Gå til innhold

Fått trojansk hest via msn


Anbefalte innlegg

Hei godt folk!!!!

 

Jeg er lite kjent i dataverdenen. men nå fikk jeg en trojansk hest av msn-virus link. desverre. Har en HP 6735b om det er nyttig informasjon. Tusen takk til alle som vil hjelpe meg ut av knipen! :-(

 

mvh,

Lenke til kommentar
Videoannonse
Annonse

Hei godt folk!!!!

 

Jeg er lite kjent i dataverdenen. men nå fikk jeg en trojansk hest av msn-virus link. desverre. Har en HP 6735b om det er nyttig informasjon. Tusen takk til alle som vil hjelpe meg ut av knipen! :-(

 

mvh,

 

jeg trykket på en eller annen link om .gif eller noe ...

Scan type: Manual Scan

Event: Security Risk Found!

Risk: W32.Pilleuz

File: C:\RECYCLER\S-1-5-21-5783377503-6114429389-014534049-4156\yv8g67.exe

Location: C:\RECYCLER\S-1-5-21-5783377503-6114429389-014534049-4156

Computer: H-BB-HENKLI1

User: UNETT\henkli1

Action taken: Cleaned by Deletion

Date found: 7. mars 2010 21:55:58

 

Jeg får mange nå. sliter noe sykt. jeg lastet ned den linken/programmet du sendte iste, men det kom en eller annen error. ellers aner jeg ikke hva jeg skal gjøre nå

Lenke til kommentar

DDS (Ver_09-12-01.01) - NTFSx86

Run by at 22:56:48,71 on 07.03.2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.3.1252.47.1044.18.2813.1364 [GMT 1:00]

 

AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

 

============== Running Processes ===============

 

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Programfiler\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\Ati2evxx.exe

C:\Programfiler\WIDCOMM\Bluetooth Software\bin\btwdins.exe

svchost.exe

svchost.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

C:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\WINDOWS\system32\agrsmsvc.exe

C:\Programfiler\Symantec AntiVirus\DefWatch.exe

C:\Programfiler\Fellesfiler\InterVideo\RegMgr\iviRegMgr.exe

C:\Programfiler\Java\jre6\bin\jqs.exe

C:\Programfiler\Fellesfiler\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Programfiler\Symantec AntiVirus\SavRoam.exe

C:\Programfiler\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Programfiler\Symantec AntiVirus\Rtvscan.exe

C:\Programfiler\UPHClean\uphclean.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\Programfiler\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe

C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe

C:\PROGRA~1\SYMANT~1\VPTray.exe

C:\Programfiler\Hewlett-Packard\Shared\hpqwmiex.exe

C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe

C:\Programfiler\Java\jre6\bin\jusched.exe

C:\Programfiler\Windows Defender\MSASCui.exe

C:\Programfiler\Analog Devices\Core\smax4pnp.exe

C:\Programfiler\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe

C:\Programfiler\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Programfiler\Windows Live\Messenger\msnmsgr.exe

C:\Programfiler\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Programfiler\Skype\Phone\Skype.exe

C:\Programfiler\LimeWire\LimeWire.exe

C:\Programfiler\Skype\Plugin Manager\skypePM.exe

C:\Programfiler\Windows Live\Contacts\wlcomm.exe

C:\Programfiler\Spotify\Spotify.exe

C:\Programfiler\Symantec AntiVirus\vpc32.exe

C:\Programfiler\Internet Explorer\IEXPLORE.EXE

C:\Programfiler\Internet Explorer\IEXPLORE.EXE

C:\Programfiler\Skype\Toolbars\Shared\SkypeNames.exe

C:\Programfiler\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\explorer.exe

C:\Programfiler\Internet Explorer\IEXPLORE.EXE

C:\Programfiler\Internet Explorer\IEXPLORE.EXE

C:\Programfiler\Hewlett-Packard\Shared\hpqToaster.exe

C:\Documents and Settings\LocalService\Skrivebord\dds.scr

 

============== Pseudo HJT Report ===============

 

uStart Page = hxxp://www.skoleportalen.no/

uDefault_Page_URL = hxxp://lav.hfk.no

uURLSearchHooks: Free Lunch Design Toolbar: {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - c:\programfiler\free_lunch_design\tbFre1.dll

uWinlogon: Shell=c:\documents and settings\henkli1\programdata\ufxw.exe,explorer.exe,c:\recycler\s-1-5-21-5783377503-6114429389-014534049-4156\yv8g67.exe

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\programfiler\fellesfiler\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\programfiler\skype\toolbars\internet explorer\SkypeIEPlugin.dll

BHO: Free Lunch Design Toolbar: {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - c:\programfiler\free_lunch_design\tbFre1.dll

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\programfiler\microsoft\search enhancement pack\search helper\SearchHelper.dll

BHO: Påloggingshjelp for Windows Live: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\programfiler\fellesfiler\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\programfiler\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\programfiler\google\googletoolbarnotifier\5.5.4723.1820\swg.dll

BHO: LimeWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\programfiler\ask.com\GenericAskToolbar.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\programfiler\java\jre6\bin\jp2ssv.dll

BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\programfiler\windows live\toolbar\wltcore.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\programfiler\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: Search Assistant: {f0626a63-410b-45e2-99a1-3f2475b2d695} - c:\programfiler\sgpsa\BHO.dll

BHO: Fast Browser Search Toolbar Helper: {fcbccb87-9224-4b8d-b117-f56d924beb18} - c:\programfiler\fast browser search\ie\FBStoolbar.dll

TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\programfiler\windows live\toolbar\wltcore.dll

TB: Free Lunch Design Toolbar: {57cc715d-37ca-44e4-9ec2-8c2cbddb25ec} - c:\programfiler\free_lunch_design\tbFre1.dll

TB: Fast Browser Search Toolbar: {1bb22d38-a411-4b13-a746-c2a4f4ec7344} - c:\programfiler\fast browser search\ie\FBStoolbar.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\programfiler\google\google toolbar\GoogleToolbar_32.dll

TB: LimeWire Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\programfiler\ask.com\GenericAskToolbar.dll

uRun: [msnmsgr] "c:\programfiler\windows live\messenger\msnmsgr.exe" /background

uRun: [skype] "c:\programfiler\skype\phone\Skype.exe" /nosplash /minimized

uRun: [swg] "c:\programfiler\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [yukkgww] c:\windows\system32\g9c1yjfaa6.exe

uRun: [riiduu] c:\windows\system32\2dyy6kk.exe

uRun: [AROReminder]

mRun: [soundMAX] c:\programfiler\analog devices\soundmax\Smax4.exe /tray

mRun: [QlbCtrl.exe] c:\programfiler\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start

mRun: [synTPEnh] c:\programfiler\synaptics\syntp\SynTPEnh.exe

mRun: [WatchDog] c:\programfiler\intervideo\dvd check\DVDCheck.exe

mRun: [ccApp] "c:\programfiler\fellesfiler\symantec shared\ccApp.exe"

mRun: [vptray] c:\progra~1\symant~1\VPTray.exe

mRun: [Adobe Reader Speed Launcher] "c:\programfiler\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [QuickTime Task] "c:\programfiler\quicktime\qttask.exe" -atboottime

mRun: [TkBellExe] "c:\programfiler\fellesfiler\real\update_ob\realsched.exe" -osboot

mRun: [sunJavaUpdateSched] "c:\programfiler\java\jre6\bin\jusched.exe"

mRun: [Windows Defender] "c:\programfiler\windows defender\MSASCui.exe" -hide

mRun: [soundMAXPnP] c:\programfiler\analog devices\core\smax4pnp.exe

mRun: [startCCC] "c:\programfiler\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun

mRun: [sGPUpdater] c:\programfiler\search guard plusu\sgpUpdaters.exe

mRun: [FBSearch] c:\programfiler\search guard plus\SearchGuardPlus.exe

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

dRun: [DWQueuedReporting] "c:\progra~1\felles~1\micros~1\dw\dwtrig20.exe" -t

StartupFolder: c:\docume~1\alluse~1\start-~1\progra~1\oppstart\dvdche~1.lnk - c:\programfiler\intervideo\dvd check\DVDCheck.exe

IE: E&ksporter til Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

IE: Google Sidewiki - c:\programfiler\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

IE: {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - c:\microgaming\poker\ladbrokesmpp\MPPoker.exe

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\programfiler\widcomm\bluetooth software\btsendto_ie.htm

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\programfiler\messenger\msmsgs.exe

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\programfiler\windows live\writer\WriterBrowserExtension.dll

IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\programfiler\skype\toolbars\internet explorer\SkypeIEPlugin.dll

IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\programfiler\skype\toolbars\internet explorer\SkypeIEPlugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/E/3/9/E39C664F-A8E3-4F69-A109-1AE9849204EE/OGAControl.cab

DPF: {15B782AF-55D8-11D1-B477-006097098764} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/authorware/awswaxd.cab

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1235482515796

DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} - hxxp://office.microsoft.com/officeupdate/content/opuc4.cab

DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\felles~1\skype\SKYPE4~1.DLL

Notify: AtiExtEvent - Ati2evxx.dll

Notify: NavLogon - c:\windows\system32\NavLogon.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

 

================= FIREFOX ===================

 

FF - ProfilePath -

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

 

---- FIREFOX POLICIES ----

c:\programfiler\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\programfiler\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".no");

 

============= SERVICES / DRIVERS ===============

 

R0 ahcix86;ahcix86;c:\windows\system32\drivers\ahcix86.sys [2009-2-24 174600]

R0 Amddfltr;Amd Disk Lower Filter Driver;c:\windows\system32\drivers\Amddfltr.sys [2009-2-24 15416]

R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [2008-3-28 24064]

R1 SAVRT;SAVRT;c:\programfiler\symantec antivirus\savrt.sys [2008-5-28 337280]

R1 SAVRTPEL;SAVRTPEL;c:\programfiler\symantec antivirus\Savrtpel.sys [2008-5-28 54656]

R2 ccEvtMgr;Symantec Event Manager;c:\programfiler\fellesfiler\symantec shared\ccEvtMgr.exe [2008-6-24 191848]

R2 ccSetMgr;Symantec Settings Manager;c:\programfiler\fellesfiler\symantec shared\ccSetMgr.exe [2008-6-24 169320]

R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2009-8-25 54752]

R2 SavRoam;SAVRoam;c:\programfiler\symantec antivirus\SavRoam.exe [2008-9-30 116664]

R2 Symantec AntiVirus;Symantec AntiVirus;c:\programfiler\symantec antivirus\Rtvscan.exe [2008-9-30 1956792]

R2 WinDefend;Windows Defender;c:\programfiler\windows defender\MsMpEng.exe [2006-11-3 13592]

R3 Com4QLBEx;Com4QLBEx;c:\programfiler\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2009-2-24 222512]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\programfiler\fellesfiler\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-8-28 102448]

R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2008-7-23 44800]

R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [2008-1-14 21632]

R3 NAVENG;NAVENG;c:\progra~1\felles~1\symant~1\virusd~1\20100307.007\naveng.sys [2010-3-7 84912]

R3 NAVEX15;NAVEX15;c:\progra~1\felles~1\symant~1\virusd~1\20100307.007\navex15.sys [2010-3-7 1324720]

S2 gupdate;Googles oppdateringstjeneste (gupdate);c:\programfiler\google\update\GoogleUpdate.exe [2010-2-11 135664]

S3 fsssvc;Windows Live Tryggere for familien-tjenesten;c:\programfiler\windows live\family safety\fsssvc.exe [2009-8-5 704864]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2009-2-24 14336]

 

============== File Associations ===============

 

regfile="regedit.exe" "%1"

 

=============== Created Last 30 ================

 

2010-03-07 20:53:21 0 d--h--r- c:\documents and settings\localservice\Siste

2010-03-07 20:53:20 0 d-----r- c:\documents and settings\localservice\Mine dokumenter

2010-03-07 20:51:51 0 d-----w- c:\programfiler\Advanced Registry Optimizer

2010-03-07 20:51:51 0 d-----w- c:\documents and settings\localservice\Skrivebord

2010-03-07 20:51:36 0 d-----w- c:\documents and settings\localservice\Start-meny

2010-03-07 20:23:27 0 d-sh--w- c:\documents and settings\localservice\PrivacIE

2010-03-07 20:23:03 0 d-----r- c:\documents and settings\localservice\Favoritter

2010-03-07 19:54:13 41472 --sh--r- c:\windows\system32\2dyy6kk.exe

2010-03-04 08:47:01 49152 --sh--r- c:\windows\system32\g9c1yjfaa6.exe

2010-03-03 23:24:30 0 d-----w- c:\programfiler\Ask.com

2010-03-03 23:23:40 0 d-----w- c:\programfiler\LimeWire

2010-02-11 22:28:03 0 d-----w- C:\Programdata

2010-02-11 20:43:24 68840 ----a-w- C:\GDIPFONTCACHEV1.DAT

2010-02-11 06:59:27 33280 -c----w- c:\windows\system32\dllcache\csrsrv.dll

2010-02-11 06:59:22 11264 -c----w- c:\windows\system32\dllcache\msrle32.dll

2010-02-11 06:59:19 344064 -c----w- c:\windows\system32\dllcache\mspaint.exe

2010-02-08 17:12:56 0 d-----w- c:\docume~1\alluse~1\progra~1\AVS4YOU

2010-02-08 17:04:15 0 d-----w- c:\programfiler\fellesfiler\AVSMedia

2010-02-08 17:04:11 974848 ----a-w- c:\windows\system32\mfc70.dll

2010-02-08 17:04:11 487424 ----a-w- c:\windows\system32\msvcp70.dll

2010-02-08 17:04:11 344064 ----a-w- c:\windows\system32\msvcr70.dll

2010-02-08 17:04:11 24576 ----a-w- c:\windows\system32\msxml3a.dll

2010-02-08 17:04:11 1700352 ----a-w- c:\windows\system32\GdiPlus.dll

2010-02-08 17:04:11 0 d-----w- c:\programfiler\AVS4YOU

2010-02-07 18:05:10 0 d-----w- c:\programfiler\Rockstar Games

 

==================== Find3M ====================

 

2010-02-24 08:16:06 181632 ------w- c:\windows\system32\MpSigStub.exe

2009-12-27 14:35:02 21504 ----a-w- c:\windows\jestertb.dll

2009-12-21 19:10:29 916480 ----a-w- c:\windows\system32\wininet.dll

2009-12-17 07:42:59 344064 ----a-w- c:\windows\system32\mspaint.exe

2009-12-14 07:10:20 33280 ----a-w- c:\windows\system32\csrsrv.dll

2009-12-09 10:12:16 2147328 ----a-w- c:\windows\system32\ntoskrnl.exe

2009-12-09 10:12:16 2025984 ----a-w- c:\windows\system32\ntkrnlpa.exe

2009-05-07 10:12:26 868352 --sha-w- c:\windows\system32\config\systemprofile\iecompatcache\index.dat

2009-05-13 11:54:41 245760 --sha-w- c:\windows\system32\config\systemprofile\ietldcache\index.dat

2009-05-13 11:54:41 32768 --sha-w- c:\windows\system32\config\systemprofile\privacie\index.dat

2009-05-07 10:12:26 32768 --sha-w- c:\windows\system32\config\systemprofile\programdata\microsoft\internet explorer\userdata\index.dat

 

fjerner den så snart som mulig nå. om det er negativt at den ligger på nett

Lenke til kommentar

Opprett en konto eller logg inn for å kommentere

Du må være et medlem for å kunne skrive en kommentar

Opprett konto

Det er enkelt å melde seg inn for å starte en ny konto!

Start en konto

Logg inn

Har du allerede en konto? Logg inn her.

Logg inn nå
  • Hvem er aktive   0 medlemmer

    • Ingen innloggede medlemmer aktive
×
×
  • Opprett ny...