fått virus - lsass.exe ble uventet avsluttet

[Demantios]

Sitter på HW-LAN og har fått virus. Har en følelse av a det er sasser, men er ikke sikker

 

I tillegg er det en prosess som heter mastercard32.exe oO

 

Regner med at noen har vært borti dette før og vet hvordan jeg skal få fiksa det

 

Skjult tekst: (Marker innholdet i feltet for å se teksten):

Logfile of HijackThis v1.99.1

Scan saved at 20:58:52, on 06.10.2006

Platform: Windows XP  (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 (6.00.2600.0000)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\S24EvMon.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\ZCfgSvc.exe

C:\Programfiler\FileZilla Server\FileZilla Server.exe

C:\WINDOWS\System32\dllcache\mainwin32.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\RegSrvc.exe

C:\WINDOWS\system\winlogon.exe

C:\WINDOWS\System32\1XConfig.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Programfiler\ltmoh\Ltmoh.exe

C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe

C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Launch Manager\LaunchAp.exe

C:\Program Files\Launch Manager\HotkeyApp.exe

C:\Program Files\Launch Manager\OSD.exe

C:\Program Files\Launch Manager\Wbutton.exe

C:\Programfiler\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe

C:\Programfiler\Wistron\AVManager\AVManager.exe

C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\WINDOWS\system32\qttask.exe

C:\Programfiler\D-Tools\daemon.exe

C:\Programfiler\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe

C:\Programfiler\Hewlett-Packard\hp LaserJet 1010 Series\SetConfig.exe

C:\Programfiler\Unlocker\UnlockerAssistant.exe

C:\Programfiler\FileZilla Server\FileZilla Server Interface.exe

C:\Programfiler\Java\jre1.5.0_06\bin\jusched.exe

C:\nwnmff_e24.exe

C:\dfndrff_e24.exe

C:\kybrdff_e24.exe

C:\Programfiler\SpeedswitchXP\SpeedswitchXP.exe

C:\programfiler\steam\steam.exe

C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe

C:\Documents and Settings\Eier\Mine dokumenter\Snarveier\Programmer\mobmeter.exe

C:\Programfiler\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe

C:\Documents and Settings\Eier\Mine dokumenter\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Programfiler\Deskbar\deskbar.dll

F2 - REG:system.ini: UserInit=userinit.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx

O3 - Toolbar: ToolBar888 - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Programfiler\Fellesfiler\{30AEA814-069E-1044-1108-04041108002f}\MyToolBar.dll

O3 - Toolbar: &VSToolBar - {821F87FF-8245-4972-9E28-732E92EC2F51} - C:\Programfiler\VSToolbar\VSToolBar.dll

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [LtMoh] C:\Programfiler\ltmoh\Ltmoh.exe

O4 - HKLM\..\Run: [synTPLpr] C:\Programfiler\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Programfiler\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe

O4 - HKLM\..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe

O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe

O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSD.exe

O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"

O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Programfiler\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe

O4 - HKLM\..\Run: [AVManager] "C:\Programfiler\Wistron\AVManager\AVManager.exe"

O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\qttask.exe" -atboottime

O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programfiler\D-Tools\daemon.exe"  -lang 1033

O4 - HKLM\..\Run: [Resume copy] copyfstq.exe /startup

O4 - HKLM\..\Run: [statusClient] C:\Programfiler\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto

O4 - HKLM\..\Run: [TomcatStartup] C:\Programfiler\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe

O4 - HKLM\..\Run: [HPLJ Config] C:\Programfiler\Hewlett-Packard\hp LaserJet 1010 Series\SetConfig.exe -c Direct -p USB001 -pn "hp LaserJet 1010 Series Driver" -n 0 -l 1033 -sl 120000

O4 - HKLM\..\Run: [unlockerAssistant] "C:\Programfiler\Unlocker\UnlockerAssistant.exe"

O4 - HKLM\..\Run: [FileZilla Server Interface] "C:\Programfiler\FileZilla Server\FileZilla Server Interface.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Programfiler\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [newname] C:\\nwnmff_e24.exe

O4 - HKLM\..\Run: [defender] C:\\dfndrff_e24.exe

O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_e24.exe

O4 - HKCU\..\Run: [speedswitchXP] C:\Programfiler\SpeedswitchXP\SpeedswitchXP.exe

O4 - HKCU\..\Run: [steam] "c:\programfiler\steam\steam.exe" -silent

O4 - Startup: Adobe Gamma.lnk = C:\Programfiler\Fellesfiler\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: Mobmeter.lnk = C:\Documents and Settings\Eier\Mine dokumenter\Snarveier\Programmer\mobmeter.exe

O4 - Global Startup: Hurtigstart for Adobe Reader.lnk = C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: Add to AD Black List - C:\Programfiler\Avant Browser\AddToADBlackList.htm

O8 - Extra context menu item: Block All Images from the Same Server - C:\Programfiler\Avant Browser\AddAllToADBlackList.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Highlight - C:\Programfiler\Avant Browser\Highlight.htm

O8 - Extra context menu item: Open All Links in This Page... - C:\Programfiler\Avant Browser\OpenAllLinks.htm

O8 - Extra context menu item: Open In New Avant Browser - C:\Programfiler\Avant Browser\OpenInNewBrowser.htm

O8 - Extra context menu item: Search - C:\Programfiler\Avant Browser\Search.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1160155384954

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O23 - Service: Adobe LM Service - Adobe Systems - C:\Programfiler\Fellesfiler\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Programfiler\FileZilla Server\FileZilla Server.exe

O23 - Service: Microsoft Main Window Service - Unknown owner - C:\WINDOWS\System32\dllcache\mainwin32.exe

O23 - Service: Network Monitor - Unknown owner - C:\Programfiler\Network Monitor\netmon.exe (file missing)

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe

O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\WINDOWS\System32\S24EvMon.exe

O23 - Service: Windows NT Logon Application (WINLOGON) - Unknown owner - C:\WINDOWS\system\winlogon.exe

 

BILDE:

Endret 6. oktober 2006 av PepsiCo

[Pozzolan]

Huh? Du drar på lan uten noen form for SP? Ikke lurt!

 

 

Slett disse med Hijackthis:

 

O3 - Toolbar: ToolBar888 - {C004DEC2-2623-438e-9CA2-C9043AB28508} - C:\Programfiler\Fellesfiler\{30AEA814-069E-1044-1108-04041108002f}\MyToolBar.dll O3 - Toolbar: &VSToolBar - {821F87FF-8245-4972-9E28-732E92EC2F51} - C:\Programfiler\VSToolbar\VSToolBar.dll 
O4 - HKLM\..\Run: [newname] C:\\nwnmff_e24.exe
O4 - HKLM\..\Run: [defender] C:\\dfndrff_e24.exe
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_e24.exe
O23 - Service: Microsoft Main Window Service - Unknown owner - C:\WINDOWS\System32\dllcache\mainwin32.exe
O23 - Service: Network Monitor - Unknown owner - C:\Programfiler\Network Monitor\netmon.exe (file missing)
O23 - Service: Windows NT Logon Application (WINLOGON) - Unknown owner - C:\WINDOWS\system\winlogon.exe

 

Så bruker du Killbox på følgende:

 

C:\WINDOWS\System32\dllcache\mainwin32.exe
C:\WINDOWS\system\winlogon.exe
C:\nwnmff_e24.exe
C:\dfndrff_e24.exe
C:\kybrdff_e24.exe
C:\Programfiler\Fellesfiler\{30AEA814-069E-1044-1108-04041108002f}\
C:\Programfiler\VSToolbar\

 

Husk å lese hijackthis guiden min i signaturen min. Den inneholder all informasjonen du trenger.

 

Husk at alt dette gjøres etter at du har slått av system restore og er i sikkermodus.

 

Ta også en online scan med Panda og post loggen her. (Kan gjøres i vanlig modus) Men før du gjør det ta en runde med ccleaner.

 

Etter at du er ferdig med alt dette poster du en ny logg fra vanlig modus.

Merk: Ikke oppdater windows enda!

[Demantios]

Takker

 

hva er SP btw

[Pozzolan]

Service Pack. (trenger jeg å skrive mer? 14...)

[Demantios]

Tenkte ikke på det. Har killa dem nå (uten sikkermodus) så skal vel reboote i natt en gang så oppdaterer jeg. Den har ikke kommet nå så

[Pozzolan]

Ikke oppdater før du har gjort det jeg skrev i min første post! Det er veldig viktig. Ellers så kan det hende at noe blir korrupt og du må ta en format c:.

Endret 7. oktober 2006 av stealthy