Din teknikk for å fjerne MSN-viruset

Gissan · 22. oktober 2006

Logg.

Skjult tekst: (Marker innholdet i feltet for å se teksten):

Logfile of HijackThis v1.99.1

Scan saved at 14:47:36, on 22.10.2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\SYSTEM32\SVCHOST.EXE

C:\WINDOWS\SYSTEM32\SPOOLSV.EXE

C:\PROGRAMFILER\ACER\ACER ECONSOLE\MEDIASERVERSERVICE.EXE

C:\Programfiler\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe

C:\WINDOWS\system32\cisvc.exe

C:\Programfiler\ewido anti-spyware 4.0\guard.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\PCCTLCOM.EXE

C:\WINDOWS\System32\snmp.exe

C:\WINDOWS\system32\svchost.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\TMPROXY.EXE

C:\PROGRA~1\TRENDM~1\INTERN~1\TMPFW.EXE

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Programfiler\CyberLink\PowerDVD\PDVDServ.exe

C:\Programfiler\Acer\eRecovery\Monitor.exe

C:\Programfiler\Java\jre1.5.0_06\bin\jusched.exe

C:\Programfiler\Acer\Acer eMode Management\AspireService.exe

C:\PROGRAMFILER\ACER\ACER ECONSOLE\MEDIASYNC.EXE

C:\Programfiler\Adobe\Photoshop Elements 4.0\apdproxy.exe

C:\Programfiler\iTunes\iTunesHelper.exe

C:\Programfiler\QuickTime\qttask.exe

C:\Programfiler\Trend Micro\Internet Security 14\pccguide.exe

C:\Programfiler\iPod\bin\iPodService.exe

C:\PROGRAMFILER\EWIDO ANTI-SPYWARE 4.0\EWIDO.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\Spybot - Search & Destroy\TeaTimer.exe

C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\PROGRA~1\MICROS~4\rapimgr.exe

C:\PROGRAMFILER\CITRIX\ICA CLIENT\PNAGENT.EXE

C:\Programfiler\WinZip\WZQKPICK.EXE

C:\PROGRAMFILER\REALVNC\VNC4\WINVNC4.EXE

C:\Programfiler\Sony Ericsson\Mobile\audevicemgr.exe

C:\PROGRA~1\INTUWA~1\SHARED\MROUTE~1\MROUTE~2.EXE

C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Programfiler\Microsoft ActiveSync\wcescomm.exe

L:\Programmer\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bt.no/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O4 - HKLM\..\Run: [LaunchApp] Alaunch

O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [ntiMUI] c:\Programfiler\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe

O4 - HKLM\..\Run: [RemoteControl] C:\Programfiler\CyberLink\PowerDVD\PDVDServ.exe

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [eRecoveryService] C:\Programfiler\Acer\eRecovery\Monitor.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Programfiler\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [AspireService] C:\Programfiler\Acer\Acer eMode Management\AspireService.exe

O4 - HKLM\..\Run: [MediaSync] C:\Programfiler\Acer\Acer eConsole\MediaSync.exe

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Programfiler\Adobe\Photoshop Elements 4.0\apdproxy.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Programfiler\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [pccguide.exe] "C:\Programfiler\Trend Micro\Internet Security 14\pccguide.exe"

O4 - HKLM\..\Run: [!ewido] "C:\PROGRAMFILER\EWIDO ANTI-SPYWARE 4.0\EWIDO.EXE" /minimized

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~4\wcescomm.exe"

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Programfiler\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - Global Startup: Program Neighborhood Agent.lnk = C:\Programfiler\Citrix\ICA Client\pnagent.exe

O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programfiler\WinZip\WZQKPICK.EXE

O4 - Global Startup: Run VNC Server.lnk = C:\Programfiler\RealVNC\VNC4\winvnc4.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Phone Connection Monitor.lnk = ?

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll

O9 - Extra 'Tools' menuitem: Opprett mobil favoritt... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab

O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetup Control) - https://portal.bergentaxi.no/dana-cached/se...uniperSetup.cab

O20 - Winlogon Notify: !SASWinLogon - C:\Programfiler\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

O23 - Service: Acer Media Server - Acer Inc. - C:\Programfiler\acer\Acer eConsole\MediaServerService.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Programfiler\Fellesfiler\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Programfiler\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Programfiler\ewido anti-spyware 4.0\guard.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Programfiler\iPod\bin\iPodService.exe

O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - C:\Programfiler\TuneUp Utilities 2006\WinStylerThemeSvc.exe

norbat · 22. oktober 2006

Jeg antar at du under scanningen av tidligere nevnte program har fått fjernet de filene som kunne fjernes, for loggen din tyder ikke på at det er noe der av betydning.

Så hvorfor du ikke kommer deg på nett er vanskelig å si. Du kan prøve å sjekke for systemfeil ved å gå til Start -> Kjør, skriv sfc /scannow . Du trenger winxp cd'n.

Om dette ikke hjelper, ser jeg at det ligger et recoveryprogram (eRecovery) på pc'n som kanskje er siste utvei?

Gissan · 22. oktober 2006

Jeg antar at du under scanningen av tidligere nevnte program har fått fjernet de filene som kunne fjernes, for loggen din tyder ikke på at det er noe der av betydning.

Så hvorfor du ikke kommer deg på nett er vanskelig å si. Du kan prøve å sjekke for systemfeil ved å gå til Start -> Kjør, skriv sfc /scannow . Du trenger winxp cd'n.

Om dette ikke hjelper, ser jeg at det ligger et recoveryprogram (eRecovery) på pc'n som kanskje er siste utvei?

7125266[/snapback]

jeg har ikke winxp cden.

Telnet sier at nettet er koblet til.

Ipconfig sier ip-adressene er greie.

Internett funker hverken for IE eller FF.

Leste litt på internett om viruset, og det stod at den forandret instillinger i webklientene på maskinen.

Under diskopprydding får jeg ikke fjernet WebClient-filene.

EDIT: SAS fjernet 65 forskjellige filer, sa den..

Endret 22. oktober 2006 av tissedam

norbat · 22. oktober 2006

Du kan laste ned ccleaner (google) og installer den på pc'n

Restart i sikker modus og kjør "rens" samt "saker" (fix det den finner) noen ganger for å rense litt.

SAS lager en logg. Kunne du finne den og legge den ut. Kunne være interessant å se hva den fant.

Endret 22. oktober 2006 av norbat

Gissan · 22. oktober 2006

Du kan laste ned ccleaner (google) og installer den på pc'n
Restart i sikker modus og kjør "rens" samt "saker" (fix det den finner) noen ganger for å rense litt.

SAS lager en logg. Kunne du finne den og legge den ut. Kunne være interessant å se hva den fant.

7125390[/snapback]

SAS finner ingenting mer.

CCleaner fikset heller ikke problemet. (fjernet 0,42 MB).

norbat · 22. oktober 2006

Åpne SAS, velg Preferences, under arkfanen Stat.../logs finner du siste logg

Gissan · 22. oktober 2006

Åpne SAS, velg Preferences, under arkfanen Stat.../logs finner du siste logg

7125516[/snapback]

Daså.

Finner den nå.

EDIT:

Skjult tekst: (Marker innholdet i feltet for å se teksten):

SUPERAntiSpyware Scan Log

Generated 10/21/2006 at 09:55 PM

Application Version : 3.3.1020

Core Rules Database Version : 0

Trace Rules Database Version: 0

Scan type : Complete Scan

Total Scan Time : 00:25:29

Memory items scanned : 164

Memory threats detected : 0

Registry items scanned : 6172

Registry threats detected : 57

File items scanned : 69961

File threats detected : 64

Unclassified.Unknown Origin

HKCR\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}

HKCR\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}#AppID

HKCR\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}\InprocServer32

HKCR\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}\InprocServer32#ThreadingModel

HKCR\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}\ProgID

HKCR\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}\Programmable

HKCR\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}\TypeLib

HKCR\CLSID\{B3E19860-0CD5-4991-A066-4FCA2704DE59}\VersionIndependentProgID

C:\SYSTEM VOLUME INFORMATION\_RESTORE{090D6C3F-51D8-4B23-BDEB-8B4694124036}\RP155\A0210662.EXE

Adware.WhenU

HKCR\ACM.ACMFactory

HKCR\ACM.ACMFactory\CLSID

HKCR\ACM.ACMFactory\CurVer

HKCR\ACM.ACMFactory.1

HKCR\ACM.ACMFactory.1\CLSID

HKCR\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}

HKCR\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid

HKCR\Interface\{572FB162-C0BA-4EDF-8CFF-E3846153B9B0}\ProxyStubClsid32

HKCR\AppId\{127DF9B4-D75D-44A6-AF78-8C3A8CEB03DB}

HKCR\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}

HKCR\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}#AppID

HKCR\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\ProgID

HKCR\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\Programmable

HKCR\CLSID\{A9AAE1AB-9688-42C5-86F5-C12F6B9015AD}\VersionIndependentProgID

HKCR\AppId\ACM.DLL

HKCR\AppId\ACM.DLL#AppID

HKCR\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}

HKCR\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid

HKCR\Interface\{72A836D1-BC00-43C0-A941-17960E4FB842}\ProxyStubClsid32

HKCR\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}

HKCR\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid

HKCR\Interface\{43382522-A846-46F4-AC57-1F71AE6E1086}\ProxyStubClsid32

Adware.MovieLand/MediaPipe

HKCR\MPAgent.Agent

HKCR\MPAgent.Agent\CLSID

HKCR\MPAgent.Agent\CurVer

HKCR\MPAgent.Agent.1

HKCR\MPAgent.Agent.1\CLSID

HKCR\AppId\MPAgent.DLL

HKCR\AppId\MPAgent.DLL#AppID

HKCR\TypeLib\{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}

HKCR\TypeLib\{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}\1.0

HKCR\TypeLib\{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}\1.0\0

HKCR\TypeLib\{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}\1.0\0\win32

HKCR\TypeLib\{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}\1.0\FLAGS

HKCR\TypeLib\{CCEBBEB5-D011-41B5-9F92-01F88A38DC0D}\1.0\HELPDIR

C:\PROGRAMFILER\FSUPPORT\NOTIFIER.EXE

Adware.Surf Accuracy

HKLM\Software\SAcc

HKLM\Software\SAcc#accid

HKLM\Software\SAcc#subaccid

HKLM\Software\SAcc#Version

HKLM\Software\SAcc#InstallDate

HKLM\Software\SAcc#DbgInfo

HKLM\Software\SAcc#srecovery

HKLM\Software\SAcc#CfgReloadAttempts

HKLM\Software\SAcc#CfgReload

HKLM\Software\SAcc#SAData

HKLM\Software\SAcc#Counter

HKLM\Software\SAcc#NextInvoke

HKLM\Software\SAcc#PopupFail

Trojan.WinAntiSpyware/WinAntiVirus 2006

C:\WINDOWS\system32\stera.job

Adware.IST/ISTBar (Slotch Bar)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Main#BandRest

Adware.Tracking Cookie

C:\Documents and Settings\Markus\Cookies\markus@belnk[1].txt

C:\Documents and Settings\Markus\Cookies\markus@surfaccuracy[2].txt

C:\Documents and Settings\Markus\Cookies\[email protected][2].txt

C:\Documents and Settings\Markus\Cookies\[email protected][1].txt

C:\Documents and Settings\Markus\Cookies\[email protected][2].txt

C:\Documents and Settings\Markus\Cookies\[email protected][1].txt

C:\Documents and Settings\Markus\Cookies\[email protected][2].txt

C:\Documents and Settings\Markus\Cookies\[email protected][1].txt

C:\Documents and Settings\Markus\Cookies\markus@revsci[1].txt

C:\Documents and Settings\Markus\Cookies\markus@warlog[1].txt

C:\Documents and Settings\Markus\Cookies\[email protected][1].txt

C:\Documents and Settings\Markus\Cookies\[email protected][3].txt

C:\Documents and Settings\Markus\Cookies\[email protected][2].txt

C:\Documents and Settings\Markus\Cookies\[email protected][1].txt

C:\Documents and Settings\Markus\Cookies\[email protected][2].txt

C:\Documents and Settings\Markus\Cookies\[email protected][1].txt

C:\Documents and Settings\AndyPandy\Cookies\andypandy@revsci[2].txt

C:\Documents and Settings\AndyPandy\Cookies\andypandy@surfaccuracy[2].txt