spyware og "registry change"?

[kayli]

Maskinen fungerer ikke som den skal, den er treg og "skurrer" når jeg skal inn på ett eller annet. Har Norton Internet S., Ad-Aware, Spybot, Spywareblaster, The Cleaner. Spybot kommer med advarsel om at den har funnet en viktig registryentry som er forandret. For å være helt ærlig skjønner jeg ingenting av dette? Merker av for "deny change". Vet ikke hva jeg skal gjøre med det. Scanner med Ad-Aware hver dag og hver dag er det "critical objects". Blir liksom aldri kvitt det.

Åssen legger jeg ved kopi av alle prosesser som kjøres?

Takknemlig for svar

[akh]

Ta et bilde av skjermen din når du har oppgavebehandling oppe. (bruk printscreen-knappen f.eks og lim det inn i et bildebehandlingsprogram)

Andre tips for å fikse på slikt: kjør hijackthis og post loggen den lager her. Hvilken nettleser bruker du? Hvis IE: skift til Opera eller Firefox.

Siden spybot varsler om endringer, finner den noe når du kjører den?

[kayli]

jeg bruker internet explorer. Ja spybot finner noe som jeg sletter. Noe som kommer opp hele tiden er dsoexploit. Tror det var det det hette.

Her er ett eksemplel på denne registry change:

HKEY=HKEY_CURRENT_USER

PATH=Software\Microsoft\Windows\Current Version\Run

NAME=phonerdr.

DATA=C:\Docume~1\Robin\PROGRA~1\tchdeaf\tray keep.exe

 

Sier dette noe?

J

[akh]

DSO Exploit

Når det gjelder den andre: ikke noe kjent navn, nei. Den mappen den ligger i (C:\Docume~1\Robin\PROGRA~1\tchdeaf) er det en mappe du har opprettet til et eller annet program? Jeg mistenker at det kan være en trojaner eller lignende. Har du kjørt et virussøk?

[kayli]

Ja, kjørt virussøk flere ganger daglig. Har sittet i hele dag. Dette er ikke min maskin. Det er min sønns, men har full tilgang

Jeg har kjørt hijackthis. Her er listen.

Logfile of HijackThis v1.99.0

Scan saved at 16:40:04, on 18.12.2004

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccProxy.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

C:\Programfiler\Norton Internet Security\ISSVC.exe

C:\Programfiler\Fellesfiler\Symantec Shared\SNDSrvc.exe

C:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Programfiler\Java\j2re1.4.2_05\bin\jusched.exe

C:\Programfiler\NVIDIA Corporation\NvMixer\NvMixerTray.exe

C:\DOWNLOADS\Winamp\winampa.exe

C:\Programfiler\QuickTime\qttask.exe

C:\Programfiler\iTunes\iTunesHelper.exe

C:\Programfiler\MSN Apps\Updater\01.02.3000.1001\no\msnappau.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe

C:\Programfiler\Internet Explorer\iexplore.exe

C:\Programfiler\The Cleaner\tca.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\Messenger\msmsgs.exe

C:\Programfiler\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe

c:\progra~1\intern~1\iexplore.exe

C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE

C:\WINDOWS\System32\CTSvcCDA.EXE

C:\Programfiler\Norton Internet Security\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\Programfiler\iPod\bin\iPodService.exe

C:\Programfiler\Fellesfiler\Microsoft Shared\Works Shared\wkcalrem.exe

C:\Documents and Settings\Robin\Skrivebord\Mine mottatte filer\regprot\regprot.exe

C:\Documents and Settings\Robin\Skrivebord\Mine mottatte filer\regprot\regprot.exe

C:\Programfiler\Internet Explorer\iexplore.exe

C:\DOCUME~1\Robin\LOKALE~1\Temp\Midlertidig mappe 1 for hijackthis.zip\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.vhunmitujdslcgru.info/ehOSt5jgS...Srj9BAYh3K.html

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.no/Default.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programfiler\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programfiler\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll (file missing)

O2 - BHO: (no name) - {9EAA69AF-CA16-2D36-E04E-ED15600A575C} - (no file)

O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll

O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\MSN Apps\MSN Toolbar\01.02.3000.1001\no\msntb.dll (file missing)

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O2 - BHO: (no name) - {C5699C09-57C8-296E-B677-F6F3A4DFCF90} - C:\DOCUME~1\Robin\PROGRA~1\SOFTRE~1\Stupid Does.exe (file missing)

O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)

O4 - HKLM\..\Run: [tcactive] C:\Programfiler\The Cleaner\tca.exe

O4 - HKLM\..\Run: [tcmonitor] C:\Programfiler\The Cleaner\tcm.exe

O4 - Global Startup: gwum.lnk = C:\Programfiler\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\j2re1.4.2_05\bin\npjpi142_05.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\j2re1.4.2_05\bin\npjpi142_05.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Programfiler\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: RaptisoftGameLoader - http://www.miniclip.com/hamsterball/raptisoftgameloader.cab

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab30149.cab

O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab30149.cab

O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/LSSupCtl.cab

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab30149.cab

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cab

O16 - DPF: {5D9E4B6D-CD17-4D85-99D4-6A52B394EC3B} (WSDownloader Control) - http://www.webshots.com/samplers/WSDownloader.ocx

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {70BA88C8-DAE8-4CE9-92BB-979C4A75F53B} (GSDACtl Class) - https://www.gamespyid.com/alaunch.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab30149.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab30149.cab

O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/SymAData.cab

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/zuma/default/popcaploader_v6.cab

O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} - http://fdl.msn.com/zone/datafiles/heartbeat.cab

O16 - DPF: {E6187999-9FEC-46A1-A20F-F4CA977D5643} (ZoneChess Object) - http://messenger.zone.msn.com/binary/Chess.cab30149.cab

O16 - DPF: {EDAF796E-9210-4417-ADDC-2AB18E4F6C27} (Hjemmeside.KvikFoto) - http://www.123hjemmeside.dk/builder/pages/KvikFoto.CAB

O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab30149.cab

O23 - Service: Ati HotKey Poller - Unknown - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE

O23 - Service: Symantec Event Manager - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Network Proxy - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Password Validation - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTSvcCDA.EXE

O23 - Service: iPod-tjeneste - Apple Computer, Inc. - C:\Programfiler\iPod\bin\iPodService.exe

O23 - Service: ISSvc - Symantec Corporation - C:\Programfiler\Norton Internet Security\ISSVC.exe

O23 - Service: Norton AntiVirus Auto-Protect Service - Symantec Corporation - C:\Programfiler\Norton Internet Security\Norton AntiVirus\navapsvc.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Programfiler\Norton Internet Security\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service - Symantec Corporation - C:\PROGRA~1\FELLES~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Symantec Network Drivers Service - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: WMDM PMSP Service - Unknown - C:\WINDOWS\System32\MsPMSPSv.exe (file missing)

[akh]

c:\progra~1\intern~1\iexplore.exe <-- denne er enten et virus eller Internet Explorer. Sjekk om mappen stemmer med IE. iexplore.exe (er litt mistenkelig siden prosessen C:\Programfiler\Internet Explorer\iexplore.exe høyst sannsynlig er den korrekte)

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.vhunmitujdslcgru.info/ehOSt5jgS...Srj9BAYh3K.html <-- denne ser også litt suspekt ut.

C:\DOCUME~1\Robin\PROGRA~1\SOFTRE~1\Stupid Does.exe (file missing) <-- mistenkelig

[kayli]

Eg e ikke helt sikker på åssen eg sjekk dette. Kunne ikke finne noe mappe som som ligna.

Skal eg slette dette eller?

[kayli]

Her er en logg fra The Cleaner

0 System Idle Process System Idle Process

4 System System

592 smss.exe \SystemRoot\System32\smss.exe

656 csrss.exe C:\WINDOWS\system32\csrss.exe Client Server Runtime Process

680 winlogon.exe C:\WINDOWS\system32\winlogon.exe Påloggingsprogram for Windows NT

724 services.exe C:\WINDOWS\system32\services.exe Program for tjenester og kontroller

736 lsass.exe C:\WINDOWS\system32\lsass.exe LSA Shell (Export Version)

884 Ati2evxx.exe C:\WINDOWS\System32\Ati2evxx.exe

900 svchost.exe C:\WINDOWS\system32\svchost.exe Generic Host Process for Win32 Services

996 svchost.exe C:\WINDOWS\system32\svchost.exe Generic Host Process for Win32 Services

1092 svchost.exe C:\WINDOWS\System32\svchost.exe Generic Host Process for Win32 Services

1180 svchost.exe C:\WINDOWS\System32\svchost.exe Generic Host Process for Win32 Services

1308 svchost.exe C:\WINDOWS\System32\svchost.exe Generic Host Process for Win32 Services

1448 ccProxy.exe C:\Programfiler\Fellesfiler\Symantec Shared\ccProxy.exe Symantec Network Proxy Service

1460 ccSetMgr.exe C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe Symantec Settings Manager Service

1472 ISSVC.exe C:\Programfiler\Norton Internet Security\ISSVC.exe IS Service

1484 SNDSrvc.exe C:\Programfiler\Fellesfiler\Symantec Shared\SNDSrvc.exe Network Driver Service

1516 SPBBCSvc.exe C:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe SPBBC Service

1540 ccEvtMgr.exe C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe Symantec Event Manager Service

1896 spoolsv.exe C:\WINDOWS\system32\spoolsv.exe Spooler SubSystem App

484 Ati2evxx.exe C:\WINDOWS\system32\Ati2evxx.exe

524 Explorer.EXE C:\WINDOWS\Explorer.EXE Windows Utforsker

108 SOUNDMAN.EXE C:\WINDOWS\SOUNDMAN.EXE Realtek Sound Manager

332 atiptaxx.exe C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe ATI Desktop Control Panel

852 jusched.exe C:\Programfiler\Java\j2re1.4.2_05\bin\jusched.exe

940 NvMixerTray.exe C:\Programfiler\NVIDIA Corporation\NvMixer\NvMixerTray.exe NVIDIA nForce Mixer Tray Application

920 winampa.exe C:\DOWNLOADS\Winamp\winampa.exe

1060 qttask.exe C:\Programfiler\QuickTime\qttask.exe

1080 iTunesHelper.exe C:\Programfiler\iTunes\iTunesHelper.exe iTunesHelper Module

1112 msnappau.exe C:\Programfiler\MSN Apps\Updater\01.02.3000.1001\no\msnappau.exe MSN Updater

1144 ccApp.exe C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe Symantec User Session

1160 iexplore.exe C:\Programfiler\Internet Explorer\iexplore.exe Internet Explorer

1124 tca.exe C:\Programfiler\The Cleaner\tca.exe The Cleaner Active Process Monitor

1260 ctfmon.exe C:\WINDOWS\system32\ctfmon.exe CTF Loader

1284 msmsgs.exe C:\Programfiler\Messenger\msmsgs.exe Windows Messenger

1592 gwum.exe C:\Programfiler\Gigabyte\Gigabyte Windows Utility Manager\gwum.exe menu1 MFC Application

1984 iexplore.exe c:\progra~1\intern~1\iexplore.exe Internet Explorer

180 CDANTSRV.EXE C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE C-Dilla RTS Service

200 CTSvcCDA.EXE C:\WINDOWS\System32\CTSvcCDA.EXE Creative Service for CDROM Access

380 navapsvc.exe C:\Programfiler\Norton Internet Security\Norton AntiVirus\navapsvc.exe Norton AntiVirus Auto-Protect Service

2132 svchost.exe C:\WINDOWS\System32\svchost.exe Generic Host Process for Win32 Services

2164 symlcsvc.exe C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe Symantec Core Component

2184 wdfmgr.exe C:\WINDOWS\system32\wdfmgr.exe Windows User Mode Driver Manager

2920 iPodService.exe C:\Programfiler\iPod\bin\iPodService.exe iPodService Module

3400 alg.exe alg.exe Application Layer Gateway Service

1340 wkcalrem.exe C:\Programfiler\Fellesfiler\Microsoft Shared\Works Shared\wkcalrem.exe Microsoft® Works Calendar Reminder Service

3252 regprot.exe C:\Documents and Settings\Robin\Skrivebord\Mine mottatte filer\regprot\regprot.exe DiamondCS RegistryProt

3388 regprot.exe C:\Documents and Settings\Robin\Skrivebord\Mine mottatte filer\regprot\regprot.exe DiamondCS RegistryProt

3548 iexplore.exe C:\Programfiler\Internet Explorer\iexplore.exe Internet Explorer

1948 notepad.exe C:\WINDOWS\system32\notepad.exe Notisblokk

 

BHO List

--------

"AcroIEHlprObj Class" - C:\Programfiler\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

"No Name" - C:\Programfiler\Spybot - Search & Destroy\SDHelper.dll

"ST" - C:\Programfiler\MSN Apps\ST\01.02.3000.1002\en-xu\stmain.dll

"CNisExtBho Class" - C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll

"MSNToolBandBHO" - C:\Programfiler\MSN Apps\MSN Toolbar\01.02.3000.1001\no\msntb.dll

"CNavExtBho Class" - C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll

"No Name" - C:\DOCUME~1\Robin\PROGRA~1\SOFTRE~1\Stupid Does.exe

[akh]

The Cleaner nevner også den "stupid does.exe" filen, bør kanskje se om den klarer å fjerne den.

 

edit: prøv BHOdemon for å få mer info om BHO-filene. (vet ikke om Cleaner også gir info om dem?)

Endret 18. desember 2004 av akh

[kayli]

Har hatt brudd på linja.

Dette kom frem når jeg kjørte BHODemon

 

Attribute Value

Blocked Load Attempts 0

Clsid {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

Created Date Wednesday, July 28, 2004 21:46:21

Desc AcroIEHelper Module

DLL Path C:\Programfiler\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

Enabled? Yes

EnabledCount 56

File Description AcroIEHelper Module

Internal Name AcroIEHelper

Last Load Time 18.12.2004 21:35:57

Legal Copyright Copyright 2001

Load Attempts 1,437

MD5 Checksum 8394abfc1be196a62c9f532511936df7

Modified Date Monday, April 16, 2001 15:39:02

Original Filename AcroIEHelper.DLL

Product Name AcroIEHelper Module

Product Version 1, 0, 0, 1

ProgID AcroIEHelper.AcroIEHlprObj.1

ReportsCount 70

Size (bytes) 37,808

Status Benign

URL www.adobe.com

 

Attribute Value

Blocked Load Attempts 0

Clsid {9EAA69AF-CA16-2D36-E04E-ED15600A575C}

Enabled? Yes

Last Load Time 18.12.2004 21:47:16

Load Attempts 1,344

Status Unknown

 

Det andre som kom frem var kjente program.

[akh]

Den første der er vel noe som hører til Acrobat Reader. Den andre bør du muligens prøve å blokkere.

[woodchopper87]

jeg bruker internet explorer. Ja spybot finner noe som jeg sletter. Noe som kommer opp hele tiden er dsoexploit. Tror det var det det hette.

DSO-exploit er visstnok en bug av en eller annen form, altså ingenting å bry seg om.

Hadde selv samme problemet. Lastet ned en fix på majorgeeks.com som ordnet det.

[kayli]

Jeg slettet den som var ukjent i BHODemon.

Hva betyr det når ett program som f.eks The Cleaner kommer med advarsel om registerendring? Når jeg ikke har klikket meg inn på en eneste fil, kommer slike advarsler?

Hver gang jeg kjører S&D er det DSOexploit med 5 registerendringer som må fixes? Blir de aldri fixet?

[akh]

Jeg postet vel en link til hvordan man kan fjerne DSO exploit lenger oppe. Som woodchopper87 sier er ikke den særlig mye å bry seg om.

At noe endres i registeret uten at du har gjort noe er et dårlig tegn, mest sannsynlig spyware/trojaner/virus på ferde. Fant du ut hva stupid does.exe var for noe?

[kayli]

Jeg søkte pg Google men fant ikke noe fornuftig der. Fant filene på datamaskin.

2 forskjellig

 

Her er den ene.

[info]

StartVersion=1

File=C:\Documents and Settings\Robin\Programdata\Soft Real Skip\Stupid Does.exe

Name=Stupid Does.exe

Rating=269

Description= (Nettleser tillegg)

Company_Product=-

Service={C5699C09-57C8-296E-B677-F6F3A4DFCF90}

Type=6

Visible=0

Win=0

M=1004

T=2080

Ports=

DelDate=38339

DelDateTime=18.12.2004 11:45:49

[service]

Service=

 

Her er den andre

[info]

StartVersion=1

File=C:\Documents and Settings\Robin\Programdata\Soft Real Skip\Stupid Does.exe

Name=Stupid Does.exe

Rating=329

Description= (Nettleser tillegg)

Company_Product=-

Service={9EAA69AF-CA16-2D36-E04E-ED15600A575C}

Type=6

Visible=0

Win=0

M=1004

T=2080

Ports=

DelDate=38339

DelDateTime=18.12.2004 11:45:32

[service]

Service=

 

Lagret i "konfigurasjonsinnstillinger"

Endret 19. desember 2004 av kayli

[kayli]

Kjørt Ad-Aware

MRU LIST

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

obj[0]=MRU RegReference : S-1-5-21-1644491937-1292428093-725345543-1005\software\microsoft\search assistant\acmru\5603

obj[1]=MRU RegReference : S-1-5-21-1644491937-1292428093-725345543-1005\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru\*

obj[2]=MRU RegReference : S-1-5-21-1644491937-1292428093-725345543-1005\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru\ini

obj[3]=MRU RegReference : S-1-5-21-1644491937-1292428093-725345543-1005\software\microsoft\windows\currentversion\explorer\recentdocs\.ini

obj[5]=MRU RegReference : S-1-5-21-1644491937-1292428093-725345543-1005\software\microsoft\windows\currentversion\explorer\recentdocs\Folder

obj[4]=MRU RegReference : S-1-5-21-1644491937-1292428093-725345543-1005\software\microsoft\windows\currentversion\explorer\recentdocs\.jpg

obj[7]=MRU RegReference : software\microsoft\directdraw\mostrecentapplication name

obj[8]=MRU RegReference : S-1-5-21-1644491937-1292428093-725345543-1005\software\microsoft\internet explorer\typedurls

 

LOP

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

obj[6]=Process : c:\docume~1\robin\lokale~1\temp\nhyecucx.exe

 

LOP

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

obj[29]=Process : c:\docume~1\robin\lokale~1\temp\piblflnc.exe

obj[32]=File : C:\Documents and Settings\Robin\Programdata\Itchdeaf\ooze corn itch road.exe

 

TRACKING COOKIE

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

obj[30]=IECache Entry : Cookie:[email protected]/

obj[31]=IECache Entry : Cookie:[email protected]/

[akh]

Får adaware fjernet det der? Fjernet du de to stupid does greiene? Begynner maskinen å bli ren etterhvert?

[kayli]

Ja, Ad-Aware får fjernet de, men det kommer nye hver dag.

Jeg har ikke slettet stupid does.exe. Skal gjøre det.

[akh]

Skift nettleser også (opera eller firefox) så slipper du denne invasjonen av spyware o.l.

[kayli]

Har slette stupid does.exe filene. Kjørte en virusscan med Ad-Aware.

Dette var den den fant

 

ArchiveData(malware.bckp)

Referencefile : SE1R23 16.12.2004

======================================================

 

LOP

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

obj[0]=Process : c:\docume~1\robin\lokale~1\temp\orbluelu.exe

 

 

 

Er det vanskelig å bytte nettleser? Kan man fremdeles bruke msn, outlook osv?