Virusproblem (Command Service)

[Jonhei]

Hei!

 

Har et lite virus jeg gjerne skulle ha fjerna...

 

Kjørte Spybot S&D og fant frem til noe som het Command Service. Spybot greide ikke å fjerne det. Har lastet ned Hijack This, og her er loggen:

Logfile of HijackThis v1.99.1

Scan saved at 17:48:38, on 05.03.2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\system32\spoolsv.exe

D:\WINDOWS\system32\rundll32.exe

D:\WINDOWS\ehome\ehtray.exe

D:\Program Files\Java\j2re1.4.2_10\bin\jusched.exe

D:\Program Files\outlook\outlook.exe

D:\WINDOWS\system32\winlog.exe

D:\Program Files\Messenger\msmsgs.exe

D:\WINDOWS\system32\ctfmon.exe

D:\Program Files\MSN Messenger\MsnMsgr.Exe

D:\Program Files\WinZip\WZQKPICK.EXE

D:\WINDOWS\Sm9yZ2VuIEhlaWVy\command.exe

D:\WINDOWS\eHome\ehRecvr.exe

D:\WINDOWS\eHome\ehSched.exe

D:\WINDOWS\system32\dllhost.exe

D:\WINDOWS\eHome\ehmsas.exe

D:\WINDOWS\system32\wscntfy.exe

D:\Program Files\LimeWire\LimeWire.exe

D:\WINDOWS\system32\wpabaln.exe

D:\WINDOWS\explorer.exe

D:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

D:\Documents and Settings\Jorgen Heier\Desktop\HijackThis.exe

D:\WINDOWS\system32\NOTEPAD.EXE

D:\WINDOWS\system32\mmc.exe

D:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startsiden.no/

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

O4 - HKLM\..\Run: [ehTray] D:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] D:\Program Files\Java\j2re1.4.2_10\bin\jusched.exe

O4 - HKLM\..\Run: [winupdates] D:\Program Files\winupdates\winupdates.exe /auto

O4 - HKLM\..\Run: [outlook] D:\Program Files\outlook\outlook.exe /auto

O4 - HKLM\..\Run: [winlog] winlog.exe

O4 - HKLM\..\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

O4 - HKLM\..\RunServices: [winlog] winlog.exe

O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\j2re1.4.2_10\bin\npjpi142_10.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\j2re1.4.2_10\bin\npjpi142_10.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1138822204984

O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.2) - https://java.sun.com/products/plugin/autodl...indows-i586.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwa...ash/swflash.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "D:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O20 - Winlogon Notify: Shell Extensions - D:\WINDOWS\system32\mgdtctm.dll

O23 - Service: Command Service (cmdService) - Unknown owner - D:\WINDOWS\Sm9yZ2VuIEhlaWVy\command.exe

 

Jeg får heller ikke slettet det. Noen som vet hva jeg kan gjøre? Kan hende at det er noen flere muligheter innenfor Hijack This som jeg ikke kan...

 

Med vennlig hilsen

En desperat Jonhei!

Endret 5. mars 2006 av Jonhei

[berxter]

HJT er først og fremst et diagnoseverktøy. Som du sikkert aner har du fått deg (minst) en Trojaner, og du bør kjøre alle disse 3 onlinescannerne:

Housecall (jeg ser det ligger en AxtiveXkontroll for den IE-baserte versjonen, men den Javabaserte som jeg linker til er minst like god

Panda , lagre loggen dens, den er liten og søt.

Trojanscan

 

Mens du nå holder på er det alltid kjekt å kjøre Ewido i safe mode. Husk å oppdatere den først, fjern haken i "Install background guard" og "Install scan via context menu"

 

 

Bernt K

[efikkan]

Ultimate Boot CD har ulike virusprogram og diagnoseprogram.