Hvordan skal jeg få bort dette viruset?

[trilobitt]

Jeg har fått et virus jeg tror heter win32.renos, jeg har prøv og bruke AGV pro, Ad-Aware pro og spybot for å fjerne det. men ingen klarer det.

 

Noen som kan hjelpe meg? takk : )

 

ComboFix 08-12-02.02 - Jim Westby 2008-12-03 16:47:25.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1044.18.2216 [GMT 1:00]

Kjører fra: c:\documents and settings\Jim Westby\Skrivebord\ComboFix.exe

* Opprettet nytt gjenopprettingspunkt

.

 

((((((((((((((((((((((((((( Filer Opprettet Fra 2008-11-03 til 2008-12-03 )))))))))))))))))))))))))))))))))

.

 

2008-12-03 16:42 . 2008-12-03 16:42 <DIR> d-------- c:\programfiler\Malwarebytes' Anti-Malware

2008-12-03 16:42 . 2008-12-03 16:42 <DIR> d-------- c:\documents and settings\Jim Westby\Programdata\Malwarebytes

2008-12-03 16:42 . 2008-12-03 16:42 <DIR> d-------- c:\documents and settings\All Users\Programdata\Malwarebytes

2008-12-03 16:42 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2008-12-03 16:42 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2008-12-03 16:23 . 2008-12-03 16:31 493 --a------ c:\windows\wininit.ini

2008-12-03 16:05 . 2008-12-03 16:06 <DIR> d-------- c:\programfiler\Spybot - Search & Destroy

2008-12-03 16:05 . 2008-12-03 16:31 <DIR> d-------- c:\documents and settings\All Users\Programdata\Spybot - Search & Destroy

2008-12-03 15:21 . 2008-12-03 15:26 <DIR> d-------- c:\documents and settings\Jim Westby\Contacts

2008-12-03 15:20 . 2008-12-03 15:20 <DIR> d----c--- c:\windows\system32\DRVSTORE

2008-12-03 15:20 . 2008-12-03 15:20 <DIR> d-------- c:\windows\LastGood

2008-12-03 15:18 . 2008-12-03 15:20 <DIR> d-------- c:\programfiler\Windows Live

2008-12-03 15:18 . 2008-12-03 15:20 <DIR> d--hsc--- c:\programfiler\Fellesfiler\WindowsLiveInstaller

2008-12-03 15:18 . 2008-12-03 15:18 <DIR> d-------- c:\documents and settings\All Users\Programdata\WLInstaller

2008-12-03 15:09 . 2008-12-03 15:09 <DIR> d-------- c:\programfiler\Lavasoft

2008-12-03 15:09 . 2008-12-03 15:14 <DIR> d-------- c:\documents and settings\All Users\Programdata\Lavasoft

2008-12-03 15:07 . 2008-04-14 17:22 221,184 --a------ c:\windows\system32\wmpns.dll

2008-12-03 15:04 . 2008-12-03 15:04 <DIR> d-------- c:\programfiler\Fellesfiler\Wise Installation Wizard

2008-12-03 15:01 . 2008-12-03 15:01 <DIR> d-------- c:\windows\LastGood.Tmp

2008-12-03 14:58 . 2008-12-03 14:58 <DIR> d-------- c:\windows\system32\no

2008-12-03 14:58 . 2008-12-03 14:58 <DIR> d-------- c:\windows\system32\bits

2008-12-03 14:58 . 2008-12-03 14:58 <DIR> d-------- c:\windows\l2schemas

2008-12-03 14:57 . 2008-12-03 15:29 <DIR> d--h----- C:\$AVG8.VAULT$

2008-12-03 14:56 . 2008-12-03 14:56 <DIR> d-------- c:\windows\ServicePackFiles

2008-12-03 14:41 . 2008-12-03 14:43 <DIR> d-------- c:\windows\system32\drivers\Avg

2008-12-03 14:41 . 2008-12-03 14:41 <DIR> d-------- c:\programfiler\Java

2008-12-03 14:41 . 2008-12-03 14:41 <DIR> d-------- c:\programfiler\AVG

2008-12-03 14:41 . 2008-12-03 14:41 <DIR> d-------- c:\documents and settings\All Users\Programdata\avg8

2008-12-03 14:41 . 2008-12-03 14:41 410,984 --a------ c:\windows\system32\deploytk.dll

2008-12-03 14:41 . 2008-12-03 14:41 98,440 --a------ c:\windows\system32\drivers\avgldx86.sys

2008-12-03 14:41 . 2008-12-03 14:41 90,632 --a------ c:\windows\system32\drivers\avgtdix.sys

2008-12-03 14:41 . 2008-12-03 14:41 73,728 --a------ c:\windows\system32\javacpl.cpl

2008-12-03 14:41 . 2008-12-03 14:41 12,936 --a------ c:\windows\system32\drivers\avgrkx86.sys

2008-12-03 14:41 . 2008-12-03 14:41 10,520 --a------ c:\windows\system32\avgrsstx.dll

2008-12-03 13:25 . 2008-12-03 13:25 <DIR> d-------- c:\programfiler\VideoLAN

2008-12-03 11:19 . 2008-12-03 14:58 <DIR> d-------- c:\windows\system32\nb-no

2008-12-03 11:06 . 2008-12-03 11:09 <DIR> d-------- c:\programfiler\LimeWire

2008-12-03 11:05 . 2008-12-03 11:05 176,128 --a------ c:\windows\system32\djifvot.dll

2008-12-03 10:56 . 2008-12-03 10:56 <DIR> d-------- c:\documents and settings\All Users\Programdata\ESET

2008-12-03 10:41 . 2008-12-03 10:41 <DIR> d-------- c:\programfiler\uTorrent

2008-12-03 10:41 . 2008-12-03 15:24 <DIR> d-------- c:\documents and settings\Jim Westby\Programdata\uTorrent

2008-12-03 10:35 . 2008-12-03 10:35 0 --a------ c:\windows\nsreg.dat

2008-12-02 23:50 . 2008-08-14 14:27 2,190,976 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe

2008-12-02 23:50 . 2008-08-14 14:27 2,147,328 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe

2008-12-02 23:50 . 2008-08-14 14:27 2,067,840 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe

2008-12-02 23:50 . 2008-08-14 14:27 2,025,984 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe

2008-12-02 23:50 . 2008-09-15 16:29 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys

2008-12-02 23:50 . 2008-04-11 20:06 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll

2008-12-02 23:50 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys

2008-12-02 23:50 . 2008-10-15 17:38 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll

2008-12-02 23:50 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys

2008-12-02 23:50 . 2008-08-14 11:04 138,496 -----c--- c:\windows\system32\dllcache\afd.sys

2008-12-02 23:49 . 2008-05-08 15:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys

2008-12-02 23:16 . 2008-12-03 11:18 <DIR> d--h----- c:\windows\$hf_mig$

2008-12-02 23:16 . 2008-06-14 18:36 272,256 --------- c:\windows\system32\drivers\bthport.sys

2008-12-02 23:16 . 2008-06-14 18:36 272,256 -----c--- c:\windows\system32\dllcache\bthport.sys

2008-12-02 23:13 . 2008-12-02 23:13 <DIR> d-------- c:\documents and settings\All Users\Programdata\Blizzard

2008-12-02 23:08 . 2008-12-03 13:29 <DIR> d-------- c:\programfiler\Fellesfiler\Blizzard Entertainment

2008-12-02 22:58 . 2008-10-16 14:09 43,544 --a------ c:\windows\system32\wups2.dll

2008-12-02 22:58 . 2008-10-16 14:08 31,768 --a------ c:\windows\system32\wucltui.dll.mui

2008-12-02 22:58 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuaucpl.cpl.mui

2008-12-02 22:58 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuapi.dll.mui

2008-12-02 22:58 . 2008-10-16 14:07 18,968 --a------ c:\windows\system32\wuaueng.dll.mui

2008-12-02 22:57 . 2008-12-02 22:57 <DIR> d---s---- c:\documents and settings\Jim Westby\UserData

2008-12-02 22:27 . 2008-12-02 22:27 <DIR> d-------- c:\windows\system32\msmq

2008-12-02 22:27 . 2008-12-02 22:27 <DIR> d-------- c:\windows\system32\Logfiles

2008-12-02 22:27 . 2008-12-02 22:27 <DIR> d-------- C:\Inetpub

2008-12-02 21:15 . 2008-04-13 19:45 172,416 --a------ c:\windows\system32\drivers\kmixer.sys

2008-12-02 21:15 . 2008-04-13 17:39 142,592 --a------ c:\windows\system32\drivers\aec.sys

2008-12-02 21:15 . 2008-04-13 20:17 83,072 --a------ c:\windows\system32\drivers\wdmaud.sys

2008-12-02 21:15 . 2008-04-13 20:15 60,800 --a------ c:\windows\system32\drivers\sysaudio.sys

2008-12-02 21:15 . 2008-04-13 19:45 56,576 --a------ c:\windows\system32\drivers\swmidi.sys

2008-12-02 21:15 . 2008-04-13 19:45 52,864 --a------ c:\windows\system32\drivers\dmusic.sys

2008-12-02 21:15 . 2008-04-13 19:39 7,552 --a------ c:\windows\system32\drivers\mskssrv.sys

2008-12-02 21:15 . 2008-04-13 19:45 6,272 --a------ c:\windows\system32\drivers\splitter.sys

2008-12-02 21:15 . 2008-04-13 19:39 5,376 --a------ c:\windows\system32\drivers\mspclock.sys

2008-12-02 21:15 . 2008-04-13 19:39 4,992 --a------ c:\windows\system32\drivers\mspqm.sys

2008-12-02 21:15 . 2008-04-13 19:45 2,944 --a------ c:\windows\system32\drivers\drmkaud.sys

2008-12-02 21:14 . 2008-12-02 21:14 <DIR> d-------- c:\programfiler\Analog Devices

2008-12-02 21:14 . 2001-09-11 14:20 1,285,632 --------- c:\windows\system32\SMMedia.dll

2008-12-02 21:14 . 2008-04-13 20:19 146,048 --a------ c:\windows\system32\drivers\portcls.sys

2008-12-02 21:14 . 2008-04-14 17:23 129,536 --a------ c:\windows\system32\ksproxy.ax

2008-12-02 21:14 . 2008-04-13 19:45 60,160 --a------ c:\windows\system32\drivers\drmk.sys

2008-12-02 21:14 . 2005-05-04 08:20 53,248 --------- c:\windows\system32\wdmioctl.dll

2008-12-02 21:14 . 2006-07-10 14:42 49,152 --------- c:\windows\system32\DSndUp.exe

2008-12-02 21:14 . 2002-04-17 14:05 45,056 --------- c:\windows\system32\CleanUp.exe

2008-12-02 21:14 . 2007-08-10 08:22 26,488 --a------ c:\windows\system32\spupdsvc.exe

2008-12-02 21:14 . 2008-04-14 17:22 4,096 --a------ c:\windows\system32\ksuser.dll

2008-12-02 21:10 . 2005-01-12 02:56 78,336 --a------ c:\windows\system32\SilSupp.cpl

2008-12-02 21:10 . 2005-01-20 06:30 67,200 -ra------ c:\windows\system32\drivers\SI3132.sys

2008-12-02 21:10 . 2004-11-02 03:21 10,368 -ra------ c:\windows\system32\drivers\SiWinAcc.sys

2008-12-02 21:09 . 2008-12-02 21:09 <DIR> d-------- c:\programfiler\NVIDIA Corporation

2008-12-02 21:09 . 2008-12-02 21:09 1,024 --a------ C:\.rnd

2008-12-02 21:09 . 2008-12-02 21:09 22 --a------ c:\windows\FileName

2008-12-02 21:07 . 2006-03-23 19:53 442,368 --a------ c:\windows\system32\CapabilityTable.exe

2008-12-02 21:07 . 2006-08-18 18:28 208,896 --------- c:\windows\system32\nvuide.exe

2008-12-02 21:07 . 2006-06-01 23:32 1,570 --------- c:\windows\system32\nvide.nvu

2008-12-02 21:06 . 2006-09-12 01:06 356,352 --a------ c:\windows\system32\nvunrm.exe

2008-12-02 21:06 . 2006-09-12 00:14 3,903 --a------ c:\windows\system32\nvnrm.nvu

2008-12-02 21:06 . 2006-08-14 20:09 1,428 --a------ c:\windows\system32\drivers\nvphy.bin

2008-12-02 21:05 . 2008-12-02 21:08 <DIR> d-------- c:\programfiler\Fellesfiler\InstallShield

2008-12-02 21:03 . 2008-12-02 21:14 <DIR> d--h----- c:\programfiler\InstallShield Installation Information

2008-12-02 21:03 . 2008-12-02 21:03 <DIR> d-------- c:\programfiler\D-Link

2008-12-02 21:03 . 2008-12-02 21:03 <DIR> d-------- c:\documents and settings\Jim Westby\Programdata\InstallShield

2008-12-02 21:02 . 2008-12-02 21:02 <DIR> d-------- c:\windows\nview

2008-12-02 21:02 . 2008-12-02 21:02 <DIR> d-------- C:\NVIDIA

2008-12-02 21:02 . 2008-10-02 10:07 453,152 --a------ c:\windows\system32\NVUNINST.EXE

2008-12-02 21:02 . 2008-10-07 13:33 453,152 --a------ c:\windows\system32\nvudisp.exe

2008-12-02 21:02 . 2008-12-03 15:07 200,819 --a------ c:\windows\system32\nvapps.xml

2008-12-02 21:02 . 2008-10-07 13:33 18,477 --a------ c:\windows\system32\nvdisp.nvu

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-12-02 19:30 --------- d-----w c:\programfiler\microsoft frontpage

2008-12-02 19:29 --------- d-----w c:\programfiler\Elektroniske tjenester

2008-12-02 19:28 --------- d-----w c:\programfiler\Fellesfiler\Tjenester

2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys

2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll

2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll

2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll

2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll

2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe

2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll

2008-09-15 15:29 1,846,400 ----a-w c:\windows\system32\win32k.sys

2008-09-04 17:17 1,106,944 ----a-w c:\windows\system32\msxml3.dll

.

 

(((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret )))))))))))))))))))))))))))))))))))))))))))))

.

.

*Merk* tomme oppføringer & gyldige standardoppføringer vises ikke

REGEDIT4

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{34B4DFE0-E110-4936-BE49-C4F3684FB458}]

2008-12-03 11:05 176128 --a------ c:\windows\system32\djifvot.dll

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"MsnMsgr"="c:\programfiler\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

 

c:\documents and settings\All Users\Start-meny\Programmer\Oppstart\

Wireless Connection Manager.lnk - c:\programfiler\D-Link\D-Link DWA-556 Xtreme N PCIe Desktop Adapter\wirelesscm.exe [2008-12-02 20525056]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=avgrsstx.dll

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programfiler\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=

"c:\\Programfiler\\uTorrent\\uTorrent.exe"=

"c:\\Programfiler\\AVG\\AVG8\\avgam.exe"=

"c:\\Programfiler\\AVG\\AVG8\\avgemc.exe"=

"c:\\Programfiler\\AVG\\AVG8\\avgupd.exe"=

"c:\\Programfiler\\AVG\\AVG8\\avgnsx.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Programfiler\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Programfiler\\Windows Live\\Messenger\\livecall.exe"=

 

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\Drivers\avgrkx86.sys [2008-12-03 12936]

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-12-03 98440]

R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-12-03 90632]

R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-12-03 874776]

R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-03 231704]

R3 JSWSCIMD;jswscimd Service;c:\windows\system32\DRIVERS\jswscimd.sys [2008-12-02 57376]

R3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys [2008-12-03 38496]

R3 WSIMD;wsimd Service;c:\windows\system32\DRIVERS\wsimd.sys [2008-12-02 57344]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f9d3f99d-c0aa-11dd-ae69-b548704665d1}]

\Shell\AutoRun\command - wd_windows_tools\setup.exe

 

*Newly Created Service* - AAWSERVICE

*Newly Created Service* - AD-WATCH_CONNECT_FILTER

*Newly Created Service* - AD-WATCH_REAL-TIME_SCANNER

*Newly Created Service* - AD-WATCH_REGISTRY_FILTER

*Newly Created Service* - CSISCANNER

*Newly Created Service* - MBAMSWISSARMY

*Newly Created Service* - PROCEXP90

*Newly Created Service* - USNJSVC

*Newly Created Service* - WLSETUPSVC

.

.

------- Tilleggsskanning -------

.

FireFox -: Profile - c:\documents and settings\Jim Westby\Programdata\Mozilla\Firefox\Profiles\9z4cjb57.default\

FF -: plugin - c:\programfiler\Java\jre6\bin\new_plugin\npdeploytk.dll

FF -: plugin - c:\programfiler\Java\jre6\bin\new_plugin\npjp2.dll

FF -: plugin - c:\programfiler\Mozilla Firefox\plugins\npdeploytk.dll

.

 

**************************************************************************

 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-12-03 16:47:56

Windows 5.1.2600 Service Pack 3 NTFS

 

skanner skjulte prosesser ...

 

skanner skjulte autostart-oppføringer ...

 

skanner skjulte filer ...

 

skanning vellykket

skjulte filer: 0

 

**************************************************************************

.

--------------------- DLL'er Lastet Av Kjørende Prosesser ---------------------

 

- - - - - - - > 'winlogon.exe'(876)

c:\windows\system32\avgrsstx.dll

 

- - - - - - - > 'lsass.exe'(988)

c:\windows\system32\avgrsstx.dll

c:\windows\system32\nvappfilter.dll

.

Tidspunkt ferdig: 2008-12-03 16:48:19

ComboFix-quarantined-files.txt 2008-12-03 15:48:16

 

Pre-Run: 32 021 491 712 byte ledig

Post-Run: 32,043,548,672 byte ledig

 

WindowsXP-KB310994-SP2-Pro-BootDisk-NOR.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

 

219 --- E O F --- 2008-12-03 14:02:15

Endret 3. desember 2008 av trilobitt

[Tosha0007]

Køyr Malwarebyte's først og etterpå ein ny runde med combofix

[r2d290]

nvm

Endret 3. desember 2008 av r2d290

[trilobitt]

Køyr Malwarebyte's først og etterpå ein ny runde med combofix

 

Malwarebytes' Anti-Malware 1.30

Database versjon: 1454

Windows 5.1.2600 Service Pack 3

 

03.12.2008 17:05:45

mbam-log-2008-12-03 (17-05-45).txt

 

Skanntype: Rask Skann

Objekter skannet: 41250

Tid tilbakelagt: 29 second(s)

 

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 0

Registerverdier infisert: 0

Registerfiler infisert: 0

Mapper infisert: 0

Filer infisert: 0

 

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

 

Minnemoduler infisert:

(Ingen mistenkelige filer funnet)

 

Registernøkler infisert:

(Ingen mistenkelige filer funnet)

 

Registerverdier infisert:

(Ingen mistenkelige filer funnet)

 

Registerfiler infisert:

(Ingen mistenkelige filer funnet)

 

Mapper infisert:

(Ingen mistenkelige filer funnet)

 

Filer infisert:

(Ingen mistenkelige filer funnet)

 

 

og her:

 

ComboFix 08-12-02.02 - Jim Westby 2008-12-03 17:06:35.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1044.18.2280 [GMT 1:00]

Kjører fra: c:\documents and settings\Jim Westby\Skrivebord\ComboFix.exe

.

 

((((((((((((((((((((((((((( Filer Opprettet Fra 2008-11-03 til 2008-12-03 )))))))))))))))))))))))))))))))))

.

 

2008-12-03 17:04 . 2008-12-03 17:04 <DIR> d-------- c:\programfiler\Malwarebytes' Anti-Malware

2008-12-03 17:04 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2008-12-03 17:04 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2008-12-03 16:42 . 2008-12-03 16:42 <DIR> d-------- c:\documents and settings\Jim Westby\Programdata\Malwarebytes

2008-12-03 16:42 . 2008-12-03 16:42 <DIR> d-------- c:\documents and settings\All Users\Programdata\Malwarebytes

2008-12-03 16:23 . 2008-12-03 16:31 493 --a------ c:\windows\wininit.ini

2008-12-03 16:05 . 2008-12-03 16:06 <DIR> d-------- c:\programfiler\Spybot - Search & Destroy

2008-12-03 16:05 . 2008-12-03 16:31 <DIR> d-------- c:\documents and settings\All Users\Programdata\Spybot - Search & Destroy

2008-12-03 15:21 . 2008-12-03 15:26 <DIR> d-------- c:\documents and settings\Jim Westby\Contacts

2008-12-03 15:20 . 2008-12-03 15:20 <DIR> d----c--- c:\windows\system32\DRVSTORE

2008-12-03 15:20 . 2008-12-03 15:20 <DIR> d-------- c:\windows\LastGood

2008-12-03 15:18 . 2008-12-03 15:20 <DIR> d-------- c:\programfiler\Windows Live

2008-12-03 15:18 . 2008-12-03 15:20 <DIR> d--hsc--- c:\programfiler\Fellesfiler\WindowsLiveInstaller

2008-12-03 15:18 . 2008-12-03 15:18 <DIR> d-------- c:\documents and settings\All Users\Programdata\WLInstaller

2008-12-03 15:09 . 2008-12-03 15:09 <DIR> d-------- c:\programfiler\Lavasoft

2008-12-03 15:09 . 2008-12-03 15:14 <DIR> d-------- c:\documents and settings\All Users\Programdata\Lavasoft

2008-12-03 15:07 . 2008-04-14 17:22 221,184 --a------ c:\windows\system32\wmpns.dll

2008-12-03 15:04 . 2008-12-03 15:04 <DIR> d-------- c:\programfiler\Fellesfiler\Wise Installation Wizard

2008-12-03 15:01 . 2008-12-03 15:01 <DIR> d-------- c:\windows\LastGood.Tmp

2008-12-03 14:58 . 2008-12-03 14:58 <DIR> d-------- c:\windows\system32\no

2008-12-03 14:58 . 2008-12-03 14:58 <DIR> d-------- c:\windows\system32\bits

2008-12-03 14:58 . 2008-12-03 14:58 <DIR> d-------- c:\windows\l2schemas

2008-12-03 14:57 . 2008-12-03 15:29 <DIR> d--h----- C:\$AVG8.VAULT$

2008-12-03 14:56 . 2008-12-03 14:56 <DIR> d-------- c:\windows\ServicePackFiles

2008-12-03 14:41 . 2008-12-03 14:43 <DIR> d-------- c:\windows\system32\drivers\Avg

2008-12-03 14:41 . 2008-12-03 14:41 <DIR> d-------- c:\programfiler\Java

2008-12-03 14:41 . 2008-12-03 14:41 <DIR> d-------- c:\programfiler\AVG

2008-12-03 14:41 . 2008-12-03 14:41 <DIR> d-------- c:\documents and settings\All Users\Programdata\avg8

2008-12-03 14:41 . 2008-12-03 14:41 410,984 --a------ c:\windows\system32\deploytk.dll

2008-12-03 14:41 . 2008-12-03 14:41 98,440 --a------ c:\windows\system32\drivers\avgldx86.sys

2008-12-03 14:41 . 2008-12-03 14:41 90,632 --a------ c:\windows\system32\drivers\avgtdix.sys

2008-12-03 14:41 . 2008-12-03 14:41 73,728 --a------ c:\windows\system32\javacpl.cpl

2008-12-03 14:41 . 2008-12-03 14:41 12,936 --a------ c:\windows\system32\drivers\avgrkx86.sys

2008-12-03 14:41 . 2008-12-03 14:41 10,520 --a------ c:\windows\system32\avgrsstx.dll

2008-12-03 13:25 . 2008-12-03 13:25 <DIR> d-------- c:\programfiler\VideoLAN

2008-12-03 11:19 . 2008-12-03 14:58 <DIR> d-------- c:\windows\system32\nb-no

2008-12-03 11:06 . 2008-12-03 11:09 <DIR> d-------- c:\programfiler\LimeWire

2008-12-03 11:05 . 2008-12-03 11:05 176,128 --a------ c:\windows\system32\djifvot.dll

2008-12-03 10:56 . 2008-12-03 10:56 <DIR> d-------- c:\documents and settings\All Users\Programdata\ESET

2008-12-03 10:41 . 2008-12-03 10:41 <DIR> d-------- c:\programfiler\uTorrent

2008-12-03 10:41 . 2008-12-03 15:24 <DIR> d-------- c:\documents and settings\Jim Westby\Programdata\uTorrent

2008-12-03 10:35 . 2008-12-03 10:35 0 --a------ c:\windows\nsreg.dat

2008-12-02 23:50 . 2008-08-14 14:27 2,190,976 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe

2008-12-02 23:50 . 2008-08-14 14:27 2,147,328 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe

2008-12-02 23:50 . 2008-08-14 14:27 2,067,840 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe

2008-12-02 23:50 . 2008-08-14 14:27 2,025,984 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe

2008-12-02 23:50 . 2008-09-15 16:29 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys

2008-12-02 23:50 . 2008-04-11 20:06 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll

2008-12-02 23:50 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys

2008-12-02 23:50 . 2008-10-15 17:38 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll

2008-12-02 23:50 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys

2008-12-02 23:50 . 2008-08-14 11:04 138,496 -----c--- c:\windows\system32\dllcache\afd.sys

2008-12-02 23:49 . 2008-05-08 15:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys

2008-12-02 23:16 . 2008-12-03 11:18 <DIR> d--h----- c:\windows\$hf_mig$

2008-12-02 23:16 . 2008-06-14 18:36 272,256 --------- c:\windows\system32\drivers\bthport.sys

2008-12-02 23:16 . 2008-06-14 18:36 272,256 -----c--- c:\windows\system32\dllcache\bthport.sys

2008-12-02 23:13 . 2008-12-02 23:13 <DIR> d-------- c:\documents and settings\All Users\Programdata\Blizzard

2008-12-02 23:08 . 2008-12-03 13:29 <DIR> d-------- c:\programfiler\Fellesfiler\Blizzard Entertainment

2008-12-02 22:58 . 2008-10-16 14:09 43,544 --a------ c:\windows\system32\wups2.dll

2008-12-02 22:58 . 2008-10-16 14:08 31,768 --a------ c:\windows\system32\wucltui.dll.mui

2008-12-02 22:58 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuaucpl.cpl.mui

2008-12-02 22:58 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuapi.dll.mui

2008-12-02 22:58 . 2008-10-16 14:07 18,968 --a------ c:\windows\system32\wuaueng.dll.mui

2008-12-02 22:57 . 2008-12-02 22:57 <DIR> d---s---- c:\documents and settings\Jim Westby\UserData

2008-12-02 22:27 . 2008-12-02 22:27 <DIR> d-------- c:\windows\system32\msmq

2008-12-02 22:27 . 2008-12-02 22:27 <DIR> d-------- c:\windows\system32\Logfiles

2008-12-02 22:27 . 2008-12-02 22:27 <DIR> d-------- C:\Inetpub

2008-12-02 21:15 . 2008-04-13 19:45 172,416 --a------ c:\windows\system32\drivers\kmixer.sys

2008-12-02 21:15 . 2008-04-13 17:39 142,592 --a------ c:\windows\system32\drivers\aec.sys

2008-12-02 21:15 . 2008-04-13 20:17 83,072 --a------ c:\windows\system32\drivers\wdmaud.sys

2008-12-02 21:15 . 2008-04-13 20:15 60,800 --a------ c:\windows\system32\drivers\sysaudio.sys

2008-12-02 21:15 . 2008-04-13 19:45 56,576 --a------ c:\windows\system32\drivers\swmidi.sys

2008-12-02 21:15 . 2008-04-13 19:45 52,864 --a------ c:\windows\system32\drivers\dmusic.sys

2008-12-02 21:15 . 2008-04-13 19:39 7,552 --a------ c:\windows\system32\drivers\mskssrv.sys

2008-12-02 21:15 . 2008-04-13 19:45 6,272 --a------ c:\windows\system32\drivers\splitter.sys

2008-12-02 21:15 . 2008-04-13 19:39 5,376 --a------ c:\windows\system32\drivers\mspclock.sys

2008-12-02 21:15 . 2008-04-13 19:39 4,992 --a------ c:\windows\system32\drivers\mspqm.sys

2008-12-02 21:15 . 2008-04-13 19:45 2,944 --a------ c:\windows\system32\drivers\drmkaud.sys

2008-12-02 21:14 . 2008-12-02 21:14 <DIR> d-------- c:\programfiler\Analog Devices

2008-12-02 21:14 . 2001-09-11 14:20 1,285,632 --------- c:\windows\system32\SMMedia.dll

2008-12-02 21:14 . 2008-04-13 20:19 146,048 --a------ c:\windows\system32\drivers\portcls.sys

2008-12-02 21:14 . 2008-04-14 17:23 129,536 --a------ c:\windows\system32\ksproxy.ax

2008-12-02 21:14 . 2008-04-13 19:45 60,160 --a------ c:\windows\system32\drivers\drmk.sys

2008-12-02 21:14 . 2005-05-04 08:20 53,248 --------- c:\windows\system32\wdmioctl.dll

2008-12-02 21:14 . 2006-07-10 14:42 49,152 --------- c:\windows\system32\DSndUp.exe

2008-12-02 21:14 . 2002-04-17 14:05 45,056 --------- c:\windows\system32\CleanUp.exe

2008-12-02 21:14 . 2007-08-10 08:22 26,488 --a------ c:\windows\system32\spupdsvc.exe

2008-12-02 21:14 . 2008-04-14 17:22 4,096 --a------ c:\windows\system32\ksuser.dll

2008-12-02 21:10 . 2005-01-12 02:56 78,336 --a------ c:\windows\system32\SilSupp.cpl

2008-12-02 21:10 . 2005-01-20 06:30 67,200 -ra------ c:\windows\system32\drivers\SI3132.sys

2008-12-02 21:10 . 2004-11-02 03:21 10,368 -ra------ c:\windows\system32\drivers\SiWinAcc.sys

2008-12-02 21:09 . 2008-12-02 21:09 <DIR> d-------- c:\programfiler\NVIDIA Corporation

2008-12-02 21:09 . 2008-12-02 21:09 1,024 --a------ C:\.rnd

2008-12-02 21:09 . 2008-12-02 21:09 22 --a------ c:\windows\FileName

2008-12-02 21:07 . 2006-03-23 19:53 442,368 --a------ c:\windows\system32\CapabilityTable.exe

2008-12-02 21:07 . 2006-08-18 18:28 208,896 --------- c:\windows\system32\nvuide.exe

2008-12-02 21:07 . 2006-06-01 23:32 1,570 --------- c:\windows\system32\nvide.nvu

2008-12-02 21:06 . 2006-09-12 01:06 356,352 --a------ c:\windows\system32\nvunrm.exe

2008-12-02 21:06 . 2006-09-12 00:14 3,903 --a------ c:\windows\system32\nvnrm.nvu

2008-12-02 21:06 . 2006-08-14 20:09 1,428 --a------ c:\windows\system32\drivers\nvphy.bin

2008-12-02 21:05 . 2008-12-02 21:08 <DIR> d-------- c:\programfiler\Fellesfiler\InstallShield

2008-12-02 21:03 . 2008-12-02 21:14 <DIR> d--h----- c:\programfiler\InstallShield Installation Information

2008-12-02 21:03 . 2008-12-02 21:03 <DIR> d-------- c:\programfiler\D-Link

2008-12-02 21:03 . 2008-12-02 21:03 <DIR> d-------- c:\documents and settings\Jim Westby\Programdata\InstallShield

2008-12-02 21:02 . 2008-12-02 21:02 <DIR> d-------- c:\windows\nview

2008-12-02 21:02 . 2008-12-02 21:02 <DIR> d-------- C:\NVIDIA

2008-12-02 21:02 . 2008-10-02 10:07 453,152 --a------ c:\windows\system32\NVUNINST.EXE

2008-12-02 21:02 . 2008-10-07 13:33 453,152 --a------ c:\windows\system32\nvudisp.exe

2008-12-02 21:02 . 2008-12-03 15:07 200,819 --a------ c:\windows\system32\nvapps.xml

2008-12-02 21:02 . 2008-10-07 13:33 18,477 --a------ c:\windows\system32\nvdisp.nvu

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-12-02 19:30 --------- d-----w c:\programfiler\microsoft frontpage

2008-12-02 19:29 --------- d-----w c:\programfiler\Elektroniske tjenester

2008-12-02 19:28 --------- d-----w c:\programfiler\Fellesfiler\Tjenester

2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys

2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll

2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll

2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll

2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll

2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe

2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll

2008-09-15 15:29 1,846,400 ----a-w c:\windows\system32\win32k.sys

2008-09-04 17:17 1,106,944 ----a-w c:\windows\system32\msxml3.dll

.

 

(((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret )))))))))))))))))))))))))))))))))))))))))))))

.

.

*Merk* tomme oppføringer & gyldige standardoppføringer vises ikke

REGEDIT4

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{34B4DFE0-E110-4936-BE49-C4F3684FB458}]

2008-12-03 11:05 176128 --a------ c:\windows\system32\djifvot.dll

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"MsnMsgr"="c:\programfiler\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

 

c:\documents and settings\All Users\Start-meny\Programmer\Oppstart\

Wireless Connection Manager.lnk - c:\programfiler\D-Link\D-Link DWA-556 Xtreme N PCIe Desktop Adapter\wirelesscm.exe [2008-12-02 20525056]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=avgrsstx.dll

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programfiler\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=

"c:\\Programfiler\\uTorrent\\uTorrent.exe"=

"c:\\Programfiler\\AVG\\AVG8\\avgam.exe"=

"c:\\Programfiler\\AVG\\AVG8\\avgemc.exe"=

"c:\\Programfiler\\AVG\\AVG8\\avgupd.exe"=

"c:\\Programfiler\\AVG\\AVG8\\avgnsx.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Programfiler\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Programfiler\\Windows Live\\Messenger\\livecall.exe"=

 

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\Drivers\avgrkx86.sys [2008-12-03 12936]

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-12-03 98440]

R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-12-03 90632]

R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-12-03 874776]

R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-03 231704]

R3 JSWSCIMD;jswscimd Service;c:\windows\system32\DRIVERS\jswscimd.sys [2008-12-02 57376]

R3 WSIMD;wsimd Service;c:\windows\system32\DRIVERS\wsimd.sys [2008-12-02 57344]

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f9d3f99d-c0aa-11dd-ae69-b548704665d1}]

\Shell\AutoRun\command - wd_windows_tools\setup.exe

 

*Newly Created Service* - AAWSERVICE

*Newly Created Service* - AD-WATCH_CONNECT_FILTER

*Newly Created Service* - AD-WATCH_REAL-TIME_SCANNER

*Newly Created Service* - AD-WATCH_REGISTRY_FILTER

*Newly Created Service* - CATCHME

*Newly Created Service* - CSISCANNER

*Newly Created Service* - MBAMSWISSARMY

*Newly Created Service* - PROCEXP90

*Newly Created Service* - USNJSVC

*Newly Created Service* - WLSETUPSVC

.

.

------- Tilleggsskanning -------

.

FireFox -: Profile - c:\documents and settings\Jim Westby\Programdata\Mozilla\Firefox\Profiles\9z4cjb57.default\

FF -: plugin - c:\programfiler\Java\jre6\bin\new_plugin\npdeploytk.dll

FF -: plugin - c:\programfiler\Java\jre6\bin\new_plugin\npjp2.dll

FF -: plugin - c:\programfiler\Mozilla Firefox\plugins\npdeploytk.dll

.

 

**************************************************************************

 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-12-03 17:07:02

Windows 5.1.2600 Service Pack 3 NTFS

 

skanner skjulte prosesser ...

 

skanner skjulte autostart-oppføringer ...

 

skanner skjulte filer ...

 

skanning vellykket

skjulte filer: 0

 

**************************************************************************

.

--------------------- DLL'er Lastet Av Kjørende Prosesser ---------------------

 

- - - - - - - > 'winlogon.exe'(876)

c:\windows\system32\avgrsstx.dll

 

- - - - - - - > 'lsass.exe'(988)

c:\windows\system32\avgrsstx.dll

c:\windows\system32\nvappfilter.dll

.

Tidspunkt ferdig: 2008-12-03 17:07:23

ComboFix-quarantined-files.txt 2008-12-03 16:07:20

ComboFix2.txt 2008-12-03 15:48:20

 

Pre-Run: 32 098 988 032 byte ledig

Post-Run: 32,090,476,544 byte ledig

 

212 --- E O F --- 2008-12-03 14:02:15

Endret 3. desember 2008 av trilobitt

[r2d290]

Greit, siden MBAM ikke fant noe, trenger du ikke poste ny Combofix-logg

 

 

Legg merke til at alle instruksjonene som blir gitt i denne tråden er skreddersydd for denne maskinen, og at verktøyene som blir brukt her, kan forårsake skade på en annen maskin med andre typer infeksjoner.

 

Hvis du tror du har det samme problemet, bør du følge veiledningen til norbat, og poste loggene i en ny tråd.

 

Hallo

 

Mitt navn er r2d290, og jeg skal være med på å hjelpe deg med å fjerne alle infeksjoner du måtte ha på PC-en.

• Det kommer til å bli gitt en rekke instruksjoner som må bli fulgt i den rekkefølgen vi skriver dem i.
   
  
• Hvis det er en instruksjon du ikke forstår, du er usikker på noe, eller det skjer noe uventet, må du ikke gjette/gå videre, men skrive en post på forumet der du spør om det du lurer på.
   
  
• Ikke start flere tråder (hverken her på diskusjon.no eller på andre forum). Dette vil bare forvirre oss som driver support.
   
  
• Det kan hende at opperasjonen vil gå i flere ledd, og det kan hende det tar litt tid før du får svar, men vi gir oss ikke hvis ikke du gjør det.
   
  
• Ikke gi opp og formater PC-en (selvom noen sier at det er det eneste som hjelper). Det er svært usansynlig at man må formatere grunnet virus.
   
  
• I noen tilfeller hender det at tråder går oss hus forbi, så hvis du ikke har fått svar innen 24 timer kan det være lurt å skrive en liten "purre-post" så tråden din havner øverst på lista.
  

Hvis du følger disse instruksjonene, skal vi nok få fikset problemet med maskinen.

Jeg analyserer loggene dine nå, og vil komme tilbake med respons så snart jeg kan...

 

PS: Det kan hende at sikkerhetsprogrammene dine gir advarsler på noen av verktøyene vi ber deg om å bruke.

sikkerhetsprogrammene kan ikke vite om verktøyene har gode eller dårlige hensikter. Verktøyene blir brukt av profesjonelle rundt om i hele verden, så du kan stole på at programmene er trygge.

 

 

 

 

 

 

 

P2P Advarsel!

• Viktig Loggene viser at det finnes ett eller fler P2P (Person to Person) fildelingsprogram på maskinen din.
   
  LimeWire, uTorrent
   
  Vær klar over at så lenge du bruker noen form for Peer-to-Peer nettverk for å laste ned filer fra en "uoffisiell" kilde, må du gå ut ifra at maskinen din kan bli infisert.
  Før i tiden ble P2P fildeling regnet som ganske trygt. Dette er ikke lenger tilfelle. Du kan fortsette å bruke P2P på din egen risiko, men husk at dette kan være kilden til din nåværende eller neste infeksjon.
   
  Referanser om risikoen for disse programmene, kan du finne i disse linkene:
   
  http://www.microsoft.com/windows/ie/commun...protection.mspx
  http://www.techweb.com/wire/160500554
  http://www.internetworldstats.com/articles/art053.htm
  Se en liste over rene/risikable P2P-programmer her: http://p2p.malwareremoval.com/
   
  Jeg anbefaler at du avinstallerer de nevnte programmene, men valget er ditt. Hvis du velger å fjerne disse programmene, kan du gjøre det fra Kontrollpanel->Legg til/fjern programmer.
   
  Hvis du ønsker å beholde programmet, ber jeg deg om å ikke bruke det før maskinen er ren for malware.
  

Endret 3. desember 2008 av r2d290

[Tosha0007]

 

P2P Advarsel!

• Viktig Loggene viser at det finnes ett eller fler P2P (Person to Person) fildelingsprogram på maskinen din.
   
  Limewire
   
  Vær klar over at så lenge du bruker noen form for Peer-to-Peer nettverk for å laste ned filer fra en "uoffisiell" kilde, må du gå ut ifra at maskinen din kan bli infisert.
  Før i tiden ble P2P fildeling regnet som ganske trygt. Dette er ikke lenger tilfelle. Du kan fortsette å bruke P2P på din egen risiko, men husk at dette kan være kilden til din nåværende eller neste infeksjon.
   
  Referanser om risikoen for disse programmene, kan du finne i disse linkene:
   
  http://www.microsoft.com/windows/ie/commun...protection.mspx
  http://www.techweb.com/wire/160500554
  http://www.internetworldstats.com/articles/art053.htm
  Se en liste over rene/risikable P2P-programmer her: http://p2p.malwareremoval.com/
   
  Jeg anbefaler at du avinstallerer de nevnte programmene, men valget er ditt. Hvis du velger å fjerne disse programmene, kan du gjøre det fra Kontrollpanel->Legg til/fjern programmer.
   
  Hvis du ønsker å beholde programmet, ber jeg deg om å ikke bruke det før maskinen er ren for malware.
  

For seint ute

Endret 3. desember 2008 av tosha0007

[trilobitt]

Jeg er ganske sikker på at det ikke er limewire. Jeg fikk viruset da jeg lastet ned noe av en nettside, og det kommer opp sånn "your comnputer is infected" osv

 

Når jeg søker med spybot kommer det: win32.renos ++

Endret 3. desember 2008 av Alastor
Fjernet unødvendig quote

[perpyro]

Lasta du ned anbefalt verktøy for å fjerne viruset som siden advarte mot?

Har fått denne advarselen selv uten at advarselet lot seg legge ned.

Gikk i taskmanageren og stengte ned firefox for å få stoppa dritten for om ei eller anna side advarer om at du har fått virus, ja da er det garantert juks.

[r2d290]

Gå til http://virusscan.jotti.org , trykk på Browse, og last opp følgende fil til analyse:

c:\windows\system32\djifvot.dll

Deretter trykker du på Submit. Godta at filen blir scannet. Til slutt kopierer du resultatet, og limer det inn i din neste post, så jeg kan se på den, og vurdere hva som må gjøres videre.

 

 

edit: hvilket program varsler om sikkerhetstrusselen, og hvor på maskinen sier programmet at den ligger?

Endret 3. desember 2008 av r2d290

[trilobitt]

Jeg lasta ikke ned det programet for å "fjerne" viruset som nettsiden sier

[trilobitt]

Scanner Malware name

A-Squared Trojan.Generic!IK

AntiVir X

ArcaVir X

Avast Win32:Trojan-gen {Other}

AVG Antivirus Generic10.ABPE

BitDefender X

ClamAV X

CPsecure Troj.Proxy.W32.Delf.an

Dr.Web X

F-Prot Antivirus X

F-Secure Anti-Virus X

G DATA X

Ikarus Trojan.Generic

Kaspersky Anti-Virus X

NOD32 X

Norman Virus Control W32/Packed_Mew.C

Panda Antivirus Generic

Sophos Antivirus Mal/EncPk-BU

VirusBuster X

VBA32 X

 

 

NOD32

Found Win32/Adware.IeDefender.NHW application

 

Dr.Web

Found Adware.Bho.292

 

AntiVir

Found TR/Drop.SMO

[r2d290]

Tror du kopierte inn feil del. Du limte inn oversikt over siste infiserte filer for den siden, ikke hva som faktisk gjelder ditt problem

Prøv igjen.

[trilobitt]

Scan taken on 03 Dec 2008 16:25:54 (GMT)

A-Squared

Found nothing

AntiVir

Found TR/Drop.SMO

ArcaVir

Found nothing

Avast

Found nothing

AVG Antivirus

Found nothing

BitDefender

Found nothing

ClamAV

Found nothing

CPsecure

Found nothing

Dr.Web

Found Adware.Bho.292

F-Prot Antivirus

Found nothing

F-Secure Anti-Virus

Found nothing

G DATA

Found nothing

Ikarus

Found nothing

Kaspersky Anti-Virus

Found nothing

NOD32

Found Win32/Adware.IeDefender.NHW application

Norman Virus Control

Found nothing

Panda Antivirus

Found nothing

Sophos Antivirus

Found nothing

VirusBuster

Found nothing

VBA32

Found nothing

 

Denne da ? : )

[r2d290]

Litt mer det jeg var interessert i, ja

 

Finn fila:

c:\windows\system32\djifvot.dll og endre filetternavnet til c:\windows\system32\djifvot.vir

 

Hvis du ikke merker noen nye problemer, etter at du fjernet fila, i løpet av en uke kan du fjerne den filen.

 

Gjentar spørsmålet: hvilket program finner win32.renos ? Hvor ligger denne fila?

Finner programmet fortsatt denne filen?

[trilobitt]

jeg slettet den fila jeg : p skal kjøre spybot pånytt og fortelle hva jeg finner

[trilobitt]

Nå finner ikke spybot noen trussler lenger, men forresten så har jeg ikke tilgang til å slette den fila du prata om.

 

men viruset er fortsatt her : /

[trilobitt]

WARNING! Some dagerous viruses detected in your system... click here to download the antispyware et kort sammendrag om hva det står

 

Det er borte etter jeg fikk sletta den fila : )

 

Tusen takk for hjelpen : DD

[r2d290]

Du forvirrer meg. Først sier du "jeg slettet den fila jeg " og så "forresten så har jeg ikke tilgang til å slette den fila du prata om." og så "Det er borte etter jeg fikk sletta den fila "

 

 

Uansett hva som stemmer, så har jeg jo sagt at du ikke skal gjøre noe som jeg ikke ber deg om. Lite vits i å be om hjelp her hvis du bare gjør som du vil Kunne hende at det var en veldig viktig systemfil du fjernet, og da kunne det hende at du ble nødt til å formatere PC-en.

 

 

Men greit: Slik jeg tolker det så har du altså fjernet den filen (?), men det fulgte med en registeroppføring med filen. Kan du poste en ny combofix-logg, også fjerner vi resten?