Hjelp til fjerning av virus/browser hijacker

madammim · 12. desember 2012

Hei.

Har en eldre XP-maskin som ser ut til å ha blitt infisert av en browser hijacker. Har google søk som startside, og når jeg bruker denne til å søke med så finner den sidene/linkene, men alle disse linkene vil sende meg til ei helt annen side. Ofte er det ihavenet.com, men det er også andre.

Når jeg søker på "remove ihavenet.com" så ser det ut til å være et kjent virus. Jeg finner flere oppskrifter for å fjerne dette, men alle fordrer at "random.exe" kjører, noe den ikke gjør på min maskin.

Dette gjelder både IE, FF og Chrome. Kjører MSE, men den ser ut til å ha blitt disablet.

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 08:51:27, on 12.12.2012

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\rundll32.exe

C:\Programfiler\IVT Corporation\BlueSoleil\BTNtService.exe

C:\Programfiler\D-Link\DWA-140 revB\ANIWZCSdS.exe

C:\Programfiler\D-Link\DWA-140 revB\ANIWConnService.exe

C:\Programfiler\Java\jre6\bin\jqs.exe

C:\Programfiler\Spybot - Search & Destroy 2\SDFSSvc.exe

C:\WINDOWS\system32\slserv.exe

C:\WINDOWS\system32\svchost.exe

C:\Programfiler\Spybot - Search & Destroy 2\SDUpdSvc.exe

C:\Programfiler\Spybot - Search & Destroy 2\SDUpdate.exe

C:\WINDOWS\system32\Rundll32.exe

C:\Programfiler\Notebook Hardware Control\nhc.exe

C:\Programfiler\Fellesfiler\Java\Java Update\jusched.exe

C:\Programfiler\Spybot - Search & Destroy 2\SDTray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\VoipDiscount.com\VoipDiscount\VoipDiscount.exe

C:\Programfiler\Messenger\msmsgs.exe

C:\Programfiler\IVT Corporation\BlueSoleil\BlueSoleil.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\OpenOffice.org 3\program\soffice.exe

C:\Programfiler\OpenOffice.org 3\program\soffice.bin

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\Programfiler\Mozilla Firefox\firefox.exe

C:\Programfiler\Mozilla Firefox\plugin-container.exe

C:\Documents and Settings\stua\Mine dokumenter\Nedlastinger\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.no/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programfiler\Spybot - Search & Destroy 2\SDHelper.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre6\bin\ssv.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programfiler\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programfiler\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: SimpleAdblock Class - {FFCB3198-32F3-4E8B-9539-4324694ED664} - C:\Programfiler\Fellesfiler\Simple Adblock\SimpleAdblock.dll

O4 - HKLM\..\Run: [siSPower] Rundll32.exe SiSPower.dll,ModeAgent

O4 - HKLM\..\Run: [NotebookHardwareControl] "C:\Programfiler\Notebook Hardware Control\nhc.exe" -quiet

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Programfiler\Fellesfiler\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [MSC] "c:\Programfiler\Microsoft Security Client\msseces.exe" -hide -runkey

O4 - HKLM\..\Run: [ControlCenter2.0] C:\Programfiler\Brother\ControlCenter2\brctrcen.exe /autorun

O4 - HKLM\..\Run: [sDTray] "C:\Programfiler\Spybot - Search & Destroy 2\SDTray.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [VoipDiscount] "C:\Programfiler\VoipDiscount.com\VoipDiscount\VoipDiscount.exe" -nosplash -minimized

O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\stua\Lokale innstillinger\Programdata\Google\Update\GoogleUpdate.exe" /c

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: OpenOffice.org 3.3.lnk = C:\Programfiler\OpenOffice.org 3\program\quickstart.exe

O4 - Global Startup: BlueSoleil.lnk = C:\Programfiler\IVT Corporation\BlueSoleil\BlueSoleil.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programfiler\Spybot - Search & Destroy 2\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programfiler\Spybot - Search & Destroy 2\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1310829115828

O17 - HKLM\System\CCS\Services\Tcpip\..\{AC3EB6CC-0AF0-4501-B731-3BCD50A161A3}: NameServer = 192.168.50.57

O17 - HKLM\System\CCS\Services\Tcpip\..\{B9E862DA-9AA7-4DD9-9FAF-CD413917D155}: NameServer = 192.168.1.100

O20 - Winlogon Notify: SDWinLogon - SDWinLogon.dll (file missing)

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe

O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programfiler\IVT Corporation\BlueSoleil\BTNtService.exe

O23 - Service: D-Link Wireless N DWA-140 Service (D-Link Wireless N DWA-140) - Wireless Service - C:\Programfiler\D-Link\DWA-140 revB\ANIWZCSdS.exe

O23 - Service: D-Link Wireless N DWA-140_WPS Service (D-Link Wireless N DWA-140_WPS) - Unknown owner - C:\Programfiler\D-Link\DWA-140 revB\ANIWConnService.exe

O23 - Service: Google-oppdatering-tjenesten (gupdate) (gupdate) - Google Inc. - C:\Programfiler\Google\Update\GoogleUpdate.exe

O23 - Service: Google-oppdatering-tjenesten (gupdatem) (gupdatem) - Google Inc. - C:\Programfiler\Google\Update\GoogleUpdate.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programfiler\Java\jre6\bin\jqs.exe

O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Programfiler\Mozilla Maintenance Service\maintenanceservice.exe

O23 - Service: Spybot-S&D 2 Scanner Service (SDScannerService) - Safer-Networking Ltd. - C:\Programfiler\Spybot - Search & Destroy 2\SDFSSvc.exe

O23 - Service: Spybot-S&D 2 Updating Service (SDUpdateService) - Safer-Networking Ltd. - C:\Programfiler\Spybot - Search & Destroy 2\SDUpdSvc.exe

O23 - Service: Spybot-S&D 2 Security Center Service (SDWSCService) - Safer-Networking Ltd. - C:\Programfiler\Spybot - Search & Destroy 2\SDWSCSvc.exe

O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

--

End of file - 7768 bytes

Dr.Geek · 12. desember 2012

Hai,

kjør scan med disse scannene og slett alle funn og post loggene:

http://www.malwarebytes.org/products/malwarebytes_free/ (free) Fullscan

http://support.kaspersky.com/5350

madammim · 12. desember 2012

Takk for at du tar deg tid

Ingen av disse ser ut til å finne noe som helst. Kjørte Spyboot 2 i går kveld, og den fant masse. Selv etter 3 runder fant den ting, så antok at den ikke fikk fjernet alt den fant...

Malewarebyte:

Malwarebytes Anti-Malware (Prøveversjon) 1.65.1.1000

www.malwarebytes.org

Databaseversjon: v2012.12.12.08

Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

stua :: STUEPC-5D140CB6 [administrator]

Beskyttelse: Aktivert

12.12.2012 17:51:32

mbam-log-2012-12-12 (17-51-32).txt

Skanntype: Full skann (C:\|E:\|)

Deaktiverte skanninnstillinger: P2P

Objekter skannet: 264912

Tid tilbakelagt: 27 minutt(er), 2 sekund(er)

Minneprosesser oppdaget: 0