Gå til innhold

[Løst] Alt er bakvendt og oppned, og teksten jeg skriver forsvinner

ErikBlodøks

Av ErikBlodøks
i IKT-drift og sikkerhet

Anbefalte innlegg

ErikBlodøks

ErikBlodøks

Skrevet
Skrevet (endret)

Hei dere. Jeg har tydligvis fått et problem:

 

Dette oppdaget jeg senest igår kveld. Alt var helt merkelig og "bakvendt og oppned" hvis dere skjønner. F.eks:å går den ikke opp og ned siden slik den skal gjøre, men zoomer inn og ut.

 

og akkurat nå så plutselig begynte den å fjerne det jeg hadde skrevet her, som når man trykker på backspace.

 

når jeg skulle skrive inn passordet for å gå inn på pcn så gikk det ikke, den stod liksom og blinket.

 

enkelte knapper funker av og til ikke.

 

pcn går svært trekt til tider, og tregt ellers.

 

HJELP!!

 

jeg skal benytte meg av "norbat" sin veiledning som jeg fant. håper noen kan kansje si " slapp av, det er ikke værre enn å gjøre slik og slik" :S ikke opplevd lignende, jeg må bare skrive dette dårlig skrevet innlegget før den begynner å viske seg ut igjen hehe TROR DETTE SKYLDES ET SÅN mail virus greie, fikk en mail av en kompis, trykket på linken og så plutselig begynte firefox og kødde og så komm det slik scanning greie på "min datamaskin"

Endret av ErikBlodøks
Lenke til kommentar

Videoannonse

Videoannonse
Annonse
r2d290

r2d290

Skrevet
Skrevet

Freak out! Dette kommer nok til å bli vanskelig.

 

Neida, om dette er malware-relatert burde vi kunne få til å fikse det. Loggene du får fra norbat sin veiledning sier ganske mye om hva som har skjedd på PCen din i det siste. Post loggene her, så skal vi nok få løst problemet :D

Lenke til kommentar
r2d290

r2d290

Skrevet
Skrevet

Heisann

 

I veiledningen (ref. signaturen min) står det bl.a at du også skal kjøre ComboFix, og poste loggen til ComboFix.

 

Combofix lagrer rapporten som C:\combofix.txt

Last opp denne filen i ditt neste svar på forumet (ved å legge det som et vedlegg).

Lenke til kommentar
System-log.com

System-log.com

Skrevet
Skrevet

Du kan prøve en bootbar løsning. Du kan se løsningen fra AVG i bruk her. Da booter du fra CD, oppdaterer virusdefinisjonene via nettverket (internett) og renser opp. Her tar ikke antivirusprogrammet hensyn til om filene er låst eller reservert fra operativsystemet (noe virus ofte blir - som forsvar fra vanlige antivirusprogrammer). Lykke til! :)

Lenke til kommentar
r2d290

r2d290

Skrevet
Skrevet (endret)

Legg merke til at alle instruksjonene som blir gitt i denne tråden er skreddersydd for denne maskinen, og at verktøyene som blir brukt her, kan forårsake skade på en annen maskin med andre typer infeksjoner.

 

Hvis du tror du har det samme problemet, bør du følge veiledningen, og poste loggene i en ny tråd.

 

Hallo

 

Mitt navn er r2d290, og jeg skal være med på å hjelpe deg med å fjerne alle infeksjoner du måtte ha på PC-en.

 

  • Det kommer til å bli gitt en rekke instruksjoner som må bli fulgt i den rekkefølgen vi skriver dem i.
     
  • Ikke prøv å fjerne problemet på egenhånd. Når vi først er i gang med en prosess er det viktig at den blir gjort "uten avbrytelser".
     
  • Hvis det er en instruksjon du ikke forstår, du er usikker på noe, eller det skjer noe uventet, må du ikke gjette/gå videre, men skrive en post på forumet der du spør om det du lurer på.
     
  • Ikke start flere tråder (hverken her på ITpro.no eller på andre forum). Dette vil bare forvirre oss som driver support.
     
  • Det kan hende at operasjonen vil gå i flere ledd, og det kan hende det tar litt tid før du får svar, men vi gir oss ikke hvis ikke du gjør det.
     
  • Ikke gi opp og formater PC-en (selv om noen sier at det er det eneste som hjelper). Det er svært sjelden at man må formatere grunnet virus.
     
  • I noen tilfeller hender det at tråder går oss hus forbi, så hvis du ikke har fått svar innen 24 timer kan det være lurt å skrive en liten "purre-post" så tråden din havner øverst på lista.

Hvis du følger disse instruksjonene, skal vi nok få fikset problemet med maskinen.

Jeg analyserer loggene dine nå, og vil komme tilbake med respons så snart jeg kan...

 

 

PS: Det kan hende at sikkerhetsprogrammene dine gir advarsler på noen av verktøyene vi ber deg om å bruke.

Sikkerhetsprogrammene kan ikke vite om verktøyene har gode eller dårlige hensikter. Verktøyene blir brukt av profesjonelle rundt om i hele verden, så du kan stole på at programmene er trygge.

Endret av r2d290
Lenke til kommentar
r2d290

r2d290

Skrevet
Skrevet

Det ser ut til at MBAM gjorde en god jobb, og fjernet en del malware. Combofix-loggen ser omtrent ren ut, men det er noe jeg er litt usikker på. Jeg kommer tilbake til dette senere i posten.

 

Jeg ser at du har mer enn ett antivirusprogram på PCen:

  • COMODO Internet Security
  • McAfee

(Det kan se ut til at du allerede har avinstallert McAfee, eller at du kan ha hatt problemer med å installere det, men det er noen rester igjen).

 

Dette er veldig farlig, ettersom flere antivirusprogrammer kan jobbe mot hverandre og faktisk tillate at mer malware slipper gjennom.

Det er viktig at du bare har ett antivirusprogram med aktivert sanntidssøk.

Jeg anbefaler at du enten (1) fjerner alt utenom ett antivirusprogram (Start->Kontrollpanel->Avinstaller et program), ELLER (2) beholder begge programmene, men skrur av sanntidssøket på alle utenom ett program mesteparten av tiden.

Du kan fortsatt bruke dem for å søke etter virus på maskinen.

Vennligst gi tilbakemelding på hvilket alternativ du velger. Hvis du velger å fjerne et av antivirusprogrammene, vennligst gi tilbakemelding på hvilke du ønsker å fjerne.

 

Bruker online scanner for å sjekke noen filer

  • Gå til VirusTotal
  • Klikk Choose/Bla gjennom....
  • Bla deg frem til filen i fet skrift:
    • c:\windows\SysWow64\temp.000
    • c:\windows\SysWow64\temp.001

    [*] Klikk Send file .

    [*] Kopier og lim inn resultatene i ditt neste svar på forumet når VirusTotal er ferdig med å skanne filen.

 

Altså, i neste tilbakemelding:

-Gi tilbakemelding på hvilket alternativ du valgte ang. flere antivirusprogram

-Post rapport for de to filene du laster opp i VirusTotal

Lenke til kommentar
ErikBlodøks

ErikBlodøks

Skrevet
  • Forfatter
Skrevet

temp000

 

VT Community Sign in ▼ My account ▼ Sign out Signing out... Languages ▼

 

VirusTotal's website has changed, we need new translations, do you feel like helping the community?

[email protected]

Sign in to VT CommunitySafety ratings and user comments (disinfection, in-the-wild locations, reverse engineering reports, etc.) on malware and URLs, free and easy.

email

password

Keep me logged in

Sign in Signing in, please wait...

Login failed, please try again

Forgot your password? Create an account

 

Edit my profile

View my profile

Inbox

 

Virustotal is a service that analyzes suspicious files and URLs and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus engines. More information...

 

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.

File name: temp.000

Submission date: 2011-01-26 10:33:04 (UTC)

Current status: queued queued (#88) analysing finished

 

 

Result: 0/ 43 (0.0%)

VT Community

 

not reviewed

Safety score: -

Compact Print results Antivirus Version Last Update Result

AhnLab-V3 2011.01.18.00 2011.01.17 -

AntiVir 7.11.1.247 2011.01.26 -

Antiy-AVL 2.0.3.7 2011.01.26 -

Avast 4.8.1351.0 2011.01.25 -

Avast5 5.0.677.0 2011.01.25 -

AVG 10.0.0.1190 2011.01.26 -

BitDefender 7.2 2011.01.26 -

CAT-QuickHeal 11.00 2011.01.25 -

ClamAV 0.96.4.0 2011.01.26 -

Commtouch 5.2.11.5 2011.01.26 -

Comodo 7504 2011.01.26 -

DrWeb 5.0.2.03300 2011.01.26 -

Emsisoft 5.1.0.1 2011.01.26 -

eSafe 7.0.17.0 2011.01.24 -

eTrust-Vet 36.1.8120 2011.01.26 -

F-Prot 4.6.2.117 2011.01.25 -

F-Secure 9.0.16160.0 2011.01.26 -

Fortinet 4.2.254.0 2011.01.26 -

GData 21 2011.01.26 -

Ikarus T3.1.1.97.0 2011.01.26 -

Jiangmin 13.0.900 2011.01.26 -

K7AntiVirus 9.78.3647 2011.01.25 -

Kaspersky 7.0.0.125 2011.01.26 -

McAfee 5.400.0.1158 2011.01.26 -

McAfee-GW-Edition 2010.1C 2011.01.26 -

Microsoft 1.6502 2011.01.26 -

NOD32 5820 2011.01.26 -

Norman 6.06.12 2011.01.26 -

nProtect 2011-01-18.01 2011.01.18 -

Panda 10.0.2.7 2011.01.25 -

PCTools 7.0.3.5 2011.01.26 -

Prevx 3.0 2011.01.26 -

Rising 23.42.02.03 2011.01.26 -

Sophos 4.61.0 2011.01.26 -

SUPERAntiSpyware 4.40.0.1006 2011.01.26 -

Symantec 20101.3.0.103 2011.01.26 -

TheHacker 6.7.0.1.120 2011.01.26 -

TrendMicro 9.120.0.1004 2011.01.26 -

TrendMicro-HouseCall 9.120.0.1004 2011.01.26 -

VBA32 3.12.14.3 2011.01.25 -

VIPRE 8200 2011.01.26 -

ViRobot 2011.1.26.4276 2011.01.26 -

VirusBuster 13.6.164.1 2011.01.25 -

Additional informationShow all

MD5 : 63da4613383ec70e047b4cd5c48f0b05

SHA1 : 578dd3ee844678c24c0831b6cc61a7dfae410bdc

SHA256: d4287ab5e4988dfe99bd54243d50dbe8744094f11fe5f9809a1a6fb9728c2124

ssdeep: 6144:sQ70n5legBB8h6GyoXwI7kohyRAeFMWiFaNF7R5LYrdKuOpO:sQ7k5lpBBi6e7kog/5Bbu

3

File size : 266293 bytes

First seen: 2009-02-21 05:19:37

Last seen : 2011-01-26 10:33:04

TrID:

Win32 EXE PECompact compressed (generic) (41.8%)

Win32 Executable MS Visual C++ (generic) (37.9%)

Win32 Executable Generic (8.5%)

Win32 Dynamic Link Library (generic) (7.6%)

Generic Win/DOS Executable (2.0%)

sigcheck:

publisher....: Microsoft Corporation

copyright....: Copyright © Microsoft Corp. 1981-1998

product......: Microsoft ® Visual C__

description..: Microsoft ® C Runtime Library

original name: MSVCRT.DLL

internal name: MSVCRT.DLL

file version.: 6.00.8337.0

comments.....: n/a

signers......: -

signing date.: -

verified.....: Unsigned

 

PEInfo: PE structure information

 

[[ basic data ]]

entrypointaddress: 0x3428

timedatestamp....: 0x366734DA (Fri Dec 04 01:03:22 1998)

machinetype......: 0x14c (I386)

 

[[ 5 section(s) ]]

name, viradd, virsiz, rawdsiz, ntropy, md5

.text, 0x1000, 0x2C415, 0x2D000, 6.68, 4949d1cdc76cb7422dc0206742f03d59

.rdata, 0x2E000, 0x6D92, 0x7000, 5.75, 9fa53bdbc12bb9693798d257aab0a50b

.data, 0x35000, 0x6750, 0x7000, 2.33, 67e008d538dc22542eb1226f0a3ce884

.rsrc, 0x3C000, 0x3A8, 0x1000, 1.00, a239c59b858ac54dba3378330481eab6

.reloc, 0x3D000, 0x22CC, 0x3000, 5.63, 97b39ad4aa3e98ecf71f284097c989a1

 

[[ 1 import(s) ]]

KERNEL32.dll: SetFilePointer, RtlUnwind, IsBadReadPtr, IsBadWritePtr, IsBadCodePtr, SetUnhandledExceptionFilter, GetModuleFileNameA, GetModuleFileNameW, ExitProcess, TerminateProcess, GetCurrentProcess, WriteFile, GetStdHandle, GetCommandLineA, GetVersion, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetLastError, ResumeThread, CreateThread, TlsSetValue, ExitThread, CloseHandle, GetCurrentThreadId, TlsAlloc, TlsFree, SetLastError, TlsGetValue, GetCurrentThread, FindNextFileA, FindFirstFileA, FindClose, FindNextFileW, FindFirstFileW, HeapFree, HeapAlloc, GetModuleHandleA, GetEnvironmentVariableA, GetVersionExA, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, HeapReAlloc, SetHandleCount, GetFileType, GetStartupInfoA, GetCPInfo, GetACP, GetOEMCP, GetProcAddress, LoadLibraryA, MultiByteToWideChar, GetCommandLineW, FreeEnvironmentStringsA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStrings, GetEnvironmentStringsW, UnhandledExceptionFilter, GetStringTypeA, GetStringTypeW, LCMapStringA, LCMapStringW, SetConsoleCtrlHandler, SetEnvironmentVariableW, InterlockedDecrement, InterlockedIncrement, FlushFileBuffers, RaiseException, SetStdHandle, Sleep, CompareStringA, CompareStringW, IsValidLocale, IsValidCodePage, GetLocaleInfoA, EnumSystemLocalesA, GetUserDefaultLCID, GetLocaleInfoW, GetTimeZoneInformation, SetEnvironmentVariableA, Beep, FileTimeToSystemTime, FileTimeToLocalFileTime, GetDiskFreeSpaceA, GetLogicalDrives, SetErrorMode, GetFileAttributesA, GetCurrentDirectoryA, SetCurrentDirectoryA, SetFileAttributesA, GetFullPathNameA, GetDriveTypeA, GetCurrentProcessId, CreateDirectoryA, RemoveDirectoryA, DeleteFileA, GetFileAttributesW, GetCurrentDirectoryW, SetCurrentDirectoryW, SetFileAttributesW, GetFullPathNameW, CreateDirectoryW, DeleteFileW, MoveFileW, RemoveDirectoryW, GetDriveTypeW, MoveFileA, GetExitCodeProcess, WaitForSingleObject, FreeLibrary, CreateProcessA, CreateProcessW, HeapValidate, HeapCompact, HeapWalk, HeapSize, ReadConsoleA, SetConsoleMode, GetConsoleMode, SetEndOfFile, WriteConsoleA, DuplicateHandle, GetFileInformationByHandle, PeekNamedPipe, ReadConsoleInputA, PeekConsoleInputA, GetNumberOfConsoleInputEvents, LockFile, UnlockFile, CreateFileA, CreatePipe, ReadFile, CreateFileW, GetSystemTimeAsFileTime, SetFileTime, LocalFileTimeToFileTime, SystemTimeToFileTime, GetLocalTime, SetLocalTime, GetSystemTime

 

[[ 759 export(s) ]]

$I10_OUTPUT, __0__non_rtti_object@@QAE@ABV0@@Z, __0__non_rtti_object@@QAE@PBD@Z, __0bad_cast@@QAE@ABQBD@Z, __0bad_cast@@QAE@ABV0@@Z, __0bad_typeid@@QAE@ABV0@@Z, __0bad_typeid@@QAE@PBD@Z, __0exception@@QAE@ABQBD@Z, __0exception@@QAE@ABV0@@Z, __0exception@@QAE@XZ, __1__non_rtti_object@@UAE@XZ, __1bad_cast@@UAE@XZ, __1bad_typeid@@UAE@XZ, __1exception@@UAE@XZ, __1type_info@@UAE@XZ, __2@YAPAXI@Z, __3@YAXPAX@Z, __4__non_rtti_object@@QAEAAV0@ABV0@@Z, __4bad_cast@@QAEAAV0@ABV0@@Z, __4bad_typeid@@QAEAAV0@ABV0@@Z, __4exception@@QAEAAV0@ABV0@@Z, __8type_info@@QBEHABV0@@Z, __9type_info@@QBEHABV0@@Z, ___7__non_rtti_object@@6B@, ___7bad_cast@@6B@, ___7bad_typeid@@6B@, ___7exception@@6B@, ___E__non_rtti_object@@UAEPAXI@Z, ___Ebad_cast@@UAEPAXI@Z, ___Ebad_typeid@@UAEPAXI@Z, ___Eexception@@UAEPAXI@Z, ___G__non_rtti_object@@UAEPAXI@Z, ___Gbad_cast@@UAEPAXI@Z, ___Gbad_typeid@@UAEPAXI@Z, ___Gexception@@UAEPAXI@Z, __query_new_handler@@YAP6AHI@ZXZ, __query_new_mode@@YAHXZ, __set_new_handler@@YAP6AHI@ZP6AHI@Z@Z, __set_new_mode@@YAHH@Z, __set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z, _before@type_info@@QBEHABV1@@Z, _name@type_info@@QBEPBDXZ, _raw_name@type_info@@QBEPBDXZ, _set_new_handler@@YAP6AXXZP6AXXZ@Z, _set_terminate@@YAP6AXXZP6AXXZ@Z, _set_unexpected@@YAP6AXXZP6AXXZ@Z, _terminate@@YAXXZ, _unexpected@@YAXXZ, _what@exception@@UBEPBDXZ, _CIacos, _CIasin, _CIatan, _CIatan2, _CIcos, _CIcosh, _CIexp, _CIfmod, _CIlog, _CIlog10, _CIpow, _CIsin, _CIsinh, _CIsqrt, _CItan, _CItanh, _CxxThrowException, _EH_prolog, _Getdays, _Getmonths, _Gettnames, _HUGE, _Strftime, _XcptFilter, __CxxFrameHandler, __CxxLongjmpUnwind, __RTCastToVoid, __RTDynamicCast, __RTtypeid, __STRINGTOLD, __argc, __argv, __badioinfo, __crtCompareStringA, __crtGetLocaleInfoW, __crtLCMapStringA, __dllonexit, __doserrno, __fpecode, __getmainargs, __initenv, __isascii, __iscsym, __iscsymf, __lc_codepage, __lc_collate_cp, __lc_handle, __lconv_init, __mb_cur_max, __p___argc, __p___argv, __p___initenv, __p___mb_cur_max, __p___wargv, __p___winitenv, __p__acmdln, __p__amblksiz, __p__commode, __p__daylight, __p__dstbias, __p__environ, __p__fileinfo, __p__fmode, __p__iob, __p__mbcasemap, __p__mbctype, __p__osver, __p__pctype, __p__pgmptr, __p__pwctype, __p__timezone, __p__tzname, __p__wcmdln, __p__wenviron, __p__winmajor, __p__winminor, __p__winver, __p__wpgmptr, __pioinfo, __pxcptinfoptrs, __set_app_type, __setlc_active, __setusermatherr, __threadhandle, __threadid, __toascii, __unDName, __unDNameEx, __unguarded_readlc_active, __wargv, __wgetmainargs, __winitenv, _abnormal_termination, _access, _acmdln, _adj_fdiv_m16i, _adj_fdiv_m32, _adj_fdiv_m32i, _adj_fdiv_m64, _adj_fdiv_r, _adj_fdivr_m16i, _adj_fdivr_m32, _adj_fdivr_m32i, _adj_fdivr_m64, _adj_fpatan, _adj_fprem, _adj_fprem1, _adj_fptan, _adjust_fdiv, _aexit_rtn, _amsg_exit, _assert, _atodbl, _atoi64, _atoldbl, _beep, _beginthread, _beginthreadex, _c_exit, _cabs, _callnewh, _cexit, _cgets, _chdir, _chdrive, _chgsign, _chkesp, _chmod, _chsize, _clearfp, _close, _commit, _commode, _control87, _controlfp, _copysign, _cprintf, _cputs, _creat, _cscanf, _ctype, _cwait, _daylight, _dstbias, _dup, _dup2, _ecvt, _endthread, _endthreadex, _environ, _eof, _errno, _except_handler2, _except_handler3, _execl, _execle, _execlp, _execlpe, _execv, _execve, _execvp, _execvpe, _exit, _expand, _fcloseall, _fcvt, _fdopen, _fgetchar, _fgetwchar, _filbuf, _fileinfo, _filelength, _filelengthi64, _fileno, _findclose, _findfirst, _findfirsti64, _findnext, _findnexti64, _finite, _flsbuf, _flushall, _fmode, _fpclass, _fpieee_flt, _fpreset, _fputchar, _fputwchar, _fsopen, _fstat, _fstati64, _ftime, _ftol, _fullpath, _futime, _gcvt, _get_osfhandle, _get_sbh_threshold, _getch, _getche, _getcwd, _getdcwd, _getdiskfree, _getdllprocaddr, _getdrive, _getdrives, _getmaxstdio, _getmbcp, _getpid, _getsystime, _getw, _getws, _global_unwind2, _heapadd, _heapchk, _heapmin, _heapset, _heapused, _heapwalk, _hypot, _i64toa, _i64tow, _initterm, _inp, _inpd, _inpw, _iob, _isatty, _isctype, _ismbbalnum, _ismbbalpha, _ismbbgraph, _ismbbkalnum, _ismbbkana, _ismbbkprint, _ismbbkpunct, _ismbblead, _ismbbprint, _ismbbpunct, _ismbbtrail, _ismbcalnum, _ismbcalpha, _ismbcdigit, _ismbcgraph, _ismbchira, _ismbckata, _ismbcl0, _ismbcl1, _ismbcl2, _ismbclegal, _ismbclower, _ismbcprint, _ismbcpunct, _ismbcspace, _ismbcsymbol, _ismbcupper, _ismbslead, _ismbstrail, _isnan, _itoa, _itow, _j0, _j1, _jn, _kbhit, _lfind, _loaddll, _local_unwind2, _lock, _locking, _logb, _longjmpex, _lrotl, _lrotr, _lsearch, _lseek, _lseeki64, _ltoa, _ltow, _makepath, _mbbtombc, _mbbtype, _mbcasemap, _mbccpy, _mbcjistojms, _mbcjmstojis, _mbclen, _mbctohira, _mbctokata, _mbctolower, _mbctombb, _mbctoupper, _mbctype, _mbsbtype, _mbscat, _mbschr, _mbscmp, _mbscoll, _mbscpy, _mbscspn, _mbsdec, _mbsdup, _mbsicmp, _mbsicoll, _mbsinc, _mbslen, _mbslwr, _mbsnbcat, _mbsnbcmp, _mbsnbcnt, _mbsnbcoll, _mbsnbcpy, _mbsnbicmp, _mbsnbicoll, _mbsnbset, _mbsncat, _mbsnccnt, _mbsncmp, _mbsncoll, _mbsncpy, _mbsnextc, _mbsnicmp, _mbsnicoll, _mbsninc, _mbsnset, _mbspbrk, _mbsrchr, _mbsrev, _mbsset, _mbsspn, _mbsspnp, _mbsstr, _mbstok, _mbstrlen, _mbsupr, _memccpy, _memicmp, _mkdir, _mktemp, _msize, _nextafter, _onexit, _open, _open_osfhandle, _osver, _outp, _outpd, _outpw, _pclose, _pctype, _pgmptr, _pipe, _popen, _purecall, _putch, _putenv, _putw, _putws, _pwctype, _read, _rmdir, _rmtmp, _rotl, _rotr, _safe_fdiv, _safe_fdivr, _safe_fprem, _safe_fprem1, _scalb, _searchenv, _seh_longjmp_unwind, _set_error_mode, _set_sbh_threshold, _seterrormode, _setjmp, _setjmp3, _setmaxstdio, _setmbcp, _setmode, _setsystime, _sleep, _snprintf, _snwprintf, _sopen, _spawnl, _spawnle, _spawnlp, _spawnlpe, _spawnv, _spawnve, _spawnvp, _spawnvpe, _splitpath, _stat, _stati64, _statusfp, _strcmpi, _strdate, _strdup, _strerror, _stricmp, _stricoll, _strlwr, _strncoll, _strnicmp, _strnicoll, _strnset, _strrev, _strset, _strtime, _strupr, _swab, _sys_errlist, _sys_nerr, _tell, _telli64, _tempnam, _timezone, _tolower, _toupper, _tzname, _tzset, _ui64toa, _ui64tow, _ultoa, _ultow, _umask, _ungetch, _unlink, _unloaddll, _unlock, _utime, _vsnprintf, _vsnwprintf, _waccess, _wasctime, _wchdir, _wchmod, _wcmdln, _wcreat, _wcsdup, _wcsicmp, _wcsicoll, _wcslwr, _wcsncoll, _wcsnicmp, _wcsnicoll, _wcsnset, _wcsrev, _wcsset, _wcsupr, _wctime, _wenviron, _wexecl, _wexecle, _wexeclp, _wexeclpe, _wexecv, _wexecve, _wexecvp, _wexecvpe, _wfdopen, _wfindfirst, _wfindfirsti64, _wfindnext, _wfindnexti64, _wfopen, _wfreopen, _wfsopen, _wfullpath, _wgetcwd, _wgetdcwd, _wgetenv, _winmajor, _winminor, _winver, _wmakepath, _wmkdir, _wmktemp, _wopen, _wperror, _wpgmptr, _wpopen, _wputenv, _wremove, _wrename, _write, _wrmdir, _wsearchenv, _wsetlocale, _wsopen, _wspawnl, _wspawnle, _wspawnlp, _wspawnlpe, _wspawnv, _wspawnve, _wspawnvp, _wspawnvpe, _wsplitpath, _wstat, _wstati64, _wstrdate, _wstrtime, _wsystem, _wtempnam, _wtmpnam, _wtoi, _wtoi64, _wtol, _wunlink, _wutime, _y0, _y1, _yn, abort, abs, acos, asctime, asin, atan, atan2, atexit, atof, atoi, atol, bsearch, calloc, ceil, clearerr, clock, cos, cosh, ctime, difftime, div, exit, exp, fabs, fclose, feof, ferror, fflush, fgetc, fgetpos, fgets, fgetwc, fgetws, floor, fmod, fopen, fprintf, fputc, fputs, fputwc, fputws, fread, free, freopen, frexp, fscanf, fseek, fsetpos, ftell, fwprintf, fwrite, fwscanf, getc, getchar, getenv, gets, getwc, getwchar, gmtime, is_wctype, isalnum, isalpha, iscntrl, isdigit, isgraph, isleadbyte, islower, isprint, ispunct, isspace, isupper, iswalnum, iswalpha, iswascii, iswcntrl, iswctype, iswdigit, iswgraph, iswlower, iswprint, iswpunct, iswspace, iswupper, iswxdigit, isxdigit, labs, ldexp, ldiv, localeconv, localtime, log, log10, longjmp, malloc, mblen, mbstowcs, mbtowc, memchr, memcmp, memcpy, memmove, memset, mktime, modf, perror, pow, printf, putc, putchar, puts, putwc, putwchar, qsort, raise, rand, realloc, remove, rename, rewind, scanf, setbuf, setlocale, setvbuf, signal, sin, sinh, sprintf, sqrt, srand, sscanf, strcat, strchr, strcmp, strcoll, strcpy, strcspn, strerror, strftime, strlen, strncat, strncmp, strncpy, strpbrk, strrchr, strspn, strstr, strtod, strtok, strtol, strtoul, strxfrm, swprintf, swscanf, system, tan, tanh, time, tmpfile, tmpnam, tolower, toupper, towlower, towupper, ungetc, ungetwc, vfprintf, vfwprintf, vprintf, vsprintf, vswprintf, vwprintf, wcscat, wcschr, wcscmp, wcscoll, wcscpy, wcscspn, wcsftime, wcslen, wcsncat, wcsncmp, wcsncpy, wcspbrk, wcsrchr, wcsspn, wcsstr, wcstod, wcstok, wcstol, wcstombs, wcstoul, wcsxfrm, wctomb, wprintf, wscanf

 

 

 

VT Community

 

0

This file has never been reviewed by any VT Community member. Be the first one to comment on it!

VirusTotal Team

Add your comment... Remember that when you write comments as an anonymous user they receive the lowest possible reputation. So if you have not signed in yet don't forget to do so. How to markup your comments?

 

You can add basic styles to your comments using the following accepted bbcode tags:

 

text -- bold

text -- italics

text -- underline

text -- strikethrough

text

-- preformatted text

 

You can also address comments to particular users using the "@" twitter-like mode. By prepending a "#" symbol to a word you can add custom tags to your comment, tags that can then be searched for.

 

Goodware Malware Spam attachment/link

P2P download Propagating via IM Network worm

Drive-by-download

 

 

 

Anonymous limit exceeded: anonymous users can only make one comment per file or URL, either sign in or register in order to continue making reviews on this item. Note that anonymous user discrimination is based on IP addresses, hence, it may be possible that another user behind your same proxy or NAT connection already made a review.

 

Preview commentEdit comment Post comment Posting comment...

Comment successfully posted

 

 

 

 

 

 

 

ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.

VirusTotal © Hispasec Sistemas - Blog - Twitter - Contact: [email protected] Terms of Service & Privacy Policy

Lenke til kommentar
ErikBlodøks

ErikBlodøks

Skrevet
  • Forfatter
Skrevet

temp.001

 

 

VT Community Sign in ▼ My account ▼ Sign out Signing out... Languages ▼

 

VirusTotal's website has changed, we need new translations, do you feel like helping the community?

[email protected]

Sign in to VT CommunitySafety ratings and user comments (disinfection, in-the-wild locations, reverse engineering reports, etc.) on malware and URLs, free and easy.

email

password

Keep me logged in

Sign in Signing in, please wait...

Login failed, please try again

Forgot your password? Create an account

 

Edit my profile

View my profile

Inbox

 

Virustotal is a service that analyzes suspicious files and URLs and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus engines. More information...

 

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware.

File name: temp.001

Submission date: 2011-01-26 10:42:41 (UTC)

Current status: queued (#88) queued (#88) analysing finished

 

 

Result: 0/ 43 (0.0%)

VT Community

 

not reviewed

Safety score: -

Compact Print results Antivirus Version Last Update Result

AhnLab-V3 2011.01.18.00 2011.01.17 -

AntiVir 7.11.1.247 2011.01.26 -

Antiy-AVL 2.0.3.7 2011.01.26 -

Avast 4.8.1351.0 2011.01.26 -

Avast5 5.0.677.0 2011.01.26 -

AVG 10.0.0.1190 2011.01.26 -

BitDefender 7.2 2011.01.26 -

CAT-QuickHeal 11.00 2011.01.25 -

ClamAV 0.96.4.0 2011.01.26 -

Commtouch 5.2.11.5 2011.01.26 -

Comodo 7507 2011.01.26 -

DrWeb 5.0.2.03300 2011.01.26 -

Emsisoft 5.1.0.1 2011.01.26 -

eSafe 7.0.17.0 2011.01.24 -

eTrust-Vet 36.1.8120 2011.01.26 -

F-Prot 4.6.2.117 2011.01.25 -

F-Secure 9.0.16160.0 2011.01.26 -

Fortinet 4.2.254.0 2011.01.26 -

GData 21 2011.01.26 -

Ikarus T3.1.1.97.0 2011.01.26 -

Jiangmin 13.0.900 2011.01.26 -

K7AntiVirus 9.78.3647 2011.01.25 -

Kaspersky 7.0.0.125 2011.01.26 -

McAfee 5.400.0.1158 2011.01.26 -

McAfee-GW-Edition 2010.1C 2011.01.26 -

Microsoft 1.6502 2011.01.26 -

NOD32 5820 2011.01.26 -

Norman 6.06.12 2011.01.26 -

nProtect 2011-01-18.01 2011.01.18 -

Panda 10.0.2.7 2011.01.25 -

PCTools 7.0.3.5 2011.01.26 -

Prevx 3.0 2011.01.26 -

Rising 23.42.02.03 2011.01.26 -

Sophos 4.61.0 2011.01.26 -

SUPERAntiSpyware 4.40.0.1006 2011.01.26 -

Symantec 20101.3.0.103 2011.01.26 -

TheHacker 6.7.0.1.120 2011.01.26 -

TrendMicro 9.120.0.1004 2011.01.26 -

TrendMicro-HouseCall 9.120.0.1004 2011.01.26 -

VBA32 3.12.14.3 2011.01.25 -

VIPRE 8200 2011.01.26 -

ViRobot 2011.1.26.4276 2011.01.26 -

VirusBuster 13.6.164.1 2011.01.25 -

Additional informationShow all

MD5 : 63da4613383ec70e047b4cd5c48f0b05

SHA1 : 578dd3ee844678c24c0831b6cc61a7dfae410bdc

SHA256: d4287ab5e4988dfe99bd54243d50dbe8744094f11fe5f9809a1a6fb9728c2124

ssdeep: 6144:sQ70n5legBB8h6GyoXwI7kohyRAeFMWiFaNF7R5LYrdKuOpO:sQ7k5lpBBi6e7kog/5Bbu

3

File size : 266293 bytes

First seen: 2009-02-21 05:19:37

Last seen : 2011-01-26 10:42:41

TrID:

Win32 EXE PECompact compressed (generic) (41.8%)

Win32 Executable MS Visual C++ (generic) (37.9%)

Win32 Executable Generic (8.5%)

Win32 Dynamic Link Library (generic) (7.6%)

Generic Win/DOS Executable (2.0%)

sigcheck:

publisher....: Microsoft Corporation

copyright....: Copyright © Microsoft Corp. 1981-1998

product......: Microsoft ® Visual C__

description..: Microsoft ® C Runtime Library

original name: MSVCRT.DLL

internal name: MSVCRT.DLL

file version.: 6.00.8337.0

comments.....: n/a

signers......: -

signing date.: -

verified.....: Unsigned

 

PEInfo: PE structure information

 

[[ basic data ]]

entrypointaddress: 0x3428

timedatestamp....: 0x366734DA (Fri Dec 04 01:03:22 1998)

machinetype......: 0x14c (I386)

 

[[ 5 section(s) ]]

name, viradd, virsiz, rawdsiz, ntropy, md5

.text, 0x1000, 0x2C415, 0x2D000, 6.68, 4949d1cdc76cb7422dc0206742f03d59

.rdata, 0x2E000, 0x6D92, 0x7000, 5.75, 9fa53bdbc12bb9693798d257aab0a50b

.data, 0x35000, 0x6750, 0x7000, 2.33, 67e008d538dc22542eb1226f0a3ce884

.rsrc, 0x3C000, 0x3A8, 0x1000, 1.00, a239c59b858ac54dba3378330481eab6

.reloc, 0x3D000, 0x22CC, 0x3000, 5.63, 97b39ad4aa3e98ecf71f284097c989a1

 

[[ 1 import(s) ]]

KERNEL32.dll: SetFilePointer, RtlUnwind, IsBadReadPtr, IsBadWritePtr, IsBadCodePtr, SetUnhandledExceptionFilter, GetModuleFileNameA, GetModuleFileNameW, ExitProcess, TerminateProcess, GetCurrentProcess, WriteFile, GetStdHandle, GetCommandLineA, GetVersion, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetLastError, ResumeThread, CreateThread, TlsSetValue, ExitThread, CloseHandle, GetCurrentThreadId, TlsAlloc, TlsFree, SetLastError, TlsGetValue, GetCurrentThread, FindNextFileA, FindFirstFileA, FindClose, FindNextFileW, FindFirstFileW, HeapFree, HeapAlloc, GetModuleHandleA, GetEnvironmentVariableA, GetVersionExA, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, HeapReAlloc, SetHandleCount, GetFileType, GetStartupInfoA, GetCPInfo, GetACP, GetOEMCP, GetProcAddress, LoadLibraryA, MultiByteToWideChar, GetCommandLineW, FreeEnvironmentStringsA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStrings, GetEnvironmentStringsW, UnhandledExceptionFilter, GetStringTypeA, GetStringTypeW, LCMapStringA, LCMapStringW, SetConsoleCtrlHandler, SetEnvironmentVariableW, InterlockedDecrement, InterlockedIncrement, FlushFileBuffers, RaiseException, SetStdHandle, Sleep, CompareStringA, CompareStringW, IsValidLocale, IsValidCodePage, GetLocaleInfoA, EnumSystemLocalesA, GetUserDefaultLCID, GetLocaleInfoW, GetTimeZoneInformation, SetEnvironmentVariableA, Beep, FileTimeToSystemTime, FileTimeToLocalFileTime, GetDiskFreeSpaceA, GetLogicalDrives, SetErrorMode, GetFileAttributesA, GetCurrentDirectoryA, SetCurrentDirectoryA, SetFileAttributesA, GetFullPathNameA, GetDriveTypeA, GetCurrentProcessId, CreateDirectoryA, RemoveDirectoryA, DeleteFileA, GetFileAttributesW, GetCurrentDirectoryW, SetCurrentDirectoryW, SetFileAttributesW, GetFullPathNameW, CreateDirectoryW, DeleteFileW, MoveFileW, RemoveDirectoryW, GetDriveTypeW, MoveFileA, GetExitCodeProcess, WaitForSingleObject, FreeLibrary, CreateProcessA, CreateProcessW, HeapValidate, HeapCompact, HeapWalk, HeapSize, ReadConsoleA, SetConsoleMode, GetConsoleMode, SetEndOfFile, WriteConsoleA, DuplicateHandle, GetFileInformationByHandle, PeekNamedPipe, ReadConsoleInputA, PeekConsoleInputA, GetNumberOfConsoleInputEvents, LockFile, UnlockFile, CreateFileA, CreatePipe, ReadFile, CreateFileW, GetSystemTimeAsFileTime, SetFileTime, LocalFileTimeToFileTime, SystemTimeToFileTime, GetLocalTime, SetLocalTime, GetSystemTime

 

[[ 759 export(s) ]]

$I10_OUTPUT, __0__non_rtti_object@@QAE@ABV0@@Z, __0__non_rtti_object@@QAE@PBD@Z, __0bad_cast@@QAE@ABQBD@Z, __0bad_cast@@QAE@ABV0@@Z, __0bad_typeid@@QAE@ABV0@@Z, __0bad_typeid@@QAE@PBD@Z, __0exception@@QAE@ABQBD@Z, __0exception@@QAE@ABV0@@Z, __0exception@@QAE@XZ, __1__non_rtti_object@@UAE@XZ, __1bad_cast@@UAE@XZ, __1bad_typeid@@UAE@XZ, __1exception@@UAE@XZ, __1type_info@@UAE@XZ, __2@YAPAXI@Z, __3@YAXPAX@Z, __4__non_rtti_object@@QAEAAV0@ABV0@@Z, __4bad_cast@@QAEAAV0@ABV0@@Z, __4bad_typeid@@QAEAAV0@ABV0@@Z, __4exception@@QAEAAV0@ABV0@@Z, __8type_info@@QBEHABV0@@Z, __9type_info@@QBEHABV0@@Z, ___7__non_rtti_object@@6B@, ___7bad_cast@@6B@, ___7bad_typeid@@6B@, ___7exception@@6B@, ___E__non_rtti_object@@UAEPAXI@Z, ___Ebad_cast@@UAEPAXI@Z, ___Ebad_typeid@@UAEPAXI@Z, ___Eexception@@UAEPAXI@Z, ___G__non_rtti_object@@UAEPAXI@Z, ___Gbad_cast@@UAEPAXI@Z, ___Gbad_typeid@@UAEPAXI@Z, ___Gexception@@UAEPAXI@Z, __query_new_handler@@YAP6AHI@ZXZ, __query_new_mode@@YAHXZ, __set_new_handler@@YAP6AHI@ZP6AHI@Z@Z, __set_new_mode@@YAHH@Z, __set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z, _before@type_info@@QBEHABV1@@Z, _name@type_info@@QBEPBDXZ, _raw_name@type_info@@QBEPBDXZ, _set_new_handler@@YAP6AXXZP6AXXZ@Z, _set_terminate@@YAP6AXXZP6AXXZ@Z, _set_unexpected@@YAP6AXXZP6AXXZ@Z, _terminate@@YAXXZ, _unexpected@@YAXXZ, _what@exception@@UBEPBDXZ, _CIacos, _CIasin, _CIatan, _CIatan2, _CIcos, _CIcosh, _CIexp, _CIfmod, _CIlog, _CIlog10, _CIpow, _CIsin, _CIsinh, _CIsqrt, _CItan, _CItanh, _CxxThrowException, _EH_prolog, _Getdays, _Getmonths, _Gettnames, _HUGE, _Strftime, _XcptFilter, __CxxFrameHandler, __CxxLongjmpUnwind, __RTCastToVoid, __RTDynamicCast, __RTtypeid, __STRINGTOLD, __argc, __argv, __badioinfo, __crtCompareStringA, __crtGetLocaleInfoW, __crtLCMapStringA, __dllonexit, __doserrno, __fpecode, __getmainargs, __initenv, __isascii, __iscsym, __iscsymf, __lc_codepage, __lc_collate_cp, __lc_handle, __lconv_init, __mb_cur_max, __p___argc, __p___argv, __p___initenv, __p___mb_cur_max, __p___wargv, __p___winitenv, __p__acmdln, __p__amblksiz, __p__commode, __p__daylight, __p__dstbias, __p__environ, __p__fileinfo, __p__fmode, __p__iob, __p__mbcasemap, __p__mbctype, __p__osver, __p__pctype, __p__pgmptr, __p__pwctype, __p__timezone, __p__tzname, __p__wcmdln, __p__wenviron, __p__winmajor, __p__winminor, __p__winver, __p__wpgmptr, __pioinfo, __pxcptinfoptrs, __set_app_type, __setlc_active, __setusermatherr, __threadhandle, __threadid, __toascii, __unDName, __unDNameEx, __unguarded_readlc_active, __wargv, __wgetmainargs, __winitenv, _abnormal_termination, _access, _acmdln, _adj_fdiv_m16i, _adj_fdiv_m32, _adj_fdiv_m32i, _adj_fdiv_m64, _adj_fdiv_r, _adj_fdivr_m16i, _adj_fdivr_m32, _adj_fdivr_m32i, _adj_fdivr_m64, _adj_fpatan, _adj_fprem, _adj_fprem1, _adj_fptan, _adjust_fdiv, _aexit_rtn, _amsg_exit, _assert, _atodbl, _atoi64, _atoldbl, _beep, _beginthread, _beginthreadex, _c_exit, _cabs, _callnewh, _cexit, _cgets, _chdir, _chdrive, _chgsign, _chkesp, _chmod, _chsize, _clearfp, _close, _commit, _commode, _control87, _controlfp, _copysign, _cprintf, _cputs, _creat, _cscanf, _ctype, _cwait, _daylight, _dstbias, _dup, _dup2, _ecvt, _endthread, _endthreadex, _environ, _eof, _errno, _except_handler2, _except_handler3, _execl, _execle, _execlp, _execlpe, _execv, _execve, _execvp, _execvpe, _exit, _expand, _fcloseall, _fcvt, _fdopen, _fgetchar, _fgetwchar, _filbuf, _fileinfo, _filelength, _filelengthi64, _fileno, _findclose, _findfirst, _findfirsti64, _findnext, _findnexti64, _finite, _flsbuf, _flushall, _fmode, _fpclass, _fpieee_flt, _fpreset, _fputchar, _fputwchar, _fsopen, _fstat, _fstati64, _ftime, _ftol, _fullpath, _futime, _gcvt, _get_osfhandle, _get_sbh_threshold, _getch, _getche, _getcwd, _getdcwd, _getdiskfree, _getdllprocaddr, _getdrive, _getdrives, _getmaxstdio, _getmbcp, _getpid, _getsystime, _getw, _getws, _global_unwind2, _heapadd, _heapchk, _heapmin, _heapset, _heapused, _heapwalk, _hypot, _i64toa, _i64tow, _initterm, _inp, _inpd, _inpw, _iob, _isatty, _isctype, _ismbbalnum, _ismbbalpha, _ismbbgraph, _ismbbkalnum, _ismbbkana, _ismbbkprint, _ismbbkpunct, _ismbblead, _ismbbprint, _ismbbpunct, _ismbbtrail, _ismbcalnum, _ismbcalpha, _ismbcdigit, _ismbcgraph, _ismbchira, _ismbckata, _ismbcl0, _ismbcl1, _ismbcl2, _ismbclegal, _ismbclower, _ismbcprint, _ismbcpunct, _ismbcspace, _ismbcsymbol, _ismbcupper, _ismbslead, _ismbstrail, _isnan, _itoa, _itow, _j0, _j1, _jn, _kbhit, _lfind, _loaddll, _local_unwind2, _lock, _locking, _logb, _longjmpex, _lrotl, _lrotr, _lsearch, _lseek, _lseeki64, _ltoa, _ltow, _makepath, _mbbtombc, _mbbtype, _mbcasemap, _mbccpy, _mbcjistojms, _mbcjmstojis, _mbclen, _mbctohira, _mbctokata, _mbctolower, _mbctombb, _mbctoupper, _mbctype, _mbsbtype, _mbscat, _mbschr, _mbscmp, _mbscoll, _mbscpy, _mbscspn, _mbsdec, _mbsdup, _mbsicmp, _mbsicoll, _mbsinc, _mbslen, _mbslwr, _mbsnbcat, _mbsnbcmp, _mbsnbcnt, _mbsnbcoll, _mbsnbcpy, _mbsnbicmp, _mbsnbicoll, _mbsnbset, _mbsncat, _mbsnccnt, _mbsncmp, _mbsncoll, _mbsncpy, _mbsnextc, _mbsnicmp, _mbsnicoll, _mbsninc, _mbsnset, _mbspbrk, _mbsrchr, _mbsrev, _mbsset, _mbsspn, _mbsspnp, _mbsstr, _mbstok, _mbstrlen, _mbsupr, _memccpy, _memicmp, _mkdir, _mktemp, _msize, _nextafter, _onexit, _open, _open_osfhandle, _osver, _outp, _outpd, _outpw, _pclose, _pctype, _pgmptr, _pipe, _popen, _purecall, _putch, _putenv, _putw, _putws, _pwctype, _read, _rmdir, _rmtmp, _rotl, _rotr, _safe_fdiv, _safe_fdivr, _safe_fprem, _safe_fprem1, _scalb, _searchenv, _seh_longjmp_unwind, _set_error_mode, _set_sbh_threshold, _seterrormode, _setjmp, _setjmp3, _setmaxstdio, _setmbcp, _setmode, _setsystime, _sleep, _snprintf, _snwprintf, _sopen, _spawnl, _spawnle, _spawnlp, _spawnlpe, _spawnv, _spawnve, _spawnvp, _spawnvpe, _splitpath, _stat, _stati64, _statusfp, _strcmpi, _strdate, _strdup, _strerror, _stricmp, _stricoll, _strlwr, _strncoll, _strnicmp, _strnicoll, _strnset, _strrev, _strset, _strtime, _strupr, _swab, _sys_errlist, _sys_nerr, _tell, _telli64, _tempnam, _timezone, _tolower, _toupper, _tzname, _tzset, _ui64toa, _ui64tow, _ultoa, _ultow, _umask, _ungetch, _unlink, _unloaddll, _unlock, _utime, _vsnprintf, _vsnwprintf, _waccess, _wasctime, _wchdir, _wchmod, _wcmdln, _wcreat, _wcsdup, _wcsicmp, _wcsicoll, _wcslwr, _wcsncoll, _wcsnicmp, _wcsnicoll, _wcsnset, _wcsrev, _wcsset, _wcsupr, _wctime, _wenviron, _wexecl, _wexecle, _wexeclp, _wexeclpe, _wexecv, _wexecve, _wexecvp, _wexecvpe, _wfdopen, _wfindfirst, _wfindfirsti64, _wfindnext, _wfindnexti64, _wfopen, _wfreopen, _wfsopen, _wfullpath, _wgetcwd, _wgetdcwd, _wgetenv, _winmajor, _winminor, _winver, _wmakepath, _wmkdir, _wmktemp, _wopen, _wperror, _wpgmptr, _wpopen, _wputenv, _wremove, _wrename, _write, _wrmdir, _wsearchenv, _wsetlocale, _wsopen, _wspawnl, _wspawnle, _wspawnlp, _wspawnlpe, _wspawnv, _wspawnve, _wspawnvp, _wspawnvpe, _wsplitpath, _wstat, _wstati64, _wstrdate, _wstrtime, _wsystem, _wtempnam, _wtmpnam, _wtoi, _wtoi64, _wtol, _wunlink, _wutime, _y0, _y1, _yn, abort, abs, acos, asctime, asin, atan, atan2, atexit, atof, atoi, atol, bsearch, calloc, ceil, clearerr, clock, cos, cosh, ctime, difftime, div, exit, exp, fabs, fclose, feof, ferror, fflush, fgetc, fgetpos, fgets, fgetwc, fgetws, floor, fmod, fopen, fprintf, fputc, fputs, fputwc, fputws, fread, free, freopen, frexp, fscanf, fseek, fsetpos, ftell, fwprintf, fwrite, fwscanf, getc, getchar, getenv, gets, getwc, getwchar, gmtime, is_wctype, isalnum, isalpha, iscntrl, isdigit, isgraph, isleadbyte, islower, isprint, ispunct, isspace, isupper, iswalnum, iswalpha, iswascii, iswcntrl, iswctype, iswdigit, iswgraph, iswlower, iswprint, iswpunct, iswspace, iswupper, iswxdigit, isxdigit, labs, ldexp, ldiv, localeconv, localtime, log, log10, longjmp, malloc, mblen, mbstowcs, mbtowc, memchr, memcmp, memcpy, memmove, memset, mktime, modf, perror, pow, printf, putc, putchar, puts, putwc, putwchar, qsort, raise, rand, realloc, remove, rename, rewind, scanf, setbuf, setlocale, setvbuf, signal, sin, sinh, sprintf, sqrt, srand, sscanf, strcat, strchr, strcmp, strcoll, strcpy, strcspn, strerror, strftime, strlen, strncat, strncmp, strncpy, strpbrk, strrchr, strspn, strstr, strtod, strtok, strtol, strtoul, strxfrm, swprintf, swscanf, system, tan, tanh, time, tmpfile, tmpnam, tolower, toupper, towlower, towupper, ungetc, ungetwc, vfprintf, vfwprintf, vprintf, vsprintf, vswprintf, vwprintf, wcscat, wcschr, wcscmp, wcscoll, wcscpy, wcscspn, wcsftime, wcslen, wcsncat, wcsncmp, wcsncpy, wcspbrk, wcsrchr, wcsspn, wcsstr, wcstod, wcstok, wcstol, wcstombs, wcstoul, wcsxfrm, wctomb, wprintf, wscanf

 

 

 

VT Community

 

0

This file has never been reviewed by any VT Community member. Be the first one to comment on it!

VirusTotal Team

Add your comment... Remember that when you write comments as an anonymous user they receive the lowest possible reputation. So if you have not signed in yet don't forget to do so. How to markup your comments?

 

You can add basic styles to your comments using the following accepted bbcode tags:

 

text -- bold

text -- italics

text -- underline

text -- strikethrough

text

-- preformatted text

 

You can also address comments to particular users using the "@" twitter-like mode. By prepending a "#" symbol to a word you can add custom tags to your comment, tags that can then be searched for.

 

Goodware Malware Spam attachment/link

P2P download Propagating via IM Network worm

Drive-by-download

 

 

 

Anonymous limit exceeded: anonymous users can only make one comment per file or URL, either sign in or register in order to continue making reviews on this item. Note that anonymous user discrimination is based on IP addresses, hence, it may be possible that another user behind your same proxy or NAT connection already made a review.

 

Preview commentEdit comment Post comment Posting comment...

Comment successfully posted

 

 

 

 

 

 

 

ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are no guarantees about the availability and continuity of this service. Although the detection rate afforded by the use of multiple antivirus engines is far superior to that offered by just one product, these results DO NOT guarantee the harmlessness of a file. Currently, there is not any solution that offers a 100% effectiveness rate for detecting viruses and malware.

VirusTotal © Hispasec Sistemas - Blog - Twitter - Contact: [email protected] Terms of Service & Privacy Policy

 

Har glemt å si at jeg avinstallerte Mcafee antivirus programmet. Comodo beholder jeg.

Lenke til kommentar
r2d290

r2d290

Skrevet
Skrevet

Ser ut til at disse filene kan bli. Jeg ser du har avinnstallert McAfee, så da kommer jeg til å slette eventuelle rester senere.

 

Merker du ingen forbedring siden før du begynte? Synes det er snodig, ettersom MBAM fjernet såpass mye, og ComboFix-loggen ser ut til å være ren. Begynne litt på nytt, ettersom noen av filene som MBAM fjernet, kan ha kommet tilbake.

 

Altså: Først MBAM (gjør så godt du kan for å få postet loggen. Tar ikke så veldig lang tid å trykke Ctrl+A (select all) og så Ctrl+C (copy). Eventuelt prøv å få lagret den nye MBAM-loggen til Skrivebordet.

 

Videre, ny ComboFix

 

Til slutt ønsker jeg å se en HijackThis-logg:

 

Gjør følgende:

Last ned 'HijackThis'.

Lagre den i en permanent mappe, f.eks i C:\HJT\, dobbelklikk på HijackThis.exe, og trykk Do a system scan and save a logfile.

 

Når Notisblokk-vinduet åpnes, trykker du Ctrl-A for å markere hele teksten, kopierer det Ctrl-C og limer det inn i din neste post på forumet Ctrl-V. Mesteparten av innholdet i lista er trygt. Ikke fiks noe enda.

Du vil da få en logg tilsvarende den i spoiler nedenfor:

 

 

Logfile of HijackThis v1.99.1

Scan saved at 17:06:11, on 08.09.2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Sygate\SPF\smc.exe

C:\WINDOWS\system32\spoolsv.exe

c:\programfiler\fellesfiler\logitech\lvmvfm\LVPrcSrv.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\LVCOMSX.EXE

C:\Programfiler\Logitech\Video\CameraAssistant.exe

C:\WINDOWS\system32\ElkCtrl.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Programfiler\Java\jre1.5.0_07\bin\jusched.exe

C:\Programfiler\Ahead\InCD\InCD.exe

C:\Programfiler\MSN Messenger\MsnMsgr.Exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Kenneth\Skrivebord\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://stealthy.foolishgames.net/news.php

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.5.0_07\bin\ssv.dll

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE

O4 - HKLM\..\Run: [LogitechCameraAssistant] C:\Programfiler\Logitech\Video\CameraAssistant.exe

O4 - HKLM\..\Run: [LogitechVideo[inspector]] C:\Programfiler\Logitech\Video\InstallHelper.exe /inspect

O4 - HKLM\..\Run: [LogitechCameraService(E)] C:\WINDOWS\system32\ElkCtrl.exe /automation

O4 - HKLM\..\Run: [smcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui

O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Programfiler\RivaTuner v2.0 RC 16\RivaTuner.exe" /S

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background

O8 - Extra context menu item: Write a Review... - http://client.alexa.com/holiday/script/actions/review.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\System32\shdocvw.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\programfiler\fellesfiler\logitech\lvmvfm\LVPrcSrv.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Programfiler\Sygate\SPF\smc.exe[/code]

 

 

 

 

Post ComboFix, MBAM, og HijackThis-logg, samt gi tilbakemelding på om noe har forandret seg i positiv eller negativ retning.

Lenke til kommentar
ErikBlodøks

ErikBlodøks

Skrevet
  • Forfatter
Skrevet

Trykker jeg crntl + a, osv.. så forsvinner hele greia. Men til opplysning så fant den ikke noe denne gangen. jeg skal prøve å finne ut hvor filene lagrer seg. slik jeg bare kan laste filen opp.

 

For å svare på om jeg har merket noe endringer: Ja jeg gjorde det rett etter at Malware programmet fjernet ca 44 inf. filer. Men det er fremdeles noe igjen, som f.eks:

 

Trykker jeg på f.eks "min datamaskin" eller en eller annen mappe/fil så får jeg et vindu om jeg har lyst til å legge mappe/fil i papirkurven. Jeg kan sitte å trykke i evigheter "nei/avbryt", men så popper det opp nye.

 

Av og til kan jeg ikke scrolle ned på nettsiden, den bare "drar" seg tilbake på opprinnelige plass. Så når jeg skal trykke "post innlegg" her på forumet, så sliter jeg. da gjelder det å ha Lucky Luke reflekser ;) Skal jeg f.eks: Redigere innlegget mitt her, så begynner den straks å viske ut det som stod fra før av.

 

Ved oppstart av datamaskinen så spør den alltid om jeg vil starte opp "windows 7", "trykk enter etter 25 sekunder". Etter det er gjort, så begynner den å pipe med korte intervaller i ca. 13 sekunder. Dette skjer når man ser Windows symbolet og de fargene som svirrer rundt om kring som til slutt danner et windows ikon ( tror jeg, husker ikke).

Ca. hver annen gang jeg starter opp maskinen så funker ikke det trådløse nettverket som det skal plutselig. Jeg har signal, men ikke internett får jeg feilmelding om. Rebooter jeg, så er det ikke et problem lenger.

 

Ellers kan jeg jo si at rett etter jeg har skrevet en adresse i søkebaren på nettleseren, så starter den å visker ut det som står der.

 

Skal prøve hijackthis programmet.

ComboFix.txt

Lenke til kommentar

Opprett en konto eller logg inn for å kommentere

Du må være et medlem for å kunne skrive en kommentar

Opprett konto

Det er enkelt å melde seg inn for å starte en ny konto!

Start en konto

Logg inn

Har du allerede en konto? Logg inn her.

Logg inn nå
Gå til emneliste

  • Hvem er aktive   0 medlemmer

    • Ingen innloggede medlemmer aktive
×
×
  • Opprett ny...