Virus blokerer internett?

eUnaas · 24. november 2008

Jeg har aldri vært særlig plaget av virus. Min holdning har vært at om jeg lar virusene være, plager dem meg ikke heller. Men når begynner jeg å slite litt her.

-Internett blir på en eller annen måte blokert etter en stund. Når maskinen får en reboot, virker alt som det skal igjen. Jeg mistenker at bare enkelte porter blir blokert. F,eks så virker nettradio, selv om ingen internettsider virker.

Symptomer:

-Ekstremt mange programmer krasjer når jeg prøver å gjøre dem, eller lukke dem.

-Minnepenner har begynnt å viste seg som mapper, istede for "harddsik ikoner"

-MSN har blitt blokkert, fordi pcen min prøvde å logge på x antall tusen ganger i løpet av kort tid.

Jeg har avg virus scann, Ad-aware, og har prøvd å gjøre noen internett virus scannere. Men jeg har mistet litt av tilliten til disse programmene nå, for i blandt virker det som de finner noen slemme filer her og der, i blandt får jeg spørsmål om å fjerne dem, andre ganger ikke. Noenganger finner de bare filer på andre scann osv...

Noen som har noen tips?

r2d290 · 24. november 2008

Følg veiledningen som er linket til i øverste link i signaturen min. Post loggene her

eUnaas · 24. november 2008

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 14

Registerverdier infisert: 2

Registerfiler infisert: 0

Mapper infisert: 1

Filer infisert: 7

...Så noe er nok ikke riktig nei.

Tosha0007 · 24. november 2008

post heile loggen er du snill. I tillegg ta med ein Combofix logg

Last ned Combofix (av sUBs), og legg det på Skrivebordet.

Kjør combofix.exe, og følg veiledningen. Du får et spørsmål om at "Roughly 1/100 machines failed to make it through the disinfection process!! Are you sure you want to do this??" - Svar Yes

Du må ikke klikke på vinduet mens programmet kjører. Dette kan føre til at programmet fryser.

Hva gjør ComboFix:

- ComboFix er et multifix-program som er laget for å fjerne en hel del kjente infeksjoner, samt lager en logg/rapport som viser filer/prosesser/registeroppføringer som ligger på PC-en. Loggen kan avgjøre om det fortsatt ligger noe på PC-en som skal fjernes. Det kreves da at noen med erfaring kan lese loggen og fortelle hvordan man skal gå videre.

PS: Combofix vil blant ramse opp alle filer som har blitt opprettet den siste måneden, og kan i enkelte tilfeller også fortelle fullt navn og annen informasjon som kan betraktes som sensitiv. Av den grunn bør du gå gjennom loggen og se om du finner informasjon du ikke vil dele med alle, og sensurere det.

Post loggfilen fra Combofix (c:\combofix.txt)

Endret 24. november 2008 av tosha0007

eUnaas · 24. november 2008

Så, dere klarer å lese fornuft ut av loggene?

ComboFix

ComboFix 08-11-23.02 - eUnaas 2008-11-24 19:05:00.1 - NTFSx86

Microsoft Windows XP Professional [GMT 1:00]

Running from: c:\documents and settings\eUnaas\Skrivebord\ComboFix.exe

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\eUnaas\Lokale innstillinger\Programdata\Microsoft\Windows Media\10.0\WMSDKNSD.XML

c:\windows\system32\EeKkkUvw.ini

c:\windows\system32\EeKkkUvw.ini2

c:\windows\system32\jpsmspbk.ini

c:\windows\system32\lsprst7.dll

c:\windows\system32\oolpdony.ini

c:\windows\system32\ruqxxnls.ini

c:\windows\system32\ssprs.dll

E:\install.exe

.

((((((((((((((((((((((((( Files Created from 2008-10-24 to 2008-11-24 )))))))))))))))))))))))))))))))

.

2008-11-24 18:54 . 2008-11-24 19:02 <DIR> d-------- c:\programfiler\Malwarebytes' Anti-Malware

2008-11-24 18:54 . 2008-11-24 18:54 <DIR> d-------- c:\documents and settings\eUnaas\Programdata\Malwarebytes

2008-11-24 18:54 . 2008-11-24 18:54 <DIR> d-------- c:\documents and settings\All Users\Programdata\Malwarebytes

2008-11-24 18:54 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2008-11-24 18:54 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2008-11-23 17:16 . 2008-11-23 17:17 <DIR> d-------- c:\programfiler\Bongo 1.0

2008-11-23 02:42 . 2006-03-06 05:10 1,232,896 --a------ c:\windows\system32\WibuKe32.cpl

2008-11-23 02:42 . 2006-03-06 05:10 573,440 --a------ c:\windows\system32\wibuKJni.dll

2008-11-23 02:42 . 2006-03-06 05:11 507,904 --a------ c:\windows\system32\WibuXpm4J32.dll

2008-11-23 02:42 . 2005-07-25 04:01 356,352 --a------ c:\windows\system32\WkExt32.dll

2008-11-23 02:42 . 2006-03-06 05:10 139,264 --a------ c:\windows\system32\WkWin32.dll

2008-11-23 02:42 . 2006-03-06 05:10 72,192 --a------ c:\windows\system32\drivers\WibuKey.sys

2008-11-23 02:42 . 2000-10-18 02:00 57,552 --a------ c:\windows\system32\WkDos.exe

2008-11-23 02:42 . 2006-03-06 05:10 54,336 --a------ c:\windows\system\WkWin.dll

2008-11-23 02:42 . 2004-09-02 03:10 17,408 --a------ c:\windows\system32\drivers\Wibukey2.sys

2008-11-23 02:41 . 2008-11-23 02:41 <DIR> d-------- c:\programfiler\WIBUKEY

2008-11-23 02:41 . 2008-11-23 02:41 <DIR> d-------- c:\programfiler\WIBU-SYSTEMS

2008-11-23 02:41 . 2008-11-23 02:41 <DIR> d-------- c:\programfiler\Fellesfiler\ChaosGroup

2008-11-23 02:41 . 2008-11-23 02:41 <DIR> d-------- c:\programfiler\Chaos Group

2008-11-17 01:35 . 2008-11-20 23:21 16,827 --a------ c:\windows\system32\drivers\hosts

2008-11-17 01:35 . 2008-11-20 23:21 6,656 --a------ c:\documents and settings\eUnaas\planet.exe

2008-11-14 19:30 . 2008-11-14 19:30 244 --ah----- C:\sqmnoopt03.sqm

2008-11-14 19:30 . 2008-11-14 19:30 232 --ah----- C:\sqmdata03.sqm

2008-11-12 21:43 . 2008-11-12 21:43 <DIR> d-------- c:\programfiler\Fellesfiler\BinarySense

2008-11-12 21:43 . 2008-11-12 21:43 <DIR> d-------- c:\programfiler\BinarySense

2008-11-08 00:11 . 2008-11-08 00:11 <DIR> d-------- c:\documents and settings\All Users\Programdata\ALM

2008-11-08 00:05 . 2008-11-08 00:05 <DIR> d-------- c:\programfiler\Fellesfiler\Adobe AIR

2008-11-06 23:08 . 2008-11-06 23:09 <DIR> d-------- c:\documents and settings\eUnaas\Programdata\Autodesk

2008-11-06 23:00 . 2008-11-06 23:00 <DIR> d-------- c:\programfiler\turbo squid tentacles

2008-11-06 22:57 . 2008-11-06 22:57 231 --a------ c:\windows\system32\3dsmax.ini

2008-11-06 22:57 . 2008-11-06 22:57 43 --a------ c:\windows\system32\InstallSettings.ini

2008-11-06 22:56 . 2008-11-06 22:58 <DIR> d-------- c:\programfiler\Fellesfiler\Autodesk Shared

2008-11-06 22:55 . 2008-11-06 22:58 <DIR> d-------- c:\programfiler\Autodesk

2008-11-06 22:55 . 2008-11-12 09:56 <DIR> d-------- c:\documents and settings\All Users\Programdata\Autodesk

2008-11-06 22:54 . 2007-05-16 16:45 3,497,832 --a------ c:\windows\system32\d3dx9_34.dll

2008-11-06 22:54 . 2006-11-29 13:06 3,426,072 --a------ c:\windows\system32\d3dx9_32.dll

2008-11-06 22:54 . 2006-09-28 16:05 2,414,360 --a------ c:\windows\system32\d3dx9_31.dll

2008-11-06 22:54 . 2007-05-16 16:45 1,124,720 --a------ c:\windows\system32\D3DCompiler_34.dll

2008-11-06 22:54 . 2007-05-16 16:45 443,752 --a------ c:\windows\system32\d3dx10_34.dll

2008-11-05 05:32 . 2008-11-05 05:32 <DIR> d-------- c:\documents and settings\All Users\Programdata\Minnetonka Audio Software

2008-11-05 05:32 . 2008-11-05 05:32 1,025 --a------ c:\windows\system32\sysprs7.tgz

2008-11-05 05:32 . 2008-11-05 05:32 1,025 --a------ c:\windows\system32\sysprs7.dll

2008-11-05 05:32 . 2008-11-05 05:32 1,025 --a------ c:\windows\system32\clauth2.dll

2008-11-05 05:32 . 2008-11-05 05:32 1,025 --a------ c:\windows\system32\clauth1.dll

2008-11-05 05:32 . 2008-11-05 05:32 219 --a------ c:\windows\system32\lsprst7.tgz

2008-11-05 05:32 . 2008-11-05 05:32 87 --a------ c:\windows\system32\ssprs.tgz

2008-11-05 04:51 . 2008-11-05 04:51 <DIR> d-------- c:\documents and settings\eUnaas\Programdata\vlc

2008-11-03 01:23 . 2008-11-03 01:23 <DIR> d-------- c:\documents and settings\All Users\Programdata\TSplines

2008-11-03 01:17 . 2008-11-03 01:17 <DIR> d-------- c:\documents and settings\All Users\Programdata\ASGvis

2008-11-03 01:17 . 2008-05-27 08:34 200,704 --a------ c:\windows\system32\BongoSDK.10.v40.dll

2008-11-03 01:16 . 2008-11-03 01:16 <DIR> d-------- c:\documents and settings\All Users\Programdata\InstallShield

2008-11-03 01:15 . 2005-08-11 17:29 73,728 --a------ c:\windows\system32\ISUSPM.cpl

2008-11-03 01:14 . 2008-11-24 19:08 <DIR> d-------- c:\programfiler\T-Splines for Rhino

2008-11-02 21:47 . 2008-11-02 21:50 <DIR> d-------- c:\programfiler\Flamingo 1.1

2008-11-02 21:28 . 2008-11-02 21:31 <DIR> d-------- c:\programfiler\Rhinoceros 3.0

2008-11-02 21:28 . 2008-11-02 21:28 <DIR> d-------- c:\programfiler\Common Files

2008-11-02 21:28 . 2006-03-31 09:39 724,992 --a------ c:\windows\system32\RhinoShExt.dll

2008-11-01 01:34 . 2008-11-01 01:34 <DIR> d-------- c:\programfiler\MagicDisc

2008-11-01 01:34 . 2008-07-28 17:19 116,736 --a------ c:\windows\system32\drivers\mcdbus.sys

2008-10-31 18:02 . 2008-10-31 20:09 <DIR> d-------- c:\programfiler\AV Vcs 6.0 DIAMOND

2008-10-31 14:35 . 2008-10-31 14:37 <DIR> d-------- C:\vcs5core

2008-10-31 14:35 . 2008-11-01 00:36 <DIR> d-------- C:\vcs5BGEffects

2008-10-31 14:35 . 2008-10-31 14:35 <DIR> d-------- C:\AV_LOGS

2008-10-31 14:22 . 2008-10-31 14:22 <DIR> d-------- c:\programfiler\Audacity

2008-10-26 00:29 . 2008-10-26 00:29 <DIR> d-------- c:\programfiler\Symbian

2008-10-26 00:27 . 2008-10-26 00:40 <DIR> d-------- c:\programfiler\Sony Ericsson

2008-10-26 00:27 . 2008-10-26 00:29 <DIR> d-------- c:\programfiler\Fellesfiler\Sony Ericsson Shared

2008-10-26 00:27 . 2008-10-26 00:27 <DIR> d-------- c:\documents and settings\All Users\Programdata\Teleca

2008-10-26 00:23 . 2008-10-26 00:23 244 --ah----- C:\sqmnoopt02.sqm

2008-10-26 00:23 . 2008-10-26 00:23 232 --ah----- C:\sqmdata02.sqm

2008-10-26 00:21 . 2008-10-26 00:21 244 --ah----- C:\sqmnoopt01.sqm

2008-10-26 00:21 . 2008-10-26 00:21 232 --ah----- C:\sqmdata01.sqm

2008-10-25 19:35 . 2008-11-05 04:45 <DIR> d-------- c:\programfiler\K-Lite Codec Pack

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-11-23 17:21 --------- d-----w c:\documents and settings\eUnaas\Programdata\dvdcss

2008-11-23 01:39 --------- d-----w c:\documents and settings\eUnaas\Programdata\uTorrent

2008-11-22 18:45 --------- d-----w c:\documents and settings\eUnaas\Programdata\CoreFTP

2008-11-11 17:35 --------- d-----w c:\documents and settings\All Users\Programdata\Microsoft Help

2008-11-07 23:09 --------- d-----w c:\programfiler\Fellesfiler\Adobe

2008-11-06 22:05 --------- d-----w c:\documents and settings\All Users\Programdata\WinZip

2008-11-03 12:10 --------- d-----w c:\documents and settings\All Users\Programdata\McNeel

2008-11-03 00:17 --------- d--h--w c:\programfiler\InstallShield Installation Information

2008-11-03 00:15 --------- d-----w c:\programfiler\Fellesfiler\InstallShield

2008-11-02 20:59 --------- d-----w c:\programfiler\Rhinoceros 4.0

2008-11-01 00:15 --------- d-----w c:\programfiler\ISOpen

2008-10-29 15:06 --------- d-----w c:\programfiler\Google

2008-10-25 23:29 --------- d-----w c:\programfiler\Fellesfiler\Teleca Shared

2008-10-25 23:27 --------- d-----w c:\documents and settings\All Users\Programdata\Sony Ericsson

2008-10-22 00:46 400 ----a-w c:\windows\system32\drivers\egxkxz_445.set

2008-10-22 00:46 400 ----a-w c:\windows\system32\drivers\biusvhm144.dat

2008-10-21 22:16 --------- d-----w c:\programfiler\CES EduPack 2008

2008-10-21 22:13 27,136 ----a-w c:\windows\~GLH0000.TMP

2008-10-18 10:06 --------- d-----w c:\programfiler\HD Tune Pro

2008-10-18 08:05 --------- d-----w c:\programfiler\Java

2008-10-16 22:17 --------- d-----w c:\programfiler\Namebadge

2008-10-14 21:12 --------- d-----w c:\programfiler\iTunes

2008-10-14 21:12 --------- d-----w c:\documents and settings\All Users\Programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

2008-10-14 21:11 --------- d-----w c:\programfiler\iPod

2008-10-12 12:09 --------- d-----w c:\programfiler\Fellesfiler\McNeel Shared

2008-10-08 23:28 --------- d-----w c:\programfiler\Imagenomic

2008-10-05 00:15 --------- d-----w c:\programfiler\Universal Extractor

2008-10-01 11:01 32,000 ----a-w c:\windows\system32\drivers\usbaapl.sys

2008-09-28 21:19 --------- d-----w c:\documents and settings\eUnaas\Programdata\TeamViewer

2008-09-28 20:33 --------- d-----w c:\programfiler\TeamViewer3

2008-09-16 00:14 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll

2008-09-16 00:12 81,920 ----a-w c:\windows\system32\dpl100.dll

2008-09-16 00:11 683,520 ----a-w c:\windows\system32\divx.dll

2008-09-08 15:51 737,280 ----a-w c:\windows\iun6002.exe

2008-08-29 08:18 87,336 ----a-w c:\windows\system32\dns-sd.exe

2008-08-29 07:53 61,440 ----a-w c:\windows\system32\dnssd.dll

2007-03-13 22:20 35,979 ----a-w c:\programfiler\Photoshop CS3 Read Me.html

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HDDtemp4"="c:\programfiler\BinarySense\HDDTemp4\\hddtemp4" [X]

"MsnMsgr"="c:\programfiler\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"mRouterConfig"="c:\programfiler\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe" [2006-03-02 290816]

"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\programfiler\Fellesfiler\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\System32\igfxtray.exe" [2005-04-05 94208]

"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2005-04-05 77824]

"Persistence"="c:\windows\System32\igfxpers.exe" [2005-04-05 114688]

"GrooveMonitor"="c:\programfiler\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]

"SunJavaUpdateSched"="c:\programfiler\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]

"Adobe Reader Speed Launcher"="c:\programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]

"Adobe Photo Downloader"="c:\programfiler\Adobe\Adobe Photoshop Lightroom 1.4\apdproxy.exe" [2008-04-01 61440]

"NeroFilterCheck"="c:\programfiler\Fellesfiler\Nero\Lib\NeroCheck.exe" [2008-02-28 570664]

"NBKeyScan"="c:\programfiler\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-09-30 1234712]

"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]

"Jet Detection"="c:\programfiler\Creative\SBLive\PROGRAM\ADGJDet.exe" [2001-11-29 28672]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-20 8429568]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-04-20 81920]

"UltraMon"="c:\programfiler\UltraMon\UltraMon.exe" [2006-10-12 304640]

"QuickTime Task"="c:\programfiler\QuickTime\qttask.exe" [2008-09-06 413696]

"AppleSyncNotifier"="c:\programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]

"iTunesHelper"="c:\programfiler\iTunes\iTunesHelper.exe" [2008-10-01 289576]

"PC Suite for Smartphones"="c:\programfiler\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" [2007-12-25 548864]

"AdobeCS4ServiceManager"="c:\programfiler\Fellesfiler\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]

"WINDVDPatch"="CTHELPER.EXE" [2002-07-02 c:\windows\system32\CTHELPER.EXE]

"nwiz"="nwiz.exe" [2007-04-20 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\eUnaas\Start-meny\Programmer\Oppstart\

MagicDisc.lnk - c:\programfiler\MagicDisc\MagicDisc.exe [2008-11-01 575488]

OneNote 2007 Screen Clipper og Launcher.lnk - c:\programfiler\Microsoft Office\Office12\ONENOTEM.EXE [2007-08-24 101784]

c:\documents and settings\All Users\Start-meny\Programmer\Oppstart\

PC-s›k i Windows.lnk - c:\programfiler\Windows Desktop Search\WindowsSearch.exe [2007-02-05 118784]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\programfiler\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.l3fhg"= mp3fhg.acm

"msacm.divxa32"= divxa32.acm

"VIDC.X264"= x264vfw.dll

"VIDC.HFYU"= huffyuv.dll

"vidc.i263"= i263_32.drv

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Programfiler\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Programfiler\\Windows Live\\Messenger\\livecall.exe"=

"c:\\Programfiler\\uTorrent\\uTorrent.exe"=

"c:\\Programfiler\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=

"c:\\Programfiler\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Programfiler\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Programfiler\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Programfiler\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Programfiler\\Intuwave\\Shared\\mRouterRuntime\\mRouterRuntime.exe"=

"c:\\Programfiler\\LimeWire\\LimeWire.exe"=

"c:\\Programfiler\\Sony Ericsson\\Mobile4\\Sync Manager\\DXP SyncML.exe"=

"c:\\Programfiler\\AVG\\AVG8\\avgupd.exe"=

"c:\\Programfiler\\Sony Ericsson\\Update Service\\Update Service.exe"=

"c:\\Programfiler\\Bonjour\\mDNSResponder.exe"=

"c:\\Programfiler\\TeamViewer3\\TeamViewer.exe"=

"c:\\Programfiler\\iTunes\\iTunes.exe"=

"c:\\Programfiler\\Rhinoceros 4.0\\System\\Rhino4.exe"=

"c:\\Programfiler\\Autodesk\\Backburner\\monitor.exe"=

"c:\\Programfiler\\Autodesk\\Backburner\\manager.exe"=

"c:\\Programfiler\\Autodesk\\Backburner\\server.exe"=

"c:\\Programfiler\\Autodesk\\3ds Max 2008\\3dsmax.exe"=

"c:\\Programfiler\\Fellesfiler\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"5353:TCP"= 5353:TCP:Adobe CSI CS4

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-07-06 97928]

R2 adfs;adfs;c:\windows\system32\drivers\adfs.sys [2008-08-14 74720]

R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-07-06 231704]

R2 HDD & SSD access service;HDD & SSD access service;c:\programfiler\Fellesfiler\BinarySense\disksvc.exe [2008-11-06 174848]

R2 UltraMonUtility;UltraMon Utility Driver;\??\c:\programfiler\Fellesfiler\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys [2006-09-24 11776]

R3 UltraMonMirror;UltraMonMirror;c:\windows\system32\DRIVERS\UltraMonMirror.sys [2006-09-24 3584]

R3 zebrceb;Sony Ericsson Cable Emulation Bus (WDM);c:\windows\system32\DRIVERS\zebrceb.sys [2008-06-23 63360]

S3 USBAAPL;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl.sys [2008-05-21 32000]

S3 zebrbus;Sony Ericsson Composite Device driver;c:\windows\system32\DRIVERS\zebrbus.sys [2008-06-23 83200]

S3 zebrmdfl;Sony Ericsson Modem Filter;c:\windows\system32\DRIVERS\zebrmdfl.sys [2008-06-23 14848]

S3 zebrmdm;Sony Ericsson Port (WDM);c:\windows\system32\DRIVERS\zebrmdm.sys [2008-06-23 109568]

S3 zebrmdmc;Sony Ericsson mRouter Port (WDM);c:\windows\system32\DRIVERS\zebrmdmc.sys [2008-06-23 109568]

S3 zebrsce;Sony Ericsson PC-Connect Port;c:\windows\system32\DRIVERS\zebrsce.sys [2008-06-23 91264]

S4 hpt3xx;hpt3xx; []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

.

Contents of the 'Scheduled Tasks' folder

2008-11-18 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\programfiler\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

.

- - - - ORPHANS REMOVED - - - -

BHO-{CDA0AA86-BEFD-4F6C-A25F-0E4269610EC4} - c:\windows\system32\wvUkkKeE.dll

HKCU-Run-AdobeBridge - (no file)

.

------- Supplementary Scan -------

.

FireFox -: Profile - c:\documents and settings\eUnaas\Programdata\Mozilla\Firefox\Profiles\4a4w5d3l.default\

FF -: plugin - c:\documents and settings\eUnaas\Lokale innstillinger\Programdata\myVRnpapi\npmyvr.dll

FF -: plugin - c:\programfiler\iTunes\Mozilla Plugins\npitunes.dll

FF -: plugin - c:\programfiler\Mozilla Firefox\plugins\npOGAPlugin.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-11-24 19:10:01

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(664)

c:\programfiler\Fellesfiler\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

.

------------------------ Other Running Processes ------------------------

.

c:\programfiler\Lavasoft\Ad-Aware\aawservice.exe

c:\programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\programfiler\Fellesfiler\Autodesk Shared\Service\AdskScSrv.exe

c:\programfiler\Bonjour\mDNSResponder.exe

c:\programfiler\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe

c:\windows\system32\nvsvc32.exe

c:\windows\system32\IoctlSvc.exe

c:\windows\system32\wdfmgr.exe

c:\windows\system32\searchindexer.exe

c:\windows\system32\rundll32.exe

c:\programfiler\BinarySense\HDDTemp4\HDDtemp4.exe

c:\programfiler\Intuwave\Shared\mRouterRuntime\mRouterRuntime.exe

c:\programfiler\Fellesfiler\Teleca Shared\logger.exe

c:\programfiler\Fellesfiler\Teleca Shared\Generic.exe

c:\progra~1\Symbian\Shared\SYMBIA~1\SYMBIA~1.EXE

c:\progra~1\Symbian\Shared\SYMBIA~1\SCBAL.exe

c:\programfiler\Fellesfiler\Nero\Lib\NMIndexingService.exe

c:\programfiler\iPod\bin\iPodService.exe

c:\windows\system32\msiexec.exe

c:\windows\system32\searchprotocolhost.exe

c:\programfiler\AVG\AVG8\avgrsx.exe

c:\windows\system32\searchfilterhost.exe

.

**************************************************************************

.

Completion time: 2008-11-24 19:15:18 - machine was rebooted

ComboFix-quarantined-files.txt 2008-11-24 18:15:15

Pre-Run: 24 049 782 784 byte ledig

Post-Run: 28,335,828,992 byte ledig

296 --- E O F --- 2008-06-26 01:00:48[/code]

Malwarebytes

Malwarebytes' Anti-Malware 1.30
Database versjon: 1419

Windows 5.1.2600 Service Pack 3

24.11.2008 19:03:24

mbam-log-2008-11-24 (19-03-24).txt

Skanntype: Rask Skann

Objekter skannet: 62337

Tid tilbakelagt: 6 minute(s), 12 second(s)

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 14

Registerverdier infisert: 2

Registerfiler infisert: 0

Mapper infisert: 1

Filer infisert: 7

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

Minnemoduler infisert:

(Ingen mistenkelige filer funnet)

Registernøkler infisert:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{20e59ca2-78b0-4431-bfd0-d8b5adfc0056} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ljjdwqjd (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{20e59ca2-78b0-4431-bfd0-d8b5adfc0056} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fd54da38-8979-4cb4-9c01-43f644e6e894} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{fd54da38-8979-4cb4-9c01-43f644e6e894} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{20e59ca2-78b0-4431-bfd0-d8b5adfc0056} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.

Registerverdier infisert:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{20e59ca2-78b0-4431-bfd0-d8b5adfc0056} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5cc57b96 (Trojan.Vundo) -> Quarantined and deleted successfully.

Registerfiler infisert:

(Ingen mistenkelige filer funnet)

Mapper infisert:

C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013 (Trojan.Agent) -> Delete on reboot.

Filer infisert:

C:\WINDOWS\system32\ljJDWQJd.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\pwogmn.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (Trojan.Agent) -> Quarantined and deleted successfully.

C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\reg32.exe (Trojan.Agent) -> Delete on reboot.

C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.

C:\WINDOWS\hosts (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.

Endret 25. november 2008 av eunaas

r2d290 · 24. november 2008

Så, dere klarer å lese fornuft ut av loggene?

Ja, det er liksom det vi er her for

Legg merke til at alle instruksjonene som blir gitt i denne tråden er skreddersydd for denne maskinen, og at verktøyene som blir brukt her, kan forårsake skade på en annen maskin med andre typer infeksjoner.

Hvis du tror du har det samme problemet, bør du følge veiledningen til norbat, og poste loggene i en ny tråd.

Hallo

Mitt navn er r2d290, og jeg skal være med på å hjelpe deg med å fjerne alle infeksjoner du måtte ha på PC-en.

Det kommer til å bli gitt en rekke instruksjoner som må bli fulgt i den rekkefølgen vi skriver dem i.
Hvis det er en instruksjon du ikke forstår, du er usikker på noe, eller det skjer noe uventet, må du ikke gjette/gå videre, men skrive en post på forumet der du spør om det du lurer på.
Ikke start flere tråder (hverken her på diskusjon.no eller på andre forum). Dette vil bare forvirre oss som driver support.
Det kan hende at opperasjonen vil gå i flere ledd, og det kan hende det tar litt tid før du får svar, men vi gir oss ikke hvis ikke du gjør det.
Ikke gi opp og formater PC-en (selvom noen sier at det er det eneste som hjelper). Det er svært usansynlig at man må formatere grunnet virus.
I noen tilfeller hender det at tråder går oss hus forbi, så hvis du ikke har fått svar innen 24 timer kan det være lurt å skrive en liten "purre-post" så tråden din havner øverst på lista.

Hvis du følger disse instruksjonene, skal vi nok få fikset problemet med maskinen.

Jeg analyserer loggene dine nå, og vil komme tilbake med respons så snart jeg kan...

PS: Det kan hende at sikkerhetsprogrammene dine gir advarsler på noen av verktøyene vi ber deg om å bruke.

sikkerhetsprogrammene kan ikke vite om verktøyene har gode eller dårlige hensikter. Verktøyene blir brukt av profesjonelle rundt om i hele verden, så du kan stole på at programmene er trygge.

r2d290 · 24. november 2008

P2P Advarsel!

Viktig Loggene viser at det finnes ett eller fler P2P (Person to Person) fildelingsprogram på maskinen din.

LimeWire

Vær klar over at så lenge du bruker noen form for Peer-to-Peer nettverk for å laste ned filer fra en "uoffisiell" kilde, må du gå ut ifra at maskinen din kan bli infisert.
Før i tiden ble P2P fildeling regnet som ganske trygt. Dette er ikke lenger tilfelle. Du kan fortsette å bruke P2P på din egen risiko, men husk at dette kan være kilden til din nåværende eller neste infeksjon.

Referanser om risikoen for disse programmene, kan du finne i disse linkene:

http://www.microsoft.com/windows/ie/commun...protection.mspx
http://www.techweb.com/wire/160500554
http://www.internetworldstats.com/articles/art053.htm
Se en liste over rene/risikable P2P-programmer her: http://p2p.malwareremoval.com/

Jeg anbefaler at du avinstallerer de nevnte programmene, men valget er ditt. Hvis du velger å fjerne disse programmene, kan du gjøre det fra Kontrollpanel->Legg til/fjern programmer.

Hvis du ønsker å beholde programmet, ber jeg deg om å ikke bruke det før maskinen er ren for malware.

Gå til http://virusscan.jotti.org , trykk på Browse, og last opp følgende fil til analyse:

c:\windows\system32\WkWin32.dll

c:\windows\system32\drivers\WibuKey.sys

c:\windows\system32\WkDos.exe

c:\documents and settings\eUnaas\planet.exe

c:\windows\system32\drivers\egxkxz_445.set

c:\windows\system32\drivers\biusvhm144.dat

Deretter trykker du på Submit. Godta at filen blir scannet. Til slutt kopierer du resultatet, og limer det inn i din neste post, så jeg kan se på den, og vurdere hva som må gjøres videre.

Trykk Start - Alle Programmer - Tilbehør - Notisblokk

Kopier og Lim inn teksten i kodeboksen nedenfor, inn i Notisblokken:

File::
c:\windows\~GLH0000.TMP




DirLook::
c:\windows\system32\drivers\hosts

Lagre det som CFScript på Skrivebordet

Dra CFScript over ComboFix.exe som ligger på Skrivebordet, slik animasjonen nedenfor viser.

Dette vil starte ComboFix igjen. Hvis maskinen ber om en omstart, lar du den gjøre det med én gang.

Post innholdet til ComboFix.txt inn i ditt neste svar på forumet.

eUnaas · 25. november 2008

Det var en litt morrsom scanner. Den Found nothing på alle filene, bortsett fra planet.exe. Hva er det for en fil?

File: planet.exe

Status:

INFECTED/MALWARE

MD5: 72908156b0025f7ef4ddef1dde224475

Packers detected:

-

Scanner results

Scan taken on 25 Nov 2008 07:22:41 (GMT)

A-Squared

Found Packer.Krunchy.B!IK

AntiVir

Found HEUR/Crypted

ArcaVir

Found nothing

Avast

Found nothing

AVG Antivirus

Found nothing

BitDefender

Found Packer.Krunchy.B

ClamAV

Found nothing

CPsecure

Found nothing

Dr.Web

Found nothing

F-Prot Antivirus

Found nothing

F-Secure Anti-Virus

Found nothing

G DATA

Found Packer.Krunchy.B

Ikarus

Found Packer.Krunchy.B

Kaspersky Anti-Virus

Found nothing

NOD32

Found nothing

Norman Virus Control

Found W32/Packed_Krunchy.A

Panda Antivirus

Found Trj/Agent.KFR

Sophos Antivirus

Found nothing

VirusBuster

Found nothing

VBA32

Found nothing

Endret 25. november 2008 av eunaas

eUnaas · 25. november 2008

ComboFix 08-11-24.01 - eUnaas 2008-11-25 9:28:23.3 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1044.18.2172 [GMT 1:00]

Running from: c:\documents and settings\eUnaas\Skrivebord\ComboFix.exe

Command switches used :: c:\documents and settings\eUnaas\Skrivebord\CFScript.txt

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

c:\windows\~GLH0000.TMP

.

((((((((((((((((((((((((( Files Created from 2008-10-25 to 2008-11-25 )))))))))))))))))))))))))))))))

.

2008-11-24 19:20 . 2008-08-14 14:27 2,190,976 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe

2008-11-24 19:20 . 2008-08-14 14:27 2,147,328 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe

2008-11-24 19:20 . 2008-08-14 14:27 2,067,840 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe

2008-11-24 19:20 . 2008-08-14 14:27 2,025,984 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe

2008-11-24 19:20 . 2008-09-15 16:29 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys

2008-11-24 19:20 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys

2008-11-24 19:20 . 2008-08-14 11:04 138,496 -----c--- c:\windows\system32\dllcache\afd.sys

2008-11-24 19:17 . 2008-04-11 20:06 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll

2008-11-24 19:17 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys

2008-11-24 19:17 . 2008-05-01 15:38 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll

2008-11-24 19:16 . 2008-09-04 18:17 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll

2008-11-24 19:15 . 2008-10-15 17:38 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll