System Shutdown

[Kazooo]

Jeg får regelmessig denne feilmeldingen:

 

 

 

Den teller ned fra 30 sekunder, så slokner alt og maskina starter på nytt. Har prøvd virussøk, men det er der fortsatt. Det går ikke an å avbryte den, men den hører til systemprossessen 'winlogon.exe'.

 

Noen tips?

[JAH]

åpner du cmd og skriver shutdown -a, så stopper du shutdown.

Da får du litt bedre til til å feilsøke

[snippsat]

Start->kjør->cmd

shutdown -a

Vil stoppe den.

 

Du har nok et maleware som kjører.

Følg Veiledningen loggene poster du her i tråden din.

 

Har du problemer meg og kjøre i normalmodus kjører du i sikkerhetsmodus.

Boot trykk F8 flere ganger under oppstart,meny kommer velg sikkerhetsmodus.

Endret 2. juni 2010 av SNIPPSAT

[Kazooo]

Ok kjørte Malware. Dette er loggen:

 

 

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

 

Databaseversjon: 4165

 

Windows 5.1.2600 Service Pack 3

Internet Explorer 6.0.2900.5512

 

02.06.2010 23:09:50

mbam-log-2010-06-02 (23-09-50).txt

 

Skanntype: Hurtigsøk

Objekter skannet: 138779

Tid tilbakelagt: 12 minutt(er), 35 sekund(er)

 

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 12

Registerverdier infisert: 3

Registerfiler infisert: 3

Mapper infisert: 1

Filer infisert 15

 

Minneprosesser infisert:

(Ingen skadelige objekter funnet)

 

Minnemoduler infisert:

(Ingen skadelige objekter funnet)

 

Registernøkler infisert:

HKEY_CLASSES_ROOT\CLSID\{003541a1-3bc0-1b1c-aaf3-040114001c01} (Trojan.Agent) -> No action taken.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> No action taken.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{3446af26-b8d7-199b-4cfc-6fd764ca5c9f} (Backdoor.Bot) -> No action taken.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> No action taken.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{4776c4dc-e894-7c06-2148-5d73cef5f905} (Backdoor.Bot) -> No action taken.

HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> No action taken.

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> No action taken.

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{3446af26-b8d7-199b-4cfc-6fd764ca5c9f} (Backdoor.Bot) -> No action taken.

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> No action taken.

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{4776c4dc-e894-7c06-2148-5d73cef5f905} (Backdoor.Bot) -> No action taken.

HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{494e6cec-7483-a4ee-0938-895519a84bc7} (Backdoor.Bot) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\reset5c (Trojan.Agent) -> No action taken.

 

Registerverdier infisert:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\swupdate (Trojan.Agent) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\getdo (Trojan.Agent) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\uid (Malware.Trace) -> No action taken.

 

Registerfiler infisert:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Zbot) -> Data: c:\windows\system32\sdra64.exe -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Zbot) -> Data: system32\sdra64.exe -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) Good: (userinit.exe) -> No action taken.

 

Mapper infisert:

C:\WINDOWS\system32\lowsec (Stolen.data) -> No action taken.

 

Filer infisert

C:\WINDOWS\system32\sdra64.exe (Trojan.Zbot) -> No action taken.

C:\Documents and Settings\Henning\Local Settings\Temp\e.exe (Trojan.Zbot) -> No action taken.

C:\Documents and Settings\Henning\Local Settings\Temporary Internet Files\Content.IE5\0DUBGHQN\load[2].exe (Trojan.Zbot) -> No action taken.

C:\WINDOWS\system32\lowsec\local.ds (Stolen.data) -> No action taken.

C:\WINDOWS\system32\lowsec\user.ds (Stolen.data) -> No action taken.

C:\WINDOWS\system32\lowsec\user.ds.lll (Stolen.data) -> No action taken.

C:\Documents and Settings\Henning\Application Data\Adobe\Update\flacor.dat (Trojan.Agent) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\Local.dtd (Malware.Trace) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\Ui.dtd (Malware.Trace) -> No action taken.

C:\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\UTemp.dtd (Malware.Trace) -> No action taken.

C:\WINDOWS\msacm32.drv (Trojan.Agent) -> No action taken.

C:\WINDOWS\rasqervy.dll (Malware.Trace) -> No action taken.

C:\WINDOWS\sdfinacs.dll (Malware.Trace) -> No action taken.

C:\WINDOWS\sdfixwcs.dll (Malware.Trace) -> No action taken.

C:\WINDOWS\wuasirvy.dll (Trojan.Banker) -> No action taken.

[snippsat]

Merk av så malwarebytes sletter det den finner ikke stå No action taken

Etter et er gjort kjører du combofix og poster loggen.