virus i systemfil... klarer ikke slette

[leifeinar]

har virus inne i windows systemet, antivirus klarer ikke og quarantine, ikke jeg heller. ikke slette heller.

 

noen lure trix? dette viruset har plaga livet av meg i flere dager. virkelig tatt over styringa...

 

som dere ser av bildet er det en programutvidelse installert 7 desember

[norbat]

Fortvil ikke og post en HJT-logg

[Jarmo]

http://www.pestpatrol.com/spywarecenter/pe...px?id=453099952

[leifeinar]

her er en logg...

 

hva i all værden er det du linker til jarmo skjønner ingen ting jeg

 

 

den vil ikke legge til noe... kopierer hele log i ny post...

Endret 11. desember 2006 av leifeinar

[leifeinar]

Logfile of HijackThis v1.99.1

Scan saved at 00:09:25, on 12.12.2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ACS.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Programfiler\TOSHIBA\ConfigFree\CFSvcs.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

C:\Programfiler\Analog Devices\SoundMAX\SMAgent.exe

C:\WINDOWS\system32\igfxtray.exe

C:\Programfiler\Analog Devices\SoundMAX\SMax4PNP.exe

C:\WINDOWS\system32\svchost.exe

C:\Programfiler\Apoint2K\Apoint.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Programfiler\TOSHIBA\TOSHIBA-kontroller\TFncKy.exe

C:\WINDOWS\system32\TFNF5.exe

C:\Programfiler\TOSHIBA\Wireless Hotkey\TosHKCW.exe

C:\Programfiler\TOSHIBA\TME3\TMERzCtl.EXE

C:\Programfiler\TOSHIBA\ConfigFree\NDSTray.exe

C:\Programfiler\TOSHIBA\ConfigFree\CFSServ.exe

C:\Programfiler\TOSHIBA\TME3\Tmesrv31.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

C:\Programfiler\TOSHIBA\TME3\TMEEJME.EXE

C:\WINDOWS\system32\rundll32.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

C:\Programfiler\Trend Micro\Internet Security 2007\pccguide.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

C:\Programfiler\Messenger\msmsgs.exe

C:\WINDOWS\system32\TPSBattM.exe

C:\Programfiler\Apoint2K\Apntex.exe

C:\Programfiler\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe

C:\Programfiler\RALINK\RT2500 Wireless LAN Card\Installer\WINXP\RaConfig2500.exe

C:\Programfiler\TOSHIBA\ConfigFree\CFXFER.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\Programfiler\Mozilla Firefox\firefox.exe

C:\Programfiler\BitLord\BitLord.exe

C:\Documents and Settings\natalia robertsen\Skrivebord\hijackthis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Programfiler\VSAdd-in\VSAdd-in.dll (file missing)

O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [soundMAXPnP] C:\Programfiler\Analog Devices\SoundMAX\SMax4PNP.exe

O4 - HKLM\..\Run: [soundMAX] C:\Programfiler\Analog Devices\SoundMAX\Smax4.exe /tray

O4 - HKLM\..\Run: [Apoint] C:\Programfiler\Apoint2K\Apoint.exe

O4 - HKLM\..\Run: [TouchED] C:\Programfiler\TOSHIBA\TouchED\TouchED.Exe

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [TFncKy] TFncKy.exe

O4 - HKLM\..\Run: [TFNF5] TFNF5.exe

O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Programfiler\TOSHIBA\Wireless Hotkey\TosHKCW.exe"

O4 - HKLM\..\Run: [TPSMain] TPSMain.exe

O4 - HKLM\..\Run: [TPSODDCtl] TPSODDCtl.exe

O4 - HKLM\..\Run: [TMESRV.EXE] C:\Programfiler\TOSHIBA\TME3\TMESRV31.EXE /Logon

O4 - HKLM\..\Run: [TMERzCtl.EXE] C:\Programfiler\TOSHIBA\TME3\TMERzCtl.EXE /Service

O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe

O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S

O4 - HKLM\..\Run: [sruusxm.dll] C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\sruusxm.dll,nsrxhv

O4 - HKLM\..\Run: [pccguide.exe] "C:\Programfiler\Trend Micro\Internet Security 2007\pccguide.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [ares] "C:\Programfiler\Ares\Ares.exe" -h

O4 - HKCU\..\Run: [skype] "C:\Programfiler\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [OE] "C:\Programfiler\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"

O4 - Global Startup: Hurtigstart for Adobe Reader.lnk = C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Programfiler\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Programfiler\RALINK\RT2500 Wireless LAN Card\Installer\WINXP\RaConfig2500.exe

O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/...html?p=ZJfox000

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0\bin\npjpi150.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0\bin\npjpi150.dll

O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)

O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exe

O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Programfiler\TOSHIBA\ConfigFree\CFSvcs.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe

O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programfiler\Analog Devices\SoundMAX\SMAgent.exe

O23 - Service: Tmesrv3 (Tmesrv) - TOSHIBA - C:\Programfiler\TOSHIBA\TME3\Tmesrv31.exe

O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

O23 - Service: Web Update Service by PowerProgrammer (WebUpdate) - Data Perceptions / PowerProgrammer - C:\WINDOWS\system32\WebUpdateSvc.exe

[Jarmo]

hva i all værden er det du linker til jarmo   skjønner ingen ting jeg

7481421[/snapback]

 

Hvis du trykker på de små linkene så finner ut alt om den dritten...

[norbat]

Last ned Vundufix og kjør programmet

 

Last ned CClenaer og kjør noen ganger rens

 

Last ned SAS, installer og oppdater. Kjør en complete scan.

 

Post en ny HJT-logg sammen med loggen fra Vundufix og SAS (preferences->statistics/logs)

 

NB! Forandre navnet Hijackthis.exe til noe annet, eks. test.exe før du kjører programmet.

Endret 11. desember 2006 av norbat

[leifeinar]

sove litt nå...har lasta ned ig satt på scan, poster i morra formidag

[leifeinar]

kjørte vundo...etter scan trykka jeg remove vundo. kjørte restart. maskina starta mye kjappere

[norbat]

Vil gjerne se en ny HJT-logg (NB! Husk å forandre hijackthis.exe til test.exe før du kjører programmet.

[leifeinar]

får ikke sakt hvor glad jeg er for at du hjelper meg

hijackthis.log_2.txt

[norbat]

Dette begynner da å se riktig så pent ut

 

Kjør HJT og fix:

O2 - BHO: (no name) - {26B61245-2471-3859-3126-04487DAC7F8A} - C:\WINDOWS\system32\ipnydgh.dll (file missing)

O2 - BHO: (no name) - {35F7813A-AF74-4474-B1DC-7EE6FB6C43C6} - (no file)

O2 - BHO: (no name) - {f4d74aaa-a178-4463-846b-b4bc87a024e0} - C:\WINDOWS\system32\ixt0.dll (file missing)

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/...html?p=ZJfox000

O20 - Winlogon Notify: winmqx32 - winmqx32.dll (file missing)

 

Kjør en rens med CCleaner

 

Restart og kjør en runde med et oppdatert Trend Micro (antivirusprogrammet ditt)

 

Hvordan kjører pc?

[leifeinar]

super service her

 

jobber i kveld og i morgen tidlig, så så det blir ikke før utpå kvelden i morra. men noe er fjærna for ting funker mye bedre. selv om jeg ikke bruker intenett explorer instalerte jeg IE7 siden det var den som ble mest styrt. mulig det var det og/eller de programmene dine.'

 

 

får ikke takka nokk her veldig taknemmelig for og si det slik. blir så jævlig paranoid når ting tar over maskina

[leifeinar]

fulgte instruksene dine og allt er i orden. takker og bukker