trojan zlob G.

[jenskujata]

nøyaktig samme problem som han under, men det hjalp ikke å kjøre ama og combofix, firefox starter bare 1\20 ganger jeg prøver og bestandig med samme startmelding, om at jeg er ubeskyttet og må laste ned ett program for videre sikker surfing.

 

samt at en add popper hvert 5 minutt, som sier den er firewallen min blah blah, samme som han under

 

 

her er loggene hvis noen kan fortelle hva som må til her ville det vært flott.

 

mam

 

 

Malwarebytes' Anti-Malware 1.31

Databaseversjon: 1456

Windows 5.1.2600 Service Pack 3

 

10.12.2008 19:51:21

mbam-log-2008-12-10 (19-51-21).txt

 

Skanntype: Rask Skann

Objekter skannet: 63152

Tid tilbakelagt: 7 minute(s), 30 second(s)

 

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 6

Registerverdier infisert: 1

Registerfiler infisert: 4

Mapper infisert: 1

Filer infisert: 8

 

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

 

Minnemoduler infisert:

(Ingen mistenkelige filer funnet)

 

Registernøkler infisert:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7c559105-9ecf-42b8-b3f7-832e75edd959} (Adware.ISTBar) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{f919fbd3-a96b-4679-af26-f551439bb5fd} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2178f3fb-2560-458f-bdee-631e2fe0dfe4} (Rogue.WinAntivirus) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8fcdf9d9-a28b-480f-8c3d-581f119a8ab8} (Adware.180Solutions) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\WR (Malware.Trace) -> Quarantined and deleted successfully.

 

Registerverdier infisert:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootStera (Rogue.WinAntivirus) -> Quarantined and deleted successfully.

 

Registerfiler infisert:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System (Rootkit.DNSChanger.H) -> Data: kdzhb.exe -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{ae834220-3509-45b0-bb96-67e097c9262b}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.117;85.255.112.149 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{ae834220-3509-45b0-bb96-67e097c9262b}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.117;85.255.112.149 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{ae834220-3509-45b0-bb96-67e097c9262b}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.117;85.255.112.149 -> Quarantined and deleted successfully.

 

Mapper infisert:

C:\resycled (Trojan.DNSChanger) -> Quarantined and deleted successfully.

 

Filer infisert:

C:\Documents and Settings\jens olav\Lokale innstillinger\Temp\MediaCodec.exe (Trojan.DNSChanger) -> Quarantined and deleted successfully.

C:\resycled\boot.com (Trojan.DNSChanger) -> Quarantined and deleted successfully.

C:\Programfiler\Mozilla Firefox\components\iamfamous.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\stera.job (Rogue.WinAntivirus) -> Quarantined and deleted successfully.

C:\WINDOWS\myalbum2007.zip (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Documents and Settings\jens olav\Lokale innstillinger\Temp\FlashPlayer.v3.193.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\tempo-565.tmp (Trojan.DNSChanger) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\tempo-FB1.tmp (Trojan.DNSChanger) -> Quarantined and deleted successfully.

 

 

 

 

combofix

 

 

ComboFix 08-12-09.03 - jens olav 2008-12-10 19:59:36.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1044.18.612 [GMT 1:00]

Kjører fra: c:\documents and settings\jens olav\Skrivebord\ComboFix.exe

* Opprettet nytt gjenopprettingspunkt

* Resident AV is active

 

 

ADVARSEL -DENNE MASKINEN HAR IKKE GJENOPPRETTINGSKONSOLLEN INSTALLERT !!

.

 

((((((((((((((((((((((((((((((((((((((( Andre slettinger )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\documents and settings\jens olav\new.txt

c:\documents and settings\sol\new.txt

c:\windows\Downloaded Program Files\setup.inf

c:\windows\system32\stera.log

D:\resycled

d:\resycled\boot.com

 

.

((((((((((((((((((((((((((((((((((((((( Drivere/Tjenester )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

-------\Legacy_FOPN

 

 

((((((((((((((((((((((((((( Filer Opprettet Fra 2008-11-10 til 2008-12-10 )))))))))))))))))))))))))))))))))

.

 

2008-12-10 19:42 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2008-12-10 19:42 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2008-12-10 18:29 . 2008-12-10 18:29 <DIR> d-------- c:\documents and settings\jens olav\Programdata\Malwarebytes

2008-12-10 18:29 . 2008-12-10 18:29 <DIR> d-------- c:\documents and settings\All Users\Programdata\Malwarebytes

2008-12-10 14:50 . 2008-12-10 14:50 <DIR> d-------- c:\programfiler\Lavasoft

2008-12-10 14:50 . 2008-12-10 14:51 <DIR> d-------- c:\documents and settings\All Users\Programdata\Lavasoft

2008-12-10 13:26 . 2008-12-10 13:26 <DIR> d-------- c:\programfiler\MSBuild

2008-12-10 13:19 . 2008-12-10 13:19 <DIR> d-------- c:\windows\system32\XPSViewer

2008-12-10 13:17 . 2008-12-10 13:17 <DIR> d-------- c:\programfiler\Reference Assemblies

2008-12-10 13:16 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll

2008-12-10 09:08 . 2008-12-10 09:08 410,984 --a------ c:\windows\system32\deploytk.dll

2008-12-09 16:54 . 2008-12-09 16:56 <DIR> d-------- c:\programfiler\Windows Live Safety Center

2008-11-30 06:13 . 2008-11-30 06:13 <DIR> d-------- c:\programfiler\iPod

2008-11-30 06:12 . 2008-11-30 06:13 <DIR> d-------- c:\programfiler\iTunes

2008-11-30 06:12 . 2008-11-30 06:13 <DIR> d-------- c:\documents and settings\All Users\Programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

2008-11-30 06:11 . 2008-12-09 16:26 <DIR> d-------- c:\programfiler\Bonjour

2008-11-30 06:09 . 2008-11-30 06:09 54,156 --ah----- c:\windows\QTFont.qfn

2008-11-30 06:09 . 2008-11-30 06:09 1,409 --a------ c:\windows\QTFont.for

2008-11-30 06:07 . 2008-11-30 06:07 <DIR> d-------- c:\programfiler\Apple Software Update

2008-11-30 06:06 . 2008-11-30 06:12 <DIR> d-------- c:\programfiler\Fellesfiler\Apple

2008-11-30 06:06 . 2008-11-30 06:06 <DIR> d-------- c:\documents and settings\All Users\Programdata\Apple

2008-11-28 04:25 . 2008-11-28 04:25 27,904 --a------ c:\windows\system32\drivers\ndisprot.sys

2008-11-28 04:24 . 2008-11-28 04:24 <DIR> d-------- c:\windows\Easy Decrypter

2008-11-20 18:10 . 2008-11-20 18:10 382 --a------ c:\windows\ODBC.INI

2008-11-20 18:06 . 2008-11-20 18:09 <DIR> d-------- c:\windows\ShellNew

2008-11-19 23:30 . 2008-11-19 23:30 <DIR> d-------- c:\programfiler\Magic Workstation

2008-11-19 22:11 . 2008-11-19 22:11 <DIR> dr-h----- C:\MSOCache

2008-11-19 21:48 . 2008-11-19 22:12 <DIR> d-------- c:\documents and settings\All Users\Programdata\Microsoft Help

2008-11-14 20:03 . 2008-11-14 20:03 <DIR> d-------- c:\programfiler\Microsoft Games

2008-11-11 23:31 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys

2008-11-11 23:30 . 2008-09-04 18:17 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-12-10 13:49 --------- d-----w c:\programfiler\Fellesfiler\Wise Installation Wizard

2008-12-10 13:29 --------- d-----w c:\programfiler\Azureus

2008-12-10 13:29 --------- d-----w c:\documents and settings\jens olav\Programdata\Azureus

2008-12-10 13:08 --------- d-----w c:\documents and settings\jens olav\Programdata\F-Secure

2008-12-10 13:08 --------- d-----w c:\documents and settings\jens olav\Programdata\dvdcss

2008-12-10 13:08 --------- d-----w c:\documents and settings\jens olav\Programdata\Apple Computer

2008-12-10 13:08 --------- d-----w c:\documents and settings\jens olav\Programdata\AdobeUM

2008-12-10 08:39 --------- d-----w c:\programfiler\NCH Software

2008-12-10 08:38 --------- d--h--w c:\programfiler\InstallShield Installation Information

2008-12-10 08:08 --------- d-----w c:\programfiler\Java

2008-12-07 15:33 --------- d-----w c:\programfiler\PokerRoom.com

2008-12-07 15:31 --------- d-----w c:\programfiler\PokerStars

2008-11-30 05:10 --------- d-----w c:\programfiler\QuickTime

2008-11-30 05:09 --------- d-----w c:\documents and settings\All Users\Programdata\Apple Computer

2008-11-14 19:15 --------- d-----w c:\programfiler\LimeWire

2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys

2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll

2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll

2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll

2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll

2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll

2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe

2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll

2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll

2008-10-13 17:58 --------- d-----w c:\programfiler\CDisplay

2008-10-11 17:28 --------- d-----w c:\programfiler\Betsson Poker

2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll

2008-09-15 15:29 1,846,400 ----a-w c:\windows\system32\win32k.sys

2008-09-10 01:16 1,307,648 ------w c:\windows\system32\msxml6.dll

.

 

(((((((((((((((((((((((((((((((( Oppstartspunkter I Registeret )))))))))))))))))))))))))))))))))))))))))))))

.

.

*Merk* tomme oppføringer & gyldige standardoppføringer vises ikke

REGEDIT4

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{a33fa729-d155-4b23-842b-2c665ecabdb6}"= "c:\programfiler\The_Pirate_Bay\tbThe1.dll" [2008-05-01 1470488]

 

[HKEY_CLASSES_ROOT\clsid\{a33fa729-d155-4b23-842b-2c665ecabdb6}]

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a33fa729-d155-4b23-842b-2c665ecabdb6}]

2008-05-01 12:16 1470488 --a------ c:\programfiler\The_Pirate_Bay\tbThe1.dll

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{a33fa729-d155-4b23-842b-2c665ecabdb6}"= "c:\programfiler\The_Pirate_Bay\tbThe1.dll" [2008-05-01 1470488]

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{A33FA729-D155-4B23-842B-2C665ECABDB6}"= "c:\programfiler\The_Pirate_Bay\tbThe1.dll" [2008-05-01 1470488]

 

[HKEY_CLASSES_ROOT\clsid\{a33fa729-d155-4b23-842b-2c665ecabdb6}]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"swg"="c:\programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-28 68856]

"WinDNN"="c:\documents and settings\jens olav\Programdata\Google\klnxv19819115.exe" [2008-12-10 123392]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"zBrowser Launcher"="c:\programfiler\Logitech\iTouch.exe" [2004-03-18 892928]

"SunJavaUpdateSched"="c:\programfiler\Java\jre6\bin\jusched.exe" [2008-12-10 136600]

"RoxioEngineUtility"="c:\programfiler\Fellesfiler\Roxio Shared\System\EngUtil.exe" [2003-05-01 65536]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-04-01 86016]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-04-01 5562368]

"F-Secure Manager"="c:\programfiler\F-Secure\Common\FSM32.EXE" [2008-02-20 182936]

"F-Secure TNB"="c:\programfiler\F-Secure\FSGUI\TNBUtil.exe" [2008-02-20 895584]

"Adobe Reader Speed Launcher"="c:\programfiler\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

"QuickTime Task"="c:\programfiler\QuickTime\qttask.exe" [2008-11-04 413696]

"iTunesHelper"="c:\programfiler\iTunes\iTunesHelper.exe" [2008-11-20 290088]

"nwiz"="nwiz.exe" [2005-04-01 c:\windows\system32\nwiz.exe]

"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 c:\windows\LOGI_MWX.EXE]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

"Nokia.PCSync"="c:\programfiler\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-11-07 1294336]

 

c:\documents and settings\All Users\Start-meny\Programmer\Oppstart\

Microsoft Office.lnk - c:\programfiler\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.ac3filter"= ac3filter.acm

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"tmproxy"=2 (0x2)

"Tmntsrv"=2 (0x2)

"PcScnSrv"=3 (0x3)

"PcCtlCom"=2 (0x2)

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Programfiler\\Messenger\\msmsgs.exe"=

"c:\\Programfiler\\PlayOnline\\SquareEnix\\PlayOnlineViewer\\pol.exe"=

"c:\\WINDOWS\\system32\\mmc.exe"=

"c:\\Programfiler\\PlayOnline\\SquareEnix\\PlayOnlineViewer\\polcfg\\polcfg.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\StubInstaller.exe"=

"c:\\Programfiler\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=

"c:\\Programfiler\\Fellesfiler\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=

"c:\\Programfiler\\Azureus\\Azureus.exe"=

"c:\\Programfiler\\MSN Messenger\\msnmsgr.exe"=

"c:\\Programfiler\\MSN Messenger\\livecall.exe"=

"c:\\Programfiler\\iTunes\\iTunes.exe"=

"c:\\Programfiler\\Bonjour\\mDNSResponder.exe"=

 

R3 F-Secure Gatekeeper;F-Secure Gatekeeper;\??\c:\programfiler\F-Secure\Anti-Virus\minifilter\fsgk.sys [2008-08-21 62048]

S2 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~1\TmPfw.exe []

S3 getPlus® Helper;getPlus® Helper;c:\programfiler\NOS\bin\getPlus_HelperSvc.exe [2008-10-05 33752]

S3 krdpdre;krdpdre;\??\c:\docume~1\JENSOL~1\LOKALE~1\Temp\krdpdre.sys []

S3 LCcfltr;Logitech USB Filter Driver;c:\windows\system32\Drivers\LCcFltr.Sys [2004-11-29 14095]

S3 Ndisprot;ArcNet NDIS Protocol Driver;\??\c:\windows\system32\drivers\Ndisprot.sys [2008-11-28 27904]

S3 PRISM_USB;D-Link Air Wireless USB Adapter Driver;c:\windows\system32\DRIVERS\PRISMUSB.sys [2003-10-02 666624]

S4 F-Secure Filter;F-Secure File System Filter;\??\c:\programfiler\F-Secure\Anti-Virus\Win2K\FSfilter.sys [2008-08-21 39776]

S4 F-Secure Recognizer;F-Secure File System Recognizer;\??\c:\programfiler\F-Secure\Anti-Virus\Win2K\FSrec.sys [2008-08-21 25184]

.

Innholdet i mappen 'Scheduled Tasks' (planlagte oppgaver)

 

2008-12-06 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\programfiler\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

 

2008-12-10 c:\windows\Tasks\Scheduled scanning task.job

- c:\progra~1\F-Secure\ANTI-V~1\fsav.exe [2008-02-20 18:44]

.

- - - - TOMME PEKERE FJERNET - - - -

 

HKCU-Run-Skype - c:\programfiler\Skype\Phone\Skype.exe

HKLM-Run-pccguide.exe - c:\programfiler\Trend Micro\Internet Security 2007\pccguide.exe

HKLM-Run-c:\windows\system32\kdzhb.exe - c:\windows\system32\kdzhb.exe

 

 

.

------- Tilleggsskanning -------

.

uStart Page = hxxp://www.startsiden.no/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: E&ksporter til Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000

IE: {{4C826F10-D34B-4ba8-B609-1FB8C6482A05} - c:\casino\Europa Casino\casino.exe

IE: {{641F4F4E-6C91-4159-869E-9F5CE6F0F64E} - c:\programfiler\MultiPoker\MultiPoker.exe

IE: {{E6073F93-9541-4be4-9800-109D378EB99B} - c:\microgaming\Poker\nordicbetMPP\MPPoker.exe

IE: {{4C826F10-D34B-4ba8-B609-1FB8C6482A05} - c:\casino\Europa Casino\casino.exe -

IE: {{641F4F4E-6C91-4159-869E-9F5CE6F0F64E} - c:\programfiler\MultiPoker\MultiPoker.exe -

IE: {{E6073F93-9541-4be4-9800-109D378EB99B} - c:\microgaming\Poker\nordicbetMPP\MPPoker.exe -

FireFox -: Profile - c:\documents and settings\jens olav\Programdata\Mozilla\Firefox\Profiles\17uby6bx.default\

FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.startsiden.no/

FF -: plugin - c:\programfiler\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll

FF -: plugin - c:\programfiler\DivX\DivX Content Uploader\npUpload.dll

FF -: plugin - c:\programfiler\iTunes\Mozilla Plugins\npitunes.dll

FF -: plugin - c:\programfiler\Java\jre6\bin\new_plugin\npdeploytk.dll

FF -: plugin - c:\programfiler\Java\jre6\bin\new_plugin\npjp2.dll

FF -: plugin - c:\programfiler\Mozilla Firefox\plugins\npdeploytk.dll

.

 

**************************************************************************

 

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-12-10 20:05:49

Windows 5.1.2600 Service Pack 3 NTFS

 

skanner skjulte prosesser ...

 

skanner skjulte autostart-oppføringer ...

 

skanner skjulte filer ...

 

skanning vellykket

skjulte filer: 0

 

**************************************************************************

.

------------------------ Andre Kjørende Prosesser ------------------------

.

c:\programfiler\Lavasoft\Ad-Aware\aawservice.exe

c:\programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\programfiler\Bonjour\mDNSResponder.exe

c:\programfiler\F-Secure\Anti-Virus\fsgk32st.exe

c:\programfiler\F-Secure\common\FSMA32.EXE

c:\programfiler\F-Secure\Anti-Virus\fsgk32.exe

c:\programfiler\Java\jre6\bin\jqs.exe

c:\programfiler\F-Secure\common\FSMB32.EXE

c:\windows\system32\nvsvc32.exe

c:\windows\system32\MsPMSPSv.exe

c:\programfiler\F-Secure\common\FCH32.EXE

c:\programfiler\F-Secure\Anti-Virus\fssm32.exe

c:\programfiler\F-Secure\common\FAMEH32.EXE

c:\programfiler\F-Secure\common\FNRB32.exe

c:\programfiler\F-Secure\Anti-Virus\fsqh.exe

c:\programfiler\F-Secure\FSAUA\program\fsaua.exe

c:\programfiler\F-Secure\common\FIH32.exe

c:\programfiler\F-Secure\Anti-Virus\fsav32.exe

c:\windows\system32\rundll32.exe

c:\programfiler\Logitech\system\EM_EXEC.EXE

c:\programfiler\F-Secure\FSGUI\fsguidll.exe

c:\programfiler\iPod\bin\iPodService.exe

.

**************************************************************************

.

Tidspunkt ferdig: 2008-12-10 20:09:15 - maskinen ble startet på nytt

ComboFix-quarantined-files.txt 2008-12-10 19:09:11

 

Pre-Run: 18 344 484 864 byte ledig

Post-Run: 21,585,641,472 byte ledig

 

232 --- E O F --- 2008-11-19 20:58:17

 

 

[jenskujata]

her er ett bilde av popupen

virus.doc

Endret 10. desember 2008 av jenskujata

[norbat]

Åpne notisblokk og kopier inn det som står i fet skrift under, lagre fila på skrivebordet som CFScript.txt.

Dra deretter fila over Combofix-iconet. Combofix vil starte igjen. Post loggen.

 

 

Driver::

krdpdre

 

Hent også hjt og post loggen den lager:

Last ned Hijackthis. Legg det i en egen mappe på skrivebordet.

Start programmet, velg "Do a system scan and save a logfile". Loggfilen kopierer du og poster.

 

 

Det ligger noen fildelingsprog og pokerprog. Dette er noe du trenger?

[jenskujata]

brukte limewire når det var nytt, bruker ikke det lenger, poker programmene er mest sysler i helgene når jeg kjeder meg, ikke noe viktig.

laster ned hijack this og poster nytt.

[jenskujata]

den poster bare blankt her..

Endret 10. desember 2008 av jenskujata

[jenskujata]

nå kanskje, lastet ned framework fra windows dl center, rett etter første combofixen, hvor lurt nå enn det var.

 

hjt log

log1.txt

 

combolog

combolog1.txt

Endret 10. desember 2008 av jenskujata

[norbat]

Det ligger en tjeneste fra Trend Micro Personal Firewall. Bruke du dette, eller skal den fjernes?

 

Hvordan går det med zlob'en?

Endret 10. desember 2008 av norbat

[jenskujata]

har prøvd å fjerne firewallen hele dagen.

sliter enda med zloben, kicker meg ut hele tiden, samt med oppstart av firefox

poster ett bilde av oppstarten

 

virus2.doc

[norbat]

Åpne notisblokk og kopier inn det som står i fet skrift under, lagre fila på skrivebordet som CFScript.txt.

Dra deretter fila over Combofix-iconet. Combofix vil starte igjen. Post loggen.

 

File::

c:\windows\system32\drivers\ndisprot.sys

 

Folder::

c:\windows\Easy Decrypter

 

Driver::

Ndisprot

TmPfw

Endret 10. desember 2008 av norbat

[jenskujata]

0\38 , seems clean

 

ok, kommer tilbake om noen strakser igjen da hehe.

 

tusen takk for hjelpa

Endret 10. desember 2008 av jenskujata

[jenskujata]

noen strakser var vel å overdrive, combo låste seg når den skulle restarte, zlob poppet, så trykte svenskeknappen tilslutt.

nå kan jeg ikke logge inn på windows engang, vil ikke starte verken i sikkermodus eller andre moduser.

 

lsass.exe systemfeil

initialisering av sikkerhetskontobehandling mislyktes pga følgende feil. En enhet koblet til systemet virker ikke. Feilstatus 0xc0000001.klikk ok for å slå av maskinen og restarte på nytt i sikkermodus. se hendelseslogg for mer info.

[norbat]

Får du startet med 'Siste fungerende......'?

[jenskujata]

prøvd siste fungerende og sikkermodus, får samme feilmelding

[norbat]

Har du en win xp cd liggende?

[jenskujata]

det som er hovedproblemet mitt, maskinen er fra 2003 og har ingen boot cd noen plass til denne...

kan kanskje få lånt meg en cd fra gammel arbeidsplassen min, men er en litt annen xp de kjører der tror jeg

[norbat]

Hvilken versjon xp cd'n er, spiller egentlig ingen så stor rolle. Vi må komme oss ut i systemgjenopprettingen for å kjøre chkdsk /r. Sjekk om du får lånt deg en slik plate.

 

Det du da skal gjøre er å boote med denne cd'n (sett den i cd-rommen og start pc'n)

Velg å reparere vha. gjenopprettingskonsollen (vanligvis ved å trykke E)

Velg hvilket operativsystem du vil bruke gjenopprettingskonsollen (vanligvis valg 1)

Fra ledetekst, skriver du chkdsk /r

 

Problemet er knyttet til denne infeksjonen: Trojan.Flus.M

[jenskujata]

ok, får se om jeg får tid i morgen, dårlig oppkjøring for eksamen i matte på fredagen dette

takk for hjelpen så langt og god natt.

[norbat]

Denne malwaren er i familie med Zlob og brukes til å sende deg til falske sider for å 'stjele' info.

 

Skulle selvfølgelig ha spurt deg om du hadde en xp cd'n tilgjengelig da det å fjerne drivere kan skape litt krøll. Combofix har mulighet til å innstallere gjenopprettingskonsollen (du fikk sikkert en melding om dette i starten av combofix-kjøringen).

 

Skaff deg en cd, så fortsetter vi derfra.