LØST - malware/spyware/trojan - hjelp?

strupen · 18. juni 2007

God dag!

Har et lite problem. I går, da jeg satt med maskinen, fikk jeg plutselig opp et vindu (IE) der det stod at jeg kunne laste ned anitivirus program o.l. Brydde meg ikke om det, siden jeg har det som trengs, håper jeg. Jeg krysset meg ut av vinduet, og med en gang kom det opp en advarsel nede i høyre hjørne:

System Alert: Malware threats

Your computer is infected with a back door Trojan what allowa the remote attacker to perform various malicious actions. Click this baloon to download malware removal software.

Av og til for jeg opp en boks der det står:

Critical System Warning!

Your system is probably infected with latest version of Spyware.CyberLog-X.

Type: Spyware

Infection Lenght: 266,129 bytes

Risk: High

System Affected: Windows 95, 98, 2000, NT, 2003 Server, Windows XP

Behavior: Spyware.CyberLog-X is a spyware program that monitors user

activity, logs keystrokes, and tracks Web sites visited.

Symptoms: Low Internet connection speed

Low System Performance

Security center alerts

Strange pop up windows

Protection: Clock OK to download anitspyware software

Får som det står i "Symptoms" lenger oppe, pop-ups og security center alerts. De andre har jeg ikke merket noe til. I frykt av å få mer virus, har jeg ikke prøvd å laste ned noe, som meldingene sier jeg kan/bør. Foresten: har fått en ny toolbar fra ingenplass på IE som heter Security Toolbar 7.1. Har prøvd å uinstallere Internet Explorer Secure Bar, men da kommer det bare en error, og maskinen restarter.

Vet ikke hva mer å si.. Har ESET NOD32 og Lavasoft AD-aware SE Personal. Ingen av de har funnet noe virus e.l. når jeg søkte. Har hatt det siden i går - som sagt - , og er allerede jævlig lei! Har dere noen tips om hva jeg kan gjøre? Bør fjerne de fort før maskina er knust :innocent:

Takker for alle svar på forhånd(viss de er til noen hjelp da, hehe)

Endret 19. juni 2007 av strupen

kvase · 18. juni 2007

det er bare for å lure deg til å innstalere et dritt program dette skjer på enkelte nett sider.vet at tidligere hadde java programet som stort sett er instalert på de fleste pc et problem rundt dette med pop ups med slike falske meldinger på netsider som er lit på kanten av trygge sider.

strupen · 18. juni 2007

det er bare for å lure deg til å innstalere et dritt program dette skjer på enkelte nett sider.vet at tidligere hadde java programet som stort sett er instalert på de fleste pc et problem rundt dette med pop ups med slike falske meldinger på netsider som er lit på kanten av trygge sider.

8889431[/snapback]

Ja, tenkt det. Så derfor lurer jeg på om det går ann å få de vekk? MÅ gå ann...

Alastor · 18. juni 2007

Flyttes til antivirus og datasikkerhet .

mkentoe · 18. juni 2007

[Kjør housecall. fjerner det meste. http://housecall.trendmicro.com/

strupen · 18. juni 2007

[Kjør housecall. fjerner det meste. http://housecall.trendmicro.com/

8889486[/snapback]

skal prøve

norbat · 18. juni 2007

Når du er ferdig med Housecall, laster du ned Hijackthis. Legg det i en egen mappe på skrivebordet.

Start programmet, velg "Do a system scan and save a logfile". Loggfilen kopierer du og poster her inne.

strupen · 18. juni 2007

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 23:59:22, on 18.06.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

Klikk for å se/fjerne innholdet nedenfor

Running processes:

C:\WINDOWS.0\System32\smss.exe

C:\WINDOWS.0\system32\winlogon.exe

C:\WINDOWS.0\system32\services.exe

C:\WINDOWS.0\system32\lsass.exe

C:\WINDOWS.0\system32\svchost.exe

C:\WINDOWS.0\System32\svchost.exe

C:\Programfiler\TGTSoft\StyleXP\StyleXPService.exe

C:\WINDOWS.0\system32\spoolsv.exe

C:\Programfiler\Eset\nod32krn.exe

C:\WINDOWS.0\System32\nvsvc32.exe

C:\WINDOWS.0\System32\svchost.exe

C:\WINDOWS.0\Explorer.EXE

C:\WINDOWS.0\system32\RunDLL32.exe

C:\Programfiler\Creative\Shared Files\CAMTRAY.EXE

C:\Programfiler\Microsoft Office\Office12\GrooveMonitor.exe

C:\Programfiler\Eset\nod32kui.exe

C:\WINDOWS.0\system32\ctfmon.exe

C:\Programfiler\DAEMON Tools\daemon.exe

C:\Programfiler\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe

C:\Programfiler\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe

C:\Programfiler\MSN Messenger\usnsvc.exe

C:\WINDOWS.0\system32\inetsrv\inetinfo.exe

C:\WINDOWS.0\system32\rundll32.exe

C:\Programfiler\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Per\Skrivebord\HiJackThis\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.no/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.5.0_08\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: TGTSoft Explorer Toolbar Changer - {C333CF63-767F-4831-94AC-E683D962C63C} - C:\Programfiler\TGTSoft\StyleXP\TGT_BHO.dll

O2 - BHO: (no name) - {CDE8EAB9-CEF3-4885-B12F-26960A25C800} - C:\Programfiler\Video ActiveX Access\iesplg.dll (file missing)

O3 - Toolbar: (no name) - {DF4E7A0C-E233-4906-B4C1-A404356541FF} - (no file)

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS.0\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Programfiler\Creative\Shared Files\CAMTRAY.EXE

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS.0\system32\NeroCheck.exe

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Programfiler\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [nod32kui] "C:\Programfiler\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [itype] "C:\Programfiler\Microsoft IntelliType Pro\itype.exe"

O4 - HKLM\..\Run: [intelliPoint] "C:\Programfiler\Microsoft IntelliPoint\ipoint.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [DAEMON Tools] "C:\Programfiler\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Policies\Explorer\Run: [rare] C:\Programfiler\Video ActiveX Access\imsmain.exe

O4 - HKLM\..\Policies\Explorer\Run: [user32.dll] C:\Programfiler\Video ActiveX Access\iesmn.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS.0\System32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS.0\System32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS.0\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS.0\System32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programfiler\Fellesfiler\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: PacificPoker - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - D:\Spel\PACIFI~1\pacificpoker.exe (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Programfiler\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (Installer Class) - http://www.nanoscan.com/as/v1/cabs/ascinstie.cab

O16 - DPF: {5CD4310E-88FB-43C1-BE24-5F3FA9C5C9D1} (KooPlayer Control) - http://www.tvlution.com/KooPlayer.ocx

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1168184807887

O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - http://www.nanoscan.com/cabs/nanoinst.cab

O16 - DPF: {E56347B0-6C2B-4C2E-939F-EE513EAC80BC} (Creative Product Registration ActiveX Control Module) - http://www.creative.com/register/OCXs/CtORWebClientNoMFC.cab

O18 - Protocol: bw+0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw+0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw-0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw-0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw00 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw00s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw10 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw10s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw20 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw20s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw30 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw30s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw40 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw40s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw50 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw50s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw60 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw60s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw70 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw70s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw80 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw80s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw90 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bw90s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwa0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwa0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwb0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwb0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwc0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwc0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwd0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwd0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwe0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwe0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwf0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwf0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O18 - Protocol: bwg0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwg0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwh0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwh0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwi0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwi0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwj0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwj0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwk0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwk0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwl0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwl0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwm0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwm0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwn0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwn0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwo0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwo0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwp0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwp0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwq0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwq0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwr0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwr0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bws0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bws0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwt0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwt0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwu0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwu0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwv0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwv0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bww0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bww0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwx0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwx0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwy0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwy0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwz0 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: bwz0s - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O18 - Protocol: offline-8876480 - {4CB3F3B9-D0B0-49E0-A0AF-DC0190702689} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FELLES~1\Skype\SKYPE4~1.DLL

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS.0\System32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS.0\System32\browseui.dll

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programfiler\Eset\nod32krn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS.0\System32\nvsvc32.exe

O23 - Service: StyleXPService - Unknown owner - C:\Programfiler\TGTSoft\StyleXP\StyleXPService.exe

--

End of file - 19048 bytes

Endret 19. juni 2007 av strupen

norbat · 19. juni 2007

Avinstaller fra legg til/fjern programmer:

Logitech desktop messenger

Kjør HJT, velg "Do a system scan only", sett merke framfor følgende linjer og klikk 'Fix checked':

O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: (no name) - {CDE8EAB9-CEF3-4885-B12F-26960A25C800} - C:\Programfiler\Video ActiveX Access\iesplg.dll (file missing)

O3 - Toolbar: (no name) - {DF4E7A0C-E233-4906-B4C1-A404356541FF} - (no file)

O4 - HKLM\..\Policies\Explorer\Run: [rare] C:\Programfiler\Video ActiveX Access\imsmain.exe

O4 - HKLM\..\Policies\Explorer\Run: [user32.dll] C:\Programfiler\Video ActiveX Access\iesmn.exe

O9 - Extra button: PacificPoker - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - D:\Spel\PACIFI~1\pacificpoker.exe (file missing)

Hent Smitfraudfix, legg det på skrivebordet

Restart i sikker modus (trykk flere ganger på F8 under oppstart, velg sikker modus)

Kjør Smitfraudfix, velg valg 2. Følg instruksen

(Den lager en logg: Vanligvis å finne i C:\rapport.txt)

I normal tilstand lager du en ny HJT-logg som du poster sammen med loggen fra Smitfraudfix.

strupen · 19. juni 2007

SmitFraudFix v2.195

Klikk for å se/fjerne innholdet nedenfor

Scan done at 11:57:33,45, 19.06.2007

Run from C:\Documents and Settings\Per\Skrivebord\SmitfraudFix

OS: Microsoft Windows XP [Versjon 5.1.2600] - Windows_NT

The filesystem type is NTFS

Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix

!Attention, following keys are not inevitably infected!

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

fjernet alle disse da de inneholder kjedelige linker ~Moderator

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\DOCUME~1\ALLUSE~1.0\START-~1\Online Security Guide.url Deleted

C:\DOCUME~1\ALLUSE~1.0\START-~1\Security Troubleshooting.url Deleted

C:\DOCUME~1\Per\FAVORI~1\Online Security Test.url Deleted

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{3A6CDE6C-8B0F-4396-8A67-FE72E3236720}: DhcpNameServer=192.168.2.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{A827AA91-3941-43F6-9B32-F01B2F6C98D5}: DhcpNameServer=192.168.1.1

HKLM\SYSTEM\CS1\Services\Tcpip\..\{3A6CDE6C-8B0F-4396-8A67-FE72E3236720}: DhcpNameServer=192.168.2.1

HKLM\SYSTEM\CS1\Services\Tcpip\..\{A827AA91-3941-43F6-9B32-F01B2F6C98D5}: DhcpNameServer=192.168.1.1

HKLM\SYSTEM\CS3\Services\Tcpip\..\{3A6CDE6C-8B0F-4396-8A67-FE72E3236720}: DhcpNameServer=192.168.2.1

HKLM\SYSTEM\CS3\Services\Tcpip\..\{A827AA91-3941-43F6-9B32-F01B2F6C98D5}: DhcpNameServer=192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System

!Attention, following keys are not inevitably infected!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix

!Attention, following keys are not inevitably infected!

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

HiJackThis

Klikk for å se/fjerne innholdet nedenfor

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 12:06:17, on 19.06.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

Running processes:

C:\WINDOWS.0\System32\smss.exe

C:\WINDOWS.0\system32\winlogon.exe

C:\WINDOWS.0\system32\services.exe

C:\WINDOWS.0\system32\lsass.exe

C:\WINDOWS.0\system32\svchost.exe

C:\WINDOWS.0\System32\svchost.exe

C:\Programfiler\TGTSoft\StyleXP\StyleXPService.exe

C:\WINDOWS.0\system32\spoolsv.exe

C:\WINDOWS.0\system32\inetsrv\inetinfo.exe

C:\Programfiler\Eset\nod32krn.exe

C:\WINDOWS.0\System32\nvsvc32.exe

C:\WINDOWS.0\System32\svchost.exe

C:\WINDOWS.0\Explorer.EXE

C:\WINDOWS.0\system32\RunDLL32.exe

C:\Programfiler\Creative\Shared Files\CAMTRAY.EXE

C:\Programfiler\Microsoft Office\Office12\GrooveMonitor.exe

C:\Programfiler\Eset\nod32kui.exe

C:\Programfiler\Microsoft IntelliType Pro\itype.exe

C:\Programfiler\Microsoft IntelliPoint\ipoint.exe

C:\WINDOWS.0\system32\ctfmon.exe

C:\Programfiler\MSN Messenger\MsnMsgr.Exe

C:\Programfiler\DAEMON Tools\daemon.exe

C:\Programfiler\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe

C:\Programfiler\NETGEAR\WG111v2 Configuration Utility\RtWLan.exe

C:\Programfiler\MSN Messenger\usnsvc.exe

C:\WINDOWS.0\system32\wuauclt.exe

C:\Programfiler\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Per\Skrivebord\HiJackThis\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm