er helt ufarlige.

Her er guide hvordan man kan stoppe dem.

http://itpro.no/art/12933.html

Logg inn

Kan noen se på loggene mine ?

Anbefalte innlegg

Knar

Lenke til kommentar

Videoannonse

raWrz

Lenke til kommentar

Knar

Lenke til kommentar

raWrz

Lenke til kommentar

Knar

Lenke til kommentar

raWrz

Lenke til kommentar

Knar

Lenke til kommentar

raWrz

Lenke til kommentar

Tosha0007

Lenke til kommentar

Knar

Lenke til kommentar

raWrz

Lenke til kommentar

Tosha0007

Lenke til kommentar

snippsat

Lenke til kommentar

Opprett en konto eller logg inn for å kommentere

Opprett konto

Logg inn

Hvem er aktive 0 medlemmer