Feilmelding med Generich Host Process for Win32 Services

MrBaboy · 29. januar 2010

Noen som vet om et gratisprogram som scanner og reparerer registry?

Fant dette:

http://www.pctools.com/registry-mechanic/?...CFU833godTCnPzQ

Men den gjør bare et søk, og reparerer bare noen få feil. For å få reppet resten av feilene, må programmet kjøpes.

Jeg får feilmelding på en Compaq laptop når den starter opp.

"Windows har lukket dette programmet for å gi bedre beskyttelse for datamaskinen.

Generich Host Process for Win32 Services".

Når maskinen har stått på en liten stund kommer det opp et lite vindu som sier at maskinen avsluttes pga feil.

Jeg har scannet maskinen med Malwarebytes som fant masse dritt.

Scannet også med AVG'n som ikke fant noe,

Prøver å gå på AVG's sider for å oppgradere antivirusen, men det ser ut til at det må være et virus i maskinen som forhindrer maskinen å åpne antivirus-nettsider.

Får heller ikke til å starte maskinen i Sikker modus.

Om jeg velger å starte i Sikker modus, bare blinker den og kommer tilbake til samme startmenyen.

Kjørte nå scan med Registry Mechanic som finner 809 feil i registry.

Men får bare til å reparere 19 stykker av de.

Kjørte også HiackThis og fikk dette:

Noen som vil analysere?

C:\Programfiler\Registry Mechanic\RegMech.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\Programfiler\HP\Digital Imaging\bin\hpqimzone.exe

C:\Programfiler\iPod\bin\iPodService.exe

C:\Programfiler\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN, Messenger og Hotmail.com - MSN Norge

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = SOL - Alt du trenger på en side

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN, Messenger og Hotmail.com - MSN Norge

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN, Messenger og Hotmail.com - MSN Norge

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = Customize Your Settings

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Programfiler\AVG\AVG8\Toolbar\IEToolbar.dll

R3 - URLSearchHook: (no name) - *{EEE6C35D-6118-11DC-9C72-001320C79847} - (no file)

R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programfiler\AVG\AVG8\avgssie.dll

O2 - BHO: Windows Live Family Safety Browser Helper - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Programfiler\Windows Live\Family Safety\fssbho.dll

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Programfiler\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: BrowserHelper Class - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Programfiler\SGPSA\SearchAssistant.dll

O2 - BHO: Påloggingshjelp for Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Programfiler\AVG\AVG8\Toolbar\IEToolbar.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programfiler\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Programfiler\Windows Live\Toolbar\wltcore.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programfiler\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programfiler\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (file missing)

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Programfiler\Windows Live\Toolbar\wltcore.dll

O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programfiler\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (file missing)

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Programfiler\AVG\AVG8\Toolbar\IEToolbar.dll

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [QPService] "C:\Programfiler\HP\QuickPlay\QPService.exe"

O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

O4 - HKLM\..\Run: [Cpqset] C:\Programfiler\HPQ\Default Settings\cpqset.exe

O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe

O4 - HKLM\..\Run: [msnsyslog] C:\WINDOWS\msnappm.exe

O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\FELLES~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Programfiler\Fellesfiler\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [C0100Mon.exe] C:\WINDOWS\C0100Mon.exe

O4 - HKLM\..\Run: [close surf mail dupe] C:\Documents and Settings\All Users\Programdata\Tick Find Close Surf\show gpl.exe

O4 - HKLM\..\Run: [fssui] "C:\Programfiler\Windows Live\Family Safety\fsui.exe" -autorun

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Programfiler\Hp\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Programfiler\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programfiler\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Programfiler\Fellesfiler\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Programfiler\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Programfiler\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [RegistryMechanic] C:\Programfiler\Registry Mechanic\RegMech.exe /H

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-21-4055146127-2045322227-3793978178-501\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Gjest')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: HP Photosmart Premier Hurtigstart.lnk = C:\Programfiler\Hp\Digital Imaging\bin\hpqthb08.exe

O9 - Extra button: Blogg dette - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programfiler\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Blogg dette i Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programfiler\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O16 - DPF: {8C379EAB-FB26-4B71-BB5C-05B4C96E4851} (Hjemmeside.KvikFoto) - http://www.123hjemmeside.no/builder/pages/KvikFoto-1-0-6.CAB

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jin...indows-i586.cab

O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jin...indows-i586.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programfiler\AVG\AVG8\avgpp.dll

O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Programfiler\Hewlett-Packard\Shared\hpqwmiex.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Programfiler\Fellesfiler\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Programfiler\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programfiler\Java\jre6\bin\jqs.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programfiler\Fellesfiler\LightScribe\LSSrvc.exe

O23 - Service: PC Tools Startup and Shutdown Monitor service (PCToolsSSDMonitorSvc) - Unknown owner - C:\Programfiler\Fellesfiler\PC Tools\sMonitor\StartManSvc.exe

--

End of file - 11325 bytes

29. januar 2010

Slett disse:

R3 - URLSearchHook: (no name) - *{EEE6C35D-6118-11DC-9C72-001320C79847} - (no file)

O2 - BHO: SWEETIE - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Programfiler\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (file missing)

O3 - Toolbar: SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Programfiler\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (file missing)

O4 - HKLM\..\Run: [msnsyslog] C:\WINDOWS\msnappm.exe

O4 - HKLM\..\Run: [C0100Mon.exe] C:\WINDOWS\C0100Mon.exe

O4 - HKLM\..\Run: [close surf mail dupe] C:\Documents and Settings\All Users\Programdata\Tick Find Close Surf\show gpl.exe

O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)

Anbefaler deg å ikke bruke reg. mech. og lignende prog. Skaper bare trøbbel.

Endret 29. januar 2010 av Slettet+19283741

MrBaboy · 29. januar 2010

I vinduet som kommer opp da maskinen avsluttes står det at det er "NT-MYNDIGHET SYSTEM som avslutter maskinen.

Noen som har en forklaring på hva som skjer her?

Og, hvorfor klarer ikke maskinen å starte i sikker modus?

Endret 29. januar 2010 av MrBaboy

MrBaboy · 30. januar 2010

Hele tiden blir maskinen avslått av systemet.

Får denne meldingen

Den kommer hele tiden så kjapt at de forskjellige scanninger og fix'er jeg prøver å kjøre blir avbrutt før prosessen er ferdig.

Finnes det en kommando som jeg kan gjøre som stopper denne shut down prosessen?

Leste en plass hvor en sa som følger:

"hvis du IKKE rekker det før pcen restarter, så åpne cmd og gå til c:/windows/system32 (det står på dette til vanlig) og skriv shutdown -a, så avbrytes denne dialogen, og du kan få kjørt virus-scan."

Hva/hvor/hvordan skulle dette gjøres? SKjønte ikke den er jeg.

zhanzet · 30. januar 2010

start kjør på startmenyen og skriv inn cmd, da vil du få opp kommandolinjen. skriv så "cd.."(eller så mange ganger det tar for å komme til C:/) og så "cd windows/system32"

da er du i system32 mappa og kan skrive inn shutdown -a"

MrBaboy · 30. januar 2010

Tusen takk...

Innen jeg rakk å lese ditt svar har jeg nå kjørt FixBlast sikkert 15-20 ganger om og om igjen, men hver hang har den blitt avbrutt av restarten.

Nå til slutt uten å gjøre noe som helst av det du skrev har plutselig PC'n latt være å restarte og fix'n fikk kjøre seg ferdig i fred.

Fixen fant ingen Blater worm....sa resultatet.

Nå har PC'n stått på i en times tid etter at fix'n kjørte seg ferdig og den har fortsatt ikke restartet seg selv.

Jeg har kjørt MalwareBytes en runde igjen og den finner heller ikke noe.

Jeg gikk inn på loggfier i MalwareBytes for å finne igjen loggene fra de tre første gangene jeg kjørte den....da den fant masse dritt der.

Her er loggene over hva den fjernet:

Malwarebytes' Anti-Malware 1.44
Databaseversjon: 3601

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

20.01.2010 13:33:15

mbam-log-2010-01-27 (13-33-15).txt

Skanntype: Rask Skann

Objekter skannet: 118618

Tid tilbakelagt: 10 minute(s), 21 second(s)

Minneprosesser infisert: 0

Minnemoduler infisert: 1

Registernøkler infisert: 18

Registerverdier infisert: 0

Registerfiler infisert: 0

Mapper infisert: 2

Filer infisert: 4

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

Minnemoduler infisert:

C:\WINDOWS\system32\win32extension.dll (Trojan.FakeAlert) -> Delete on reboot.

Registernøkler infisert:

HKEY_CLASSES_ROOT\CLSID\{6551001f-a07b-40b1-8f55-b44bf35a42a6} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{6551001f-a07b-40b1-8f55-b44bf35a42a6} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{6551001f-a07b-40b1-8f55-b44bf35a42a6} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\urlsearchhook.toolbarurlsearchho ok (Adware.Ecobar) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{4509d3cc-b642-4745-b030-645b79522c6d} (Adware.Ecobar) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{4897bba6-48d9-468c-8efa-846275d7701b} (Adware.Ecobar) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{ca3eb689-8f09-4026-aa10-b9534c691ce0} (Adware.Ecobar) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\urlsearchhook.toolbarurlsearchho ok.1 (Adware.Ecobar) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servis es (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00157f4 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c004c620 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c005dbd7 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00639a2 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0088d32 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c009c3e4 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c009ded8 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00dc7df (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00e84f6 (Trojan.Vundo) -> Quarantined and deleted successfully.

Registerverdier infisert:

(Ingen mistenkelige filer funnet)

Registerfiler infisert:

(Ingen mistenkelige filer funnet)

Mapper infisert:

C:\Programfiler\PersonalSec (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.

C:\Programfiler\Fellesfiler\PersonalSecUninstall (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.

Filer infisert:

C:\WINDOWS\system32\win32extension.dll (Trojan.FakeAlert) -> Delete on reboot.

C:\Programfiler\Fast Browser Search\IE\tbhelper.dll (Adware.Ecobar) -> Quarantined and deleted successfully.

C:\Programfiler\PersonalSec\psecurity.exe (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.

C:\Programfiler\Fellesfiler\PersonalSecUninstall\U ninstall.lnk (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.

Malwarebytes' Anti-Malware 1.44
Databaseversjon: 3510

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

28.01.2010 20:18:24

mbam-log-2010-01-28 (20-18-24).txt

Skanntype: Rask Skann

Objekter skannet: 116094

Tid tilbakelagt: 7 minute(s), 48 second(s)

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 13

Registerverdier infisert: 0

Registerfiler infisert: 0

Mapper infisert: 2

Filer infisert: 3

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

Minnemoduler infisert:

(Ingen mistenkelige filer funnet)

Registernøkler infisert:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servis es (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00157f4 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c004c620 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c005dbd7 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00639a2 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0088d32 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c009c3e4 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c009ded8 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00dc7df (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00e84f6 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{6551001f-a07b-40b1-8f55-b44bf35a42a6} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Ext\Stats\{6551001f-a07b-40b1-8f55-b44bf35a42a6} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{6551001f-a07b-40b1-8f55-b44bf35a42a6} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registerverdier infisert:

(Ingen mistenkelige filer funnet)

Registerfiler infisert:

(Ingen mistenkelige filer funnet)

Mapper infisert:

C:\Programfiler\PersonalSec (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.

C:\Programfiler\Fellesfiler\PersonalSecUninstall (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.

Filer infisert:

C:\Programfiler\PersonalSec\psecurity.exe (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.

C:\Programfiler\Fellesfiler\PersonalSecUninstall\U ninstall.lnk (Rogue.PersonalSecurity) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\win32extension.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Malwarebytes' Anti-Malware 1.44
Databaseversjon: 3653

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

28.01.2010 20:46:03

mbam-log-2010-01-28 (20-46-03).txt

Skanntype: Rask Skann

Objekter skannet: 119038

Tid tilbakelagt: 7 minute(s), 7 second(s)

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 5

Registerverdier infisert: 0

Registerfiler infisert: 0

Mapper infisert: 0

Filer infisert: 1

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

Minnemoduler infisert:

(Ingen mistenkelige filer funnet)

Registernøkler infisert:

HKEY_CLASSES_ROOT\urlsearchhook.toolbarurlsearchho ok (Adware.Ecobar) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\TypeLib\{4509d3cc-b642-4745-b030-645b79522c6d} (Adware.Ecobar) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Interface\{4897bba6-48d9-468c-8efa-846275d7701b} (Adware.Ecobar) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{ca3eb689-8f09-4026-aa10-b9534c691ce0} (Adware.Ecobar) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\urlsearchhook.toolbarurlsearchho ok.1 (Adware.Ecobar) -> Quarantined and deleted successfully.

Registerverdier infisert:

(Ingen mistenkelige filer funnet)

Registerfiler infisert:

(Ingen mistenkelige filer funnet)

Mapper infisert:

(Ingen mistenkelige filer funnet)

Filer infisert:

C:\Programfiler\Fast Browser Search\IE\tbhelper.dll (Adware.Ecobar) -> Quarantined and deleted successfully.

Malwarebytes' Anti-Malware 1.44
Databaseversjon: 3653

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

28.01.2010 21:14:22

mbam-log-2010-01-28 (21-14-22).txt

Skanntype: Rask Skann

Objekter skannet: 119043

Tid tilbakelagt: 7 minute(s), 7 second(s)

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 0

Registerverdier infisert: 0

Registerfiler infisert: 0

Mapper infisert: 0

Filer infisert: 0

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

Minnemoduler infisert:

(Ingen mistenkelige filer funnet)

Registernøkler infisert:

(Ingen mistenkelige filer funnet)

Registerverdier infisert:

(Ingen mistenkelige filer funnet)

Registerfiler infisert:

(Ingen mistenkelige filer funnet)

Mapper infisert:

(Ingen mistenkelige filer funnet)

Filer infisert:

(Ingen mistenkelige filer funnet)

zhanzet · 30. januar 2010

er ikke kjent nok med regedit etc til å kunne si noe stort om hva den har slettet, men det høres ut som alt den har fjernet har hatt med div trojan å gjøre. kan kanskje virke som om den har klart å rette noe de gangene du har kjørt fixblast nok ganger også

MrBaboy · 30. januar 2010

Loggfilene fra FixBlast sier at den fant ingen ting.

Nå er maskinen tilbake i samme håpløse gange.

Får fortsatt samme feilmelding som jeg åpnet denne tråden med.

Den fortsetter å restarte i tide og utide.

Det går ikke å starte maskinen i Sikker modus.

Når jeg åpner IE8 kommer det opp med en ekstra browser som åpner med denne siden:

http://www.cmpd-no.com/default.aspx?affid=...48wns42Zv000000

En nettside med norsk reklame om en PC man kan vinne.

Jeg får også opp en feilmelding når IE8 åpnes:

"Et program på datamaskinen har skadet innstillingene for standard søkeleverandør i Internet Explorer.
Int. Eplorer har tilbakestilt denne innstillingen til den opprinnelige søkeleverandøren: Livesearch (search.live.com)

Int. Explorer åpner nå søkerinnstillinger, der du kan endre denne innstillingen, eller innstallere flere søkeleverandører."

Så åpnes vinduet for dette.

Der får jeg opp en liste over forskjellige søkeleverandører, og hvor Live Search står som standard.

Når jeg så prøver å endre standard leverandør til en annen, så skjer det ikke noe.

Funksjonene i vinduet har frosset og er låst.

MrBaboy · 30. januar 2010

Kjørte HijackThis nå og får denne loggen:

Logfile of Trend Micro HijackThis v2.0.3 (BETA)

Scan saved at 21:24:37, on 30.01.2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Programfiler\Java\jre6\bin\jqs.exe

C:\Programfiler\Fellesfiler\LightScribe\LSSrvc.exe

C:\Programfiler\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\WINDOWS\system32\svchost.exe

C:\PROGRA~1\AVG\AVG8\avgemc.exe

C:\Programfiler\Hewlett-Packard\Shared\hpqwmiex.exe

C:\Programfiler\AVG\AVG8\avgcsrvx.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe

C:\Programfiler\HP\QuickPlay\QPService.exe

C:\Programfiler\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe

C:\Programfiler\Fellesfiler\InstallShield\UpdateService\issch.exe

C:\WINDOWS\C0100Mon.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\Programfiler\Hp\HP Software Update\HPWuSchd2.exe

C:\Programfiler\Java\jre6\bin\jusched.exe

C:\Programfiler\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe