har fått virus...tør jeg restarte?

killmeister · 18. november 2006

Jeg presterte å kjøre noe som hette perfect kodec. Denne var tydeligvis himla usunn....

Har fått startsiden endret og noen nye symboler på verktøylinja. har kjørt SAS,Adware,spyboot og norton 2006. alle fant litt forskjellig rart. Windows defender fant ingen ting.

Hva bør jeg gjøre nå??

Takker for svar.

har HJT både før og etter "henelsen" si ifra om dere trenger den:-)

Når jeg trykker på det ene symbolet på verktøylinja kommer jeg hit http://www.pesttrap.com/?advid=177

Endret 18. november 2006 av killmeister

norbat · 18. november 2006

Post en ny HJT-logg

killmeister · 18. november 2006

Post en ny HJT-logg

7312546[/snapback]

Logfile of HijackThis v1.99.1

Scan saved at 00:02:15, on 19.11.2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

C:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Programfiler\Fellesfiler\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Programfiler\Norton AntiVirus\navapsvc.exe

C:\Programfiler\Java\jre1.5.0_06\bin\jusched.exe

C:\windows\system\hpsysdrv.exe

C:\HP\KBD\KBD.EXE

C:\Programfiler\Fellesfiler\InterVideo\SchSvr\SchSvr.exe

C:\Programfiler\InterVideo\Common\Bin\WinRemote.exe

C:\WINDOWS\System32\keyhook.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe

C:\WINDOWS\system32\CTHELPER.EXE

C:\Programfiler\D-Tools\daemon.exe

C:\Programfiler\ATI Technologies\ATI.ACE\cli.exe

C:\Programfiler\SlySoft\AnyDVD\AnyDVD.exe

C:\Programfiler\Macrogaming\SweetIM\SweetIM.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\Norton AntiVirus\IWP\NPFMntor.exe

C:\Programfiler\HP\Digital Imaging\bin\hpqtra08.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\HP\Digital Imaging\bin\hpohmr08.exe

C:\Programfiler\HP\Digital Imaging\bin\hpotdd01.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\Programfiler\No-IP\DUC20.exe

C:\Programfiler\Telenor Sikker Lagring\safestorage.exe

C:\Programfiler\HP\Digital Imaging\bin\hpoevm08.exe

C:\Programfiler\HP\Digital Imaging\Bin\hpoSTS08.exe

C:\Programfiler\ATI Technologies\ATI.ACE\cli.exe

C:\Programfiler\Fellesfiler\Symantec Shared\Security Console\NSCSRVCE.EXE

C:\WINDOWS\System32\msiexec.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Programfiler\Windows Defender\MsMpEng.exe

C:\Programfiler\Windows Defender\MSASCui.exe

C:\Programfiler\Internet Explorer\iexplore.exe

C:\Programfiler\WinRAR\WinRAR.exe

C:\Programfiler\Messenger\msmsgs.exe

C:\DOCUME~1\HP_Eier\LOKALE~1\Temp\Rar$EX01.328\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&t...lion&pf=desktop

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&t...lion&pf=desktop

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&t...lion&pf=desktop

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.online.no/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&t...lion&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&t...lion&pf=desktop

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&t...lion&pf=desktop

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Programfiler\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: HP-visning - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Programfiler\HP\Digital Imaging\bin\HPDTLK02.dll

O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Programfiler\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Protection Bar - {74a49269-9779-48b4-a0e6-3a5af2a3ade6} - C:\Programfiler\Perfect Codec\iesplugin.dll (file missing)

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Programfiler\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE

O4 - HKLM\..\Run: [Home Theater SchSvr] C:\Programfiler\Fellesfiler\InterVideo\SchSvr\SchSvr.exe

O4 - HKLM\..\Run: [WINREMOTE] C:\Programfiler\InterVideo\Common\Bin\WinRemote.exe

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [siS Windows KeyHook] C:\WINDOWS\System32\keyhook.exe

O4 - HKLM\..\Run: [ccApp] "C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE

O4 - HKLM\..\Run: [ATIPTA] "C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe"

O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Programfiler\D-Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [ATICCC] "C:\Programfiler\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay

O4 - HKLM\..\Run: [AnyDVD] C:\Programfiler\SlySoft\AnyDVD\AnyDVD.exe

O4 - HKLM\..\Run: [sweetIM] C:\Programfiler\Macrogaming\SweetIM\SweetIM.exe

O4 - HKLM\..\Run: [Windows Defender] "C:\Programfiler\Windows Defender\MSASCui.exe" -hide

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Startup: No-IP DUC.lnk = C:\Programfiler\No-IP\DUC20.exe

O4 - Startup: Telenor Sikker Lagring.lnk = C:\Programfiler\Telenor Sikker Lagring\safestorage.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programfiler\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: hp psc 1000 series.lnk = ?

O4 - Global Startup: hpoddt01.exe.lnk = ?

O4 - Global Startup: Hurtigstart for Adobe Reader.lnk = C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1139616914671

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O16 - DPF: {DEB21AD3-FDA4-42F6-B57D-EE696A675EE8} (IP-Uploader Control) - http://asp08.photoprintit.de/microsite/502...geUploader3.cab

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: !SASWinLogon - C:\Programfiler\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Programfiler\Norton AntiVirus\navapsvc.exe

O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Programfiler\Norton AntiVirus\IWP\NPFMntor.exe

O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\Security Console\NSCSRVCE.EXE

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Programfiler\Norton AntiVirus\SAVScan.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\SNDSrvc.exe

O23 - Service: SPBBCSvc - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\Security Center\SymWSC.exe

norbat · 18. november 2006

Avinstaller Macrogaming fra legg til/fjern programmer

Kjør HJT og fjern:

O3 - Toolbar: Protection Bar - {74a49269-9779-48b4-a0e6-3a5af2a3ade6} - C:\Programfiler\Perfect Codec\iesplugin.dll (file missing)

O4 - HKLM\..\Run: [sweetIM] C:\Programfiler\Macrogaming\SweetIM\SweetIM.exe

O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)

Fra utforsker, fjern mappene (i bold):

C:\Programfiler\Macrogaming

C:\Programfiler\Perfect Codec

Last ned CCleaner og kjør rens samt noen ganger med 'saker'

Restart og legg ut en ny HTJ

Du kan godt legge ut loggen fra Superantispyware (SAS). Du finner den under Preferences -> Statistics/logs

killmeister · 19. november 2006

SUPERAntiSpyware Scan Log

Generated 11/10/2006 at 00:05 AM

Application Version : 3.3.1020

Core Rules Database Version : 3125

Trace Rules Database Version: 1145

Scan type : Quick Scan

Total Scan Time : 00:10:31

Memory items scanned : 701

Memory threats detected : 0

Registry items scanned : 1028

Registry threats detected : 2

File items scanned : 17170

File threats detected : 19

Adware.Tracking Cookie

C:\Documents and Settings\HP_Eier\Cookies\[email protected][2].txt

C:\Documents and Settings\HP_Eier\Cookies\hp_eier@mediaplex[1].txt

C:\Documents and Settings\HP_Eier\Cookies\hp_eier@revsci[2].txt

C:\Documents and Settings\HP_Eier\Cookies\hp_eier@advertising[2].txt

C:\Documents and Settings\HP_Eier\Cookies\hp_eier@cgi-bin[2].txt

C:\Documents and Settings\HP_Eier\Cookies\[email protected][1].txt

C:\Documents and Settings\HP_Eier\Cookies\hp_eier@tribalfusion[1].txt

C:\Documents and Settings\HP_Eier\Cookies\hp_eier@atdmt[2].txt

C:\Documents and Settings\HP_Eier\Cookies\[email protected][1].txt

C:\Documents and Settings\HP_Eier\Cookies\hp_eier@doubleclick[1].txt

C:\Documents and Settings\HP_Eier\Cookies\hp_eier@tradedoubler[1].txt

Registry Cleaner Trial

HKU\S-1-5-21-2208590475-1158305528-1481939610-1007\Software\Registry Cleaner

HKU\S-1-5-21-2208590475-1158305528-1481939610-1007\Software\SoftwareOnline.com

C:\Documents and Settings\HP_Eier\Programdata\Registry Cleaner\Backups\2006-09-17,16-24 30 421.zip

C:\Documents and Settings\HP_Eier\Programdata\Registry Cleaner\Backups\2006-09-17,16-25 14 875.zip

C:\Documents and Settings\HP_Eier\Programdata\Registry Cleaner\Backups

C:\Documents and Settings\HP_Eier\Programdata\Registry Cleaner\Regclean.ini

C:\Documents and Settings\HP_Eier\Programdata\Registry Cleaner

Trojan.NewDotNet

C:\WINDOWS\NDNUNINSTALL6_38.EXE

C:\WINDOWS\NDNUNINSTALL7_22.EXE

Logfile of HijackThis v1.99.1

Scan saved at 01:31:51, on 19.11.2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

C:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Programfiler\Fellesfiler\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Programfiler\Norton AntiVirus\navapsvc.exe

C:\Programfiler\Java\jre1.5.0_06\bin\jusched.exe

C:\windows\system\hpsysdrv.exe

C:\HP\KBD\KBD.EXE

C:\Programfiler\Fellesfiler\InterVideo\SchSvr\SchSvr.exe

C:\Programfiler\InterVideo\Common\Bin\WinRemote.exe

C:\WINDOWS\System32\keyhook.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe

C:\WINDOWS\system32\CTHELPER.EXE

C:\Programfiler\D-Tools\daemon.exe

C:\Programfiler\ATI Technologies\ATI.ACE\cli.exe

C:\Programfiler\SlySoft\AnyDVD\AnyDVD.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\Norton AntiVirus\IWP\NPFMntor.exe

C:\Programfiler\HP\Digital Imaging\bin\hpqtra08.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\HP\Digital Imaging\bin\hpohmr08.exe

C:\Programfiler\HP\Digital Imaging\bin\hpotdd01.exe

C:\WINDOWS\System32\MsPMSPSv.exe

C:\Programfiler\No-IP\DUC20.exe

C:\Programfiler\Telenor Sikker Lagring\safestorage.exe

C:\Programfiler\HP\Digital Imaging\bin\hpoevm08.exe

C:\Programfiler\HP\Digital Imaging\Bin\hpoSTS08.exe

C:\Programfiler\ATI Technologies\ATI.ACE\cli.exe

C:\Programfiler\Fellesfiler\Symantec Shared\Security Console\NSCSRVCE.EXE

C:\Programfiler\Windows Defender\MsMpEng.exe

C:\Programfiler\Windows Defender\MSASCui.exe

C:\Programfiler\Internet Explorer\iexplore.exe

C:\Programfiler\WinRAR\WinRAR.exe

C:\DOCUME~1\HP_Eier\LOKALE~1\Temp\Rar$EX00.781\HijackThis.exe