Spyware problemer. Trenger litt ekspertise...igjen

[Plecto]

Nå har jeg igjen samme problemet som jeg hadde for en stund siden, spyware som har svidd seg fast i harddisken

 

Her er i alle falll Hijack This loggfilen

 

Logfile of HijackThis v1.99.1

Scan saved at 08:09:31, on 26.09.2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

c:\programfiler\mcafee.com\agent\mcdetect.exe

c:\PROGRA~1\mcafee.com\vso\mcshield.exe

c:\PROGRA~1\mcafee.com\agent\mctskshd.exe

c:\PROGRA~1\mcafee.com\vso\OasClnt.exe

C:\Programfiler\Fellesfiler\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\r_server.exe

c:\programfiler\mcafee.com\vso\mcvsshld.exe

c:\progra~1\mcafee.com\vso\mcvsescn.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wdfmgr.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\alg.exe

C:\PROGRA~1\mcafee.com\agent\mcagent.exe

C:\Programfiler\D-Tools\daemon.exe

C:\WINDOWS\system32\rundll32.exe

C:\Programfiler\K-Lite Codec Pack\QuickTime\qttask.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Programfiler\MSN Messenger\MsnMsgr.Exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\Messenger\msmsgs.exe

c:\progra~1\mcafee.com\vso\mcvsftsn.exe

C:\Programfiler\Ahead\Nero StartSmart\NeroStartSmart.exe

C:\Programfiler\Ahead\nero\nero.exe

C:\WINDOWS\System32\imapi.exe

C:\Programfiler\Avid\Avid Liquid 7\Program\STUDIOU.MOD

C:\Programfiler\Avid\Avid Liquid 7\Program\Watchu.exe

C:\Programfiler\Avid\Avid Liquid 7\PROGRAM\VFCOLU.EXE

C:\Programfiler\Avid\Avid Liquid 7\Program\UMI.EXE

C:\Programfiler\Avid\Avid Liquid 7\Program\RM.EXE

C:\Programfiler\Avid\Avid Liquid 7\Program\nwattach.exe

c:\windows\system32\rlvknlg.exe

C:\Programfiler\Spybot - Search & Destroy\SpybotSD.exe

C:\WINDOWS\system32\mmc.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\mmc.exe

C:\Programfiler\Internet Explorer\iexplore.exe

C:\Programfiler\WinRAR\WinRAR.exe

C:\DOCUME~1\Tor-Arne\LOKALE~1\Temp\Rar$EX00.609\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.norskfilmforum.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Programfiler\MyGlobalSearch\bar\1.bin\MGSBAR.DLL

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programfiler\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.5.0_07\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programfiler\google\googletoolbar1.dll

O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll

O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Programfiler\MyGlobalSearch\bar\1.bin\MGSBAR.DLL

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programfiler\google\googletoolbar1.dll

O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe

O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe

O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask

O4 - HKLM\..\Run: [VirusScan Online] C:\Programfiler\McAfee.com\VSO\mcvsshld.exe

O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programfiler\D-Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [OASClnt] C:\Programfiler\McAfee.com\VSO\oasclnt.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKLM\..\RunOnce: [AAW] "C:\Programfiler\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe" "+b1"

O4 - HKLM\..\RunOnce: [spybotSnD] "C:\Programfiler\Spybot - Search & Destroy\SpybotSD.exe" /autocheck

O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_07\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\rlls.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\rlls.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\rlls.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\rlls.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\rlls.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\rlls.dll

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -

O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.2.89.cab

O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m...83/mcinsctl.cab

O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://62.128.250.96//activex/AMC.cab

O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m...,20/mcgdmgr.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: Adobe LM Service - Adobe Systems - C:\Programfiler\Fellesfiler\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Programfiler\iPod\bin\iPodService.exe

O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\programfiler\mcafee.com\agent\mcdetect.exe

O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe

O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe

O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe

O23 - Service: Ndillien - McAfee Inc. - (no file)

O23 - Service: Remote Administrator Service (r_server) - Unknown owner - C:\WINDOWS\system32\r_server.exe" /service (file missing)

 

 

 

Pcen min går enormt tregt, det tar borti 10 minutter å starte den (henger i oppstart), jeg får ikke åpnet diskdefragmenterings verktøyet og pcen henger omtrent hele tiden. Jeg kjører adaware, cc cleaner og spybot konstant og den finner stadig mer spyware. Jeg har også en "rlvknlg.exe" program som starter hele tiden og bruker enormt med både cpu og minne. Harddisken knaker og klager når dette programmet er oppe, men det hjelper ikke å lukke det, tar 10 sekunder så er det back og track. Vær så snill å hjelp!

[Thor.]

Angående rlvknlg.exe så kan du se på linken under

 

http://www.liutilities.com/products/wintas...ibrary/rlvknlg/

[Plecto]

Det hjalp ikke så veldig. For å fjerne det måtte jeg ha WinTask 5 pro, som koster penger. Det var en "free scan" der, Registry Booster, men den fjernet bare 15 av 216 problemer fordi det var trail, og den fjernet ikke rlvknlg.exe

[Thor.]

Googler du etter filnavnet finner du flere løsninger

[Plecto]

Det var ikke værre enn å avslutte programmet i oppgavebehandlingen for så å slette fila i system32. Men jeg skulle gjerne hatt noen råd ang den HJT loggen...

[Thor.]

O10 - Unknown file in Winsock LSP: c:\windows\system32\rlls.dll (6 stykker) "This entry should not be fixed! Your best bet to repair it is to try the LSPFix from Cexx.org."

 

O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} - "Kazaa Spyware"

 

Slett disse og se om de kommer tilbake

[berxter]

Download, unzip and run LSPFix.exe from here and remove rlls.dll from your winsock layers. In order to do this, click the "I know what I'm doing" checkbox and check all instances of rlls.dll (and nothing else). Then move all checked files to the "Remove" pane and click Finish and reboot.

http://www.cexx.org/lspfix.htm

 

Denne må du fikse:

O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Programfiler\MyGlobalSearch\bar\1.bin\MGSBAR.DLL

 

O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Programfiler\MyGlobalSearch\bar\1.bin\MGSBAR.DLL

Enkleste måten er vel å prøve SuperAntiSpyware:

http://www.superantispyware.com/

 

Den skal være effektiv mot svineriet.

 

Bernt K

[Plecto]

Har fikset de problemene nå, men det hjalp ingenting på problemene jeg har på pcen. Tenkte kanskje at det passer bedre å diskutere det her:

 

https://www.diskusjon.no/index.php?showtopic=627034&hl=

[Thor.]

Har fikset de problemene nå, men det hjalp ingenting på problemene jeg har på pcen. Tenkte kanskje at det passer bedre å diskutere det her:

 

https://www.diskusjon.no/index.php?showtopic=627034&hl=

6953939[/snapback]

Nei.. Spyware og virus går under sikkerhet

[Plecto]

Ja, men jeg vet ikke om det er det som er problemet... har alle mulige problemer med pcen nå så jeg vet ikke helt hvor det skal postes

[Thor.]

Last ned ccleaner og rydd i systemet. Den sletter ikke noe som er viktig for hverken deg eller systemet. Den rydder også opp i registeret som kan klumpe seg til etterhvert.

 

Hjeler dette?