Trojan Horse Problem

[JohnnyR]

For en dag siden så fikk jeg et virus, som heter "Trojan Horse". Og det viser seg å være et virus som norton ikke greier å fjerne.

Jeg har kjørt flere fulle systemsøk om og om igjen, men bare for å finne ut noe jeg har visst lenge, at norton ikke greier å fjerne det !

Det er ikke blitt sagt noe om den eksakte plasseringen så manuell fjerning er dessverre ikke en mulighet.

 

(PS: Gjerne litt dypere info. om hvordan jeg fjerner viruset i sikkerhetsmodus)

 

Visst noen har noen som helst anelse om hva jeg kunne ha gjort for å få fjernet det, si ifra !

 

Mvh JohnnyR

Endret 9. juli 2007 av JohnnyR

[Kontorstol]

Last ned HijackThis og legg ut en logg

[JohnnyR]

Last ned HijackThis og legg ut en logg

9037926[/snapback]

 

Hvor får jeg lastet ned HijackThis da ?

[JohnnyR]

nvm.. fant det..

[Gjest Bruker-95147]

Hva med de andre velkjente metodene, før man går amok ...?

 

Da tenker jeg på manuell fjerning osv...

[JohnnyR]

Hva med de andre velkjente metodene, før man går amok ...?

 

Da tenker jeg på manuell fjerning osv...

9037960[/snapback]

 

 

manuell fjerning ? Tell me in detail, hva jeg skal gjøre. Please..

[.Butthead.]

Går inn der som fila ligger å sletter den selv?? Ikke så vanskelig det..

[medlem-68510]

Bytt antivirus program. Norton/Norman/osv tiltrekker seg bare mere dritt.

[sigjac]

Hva med å prøve noen webbasert virusscannere? Eventuelt laste ned et gratis antivirus?

 

Du kan prøve disse webbaserte:

ESET Online Scanner

Trend Micro HouseCall

 

Hvis du googler på det nøyaktige navnet (W32.virusnavn f.eks) så kan du finne manuelle måter å fjerne viruset/trojanen.

 

Edit: Ellers er jeg enig med Inf3rn090, bytt fra Norton (McAffee anbefales heller ikke).

Endret 9. juli 2007 av sigjac

[Gjest Bruker-95147]

Hva med de andre velkjente metodene, før man går amok ...?

 

Da tenker jeg på manuell fjerning osv...

9037960[/snapback]

 

 

manuell fjerning ? Tell me in detail, hva jeg skal gjøre. Please..

9037968[/snapback]

 

Hvis Norton gir deg plasseringen, så er det bare å prøve å slette svineriet. Sannsynligvis går ikke det. Så da må du restarte, og trykke F8 etter opplastingen av bios. Her får du en meny hvor du kan velge å starte opp i "safemode", eller "sikkermodus". Så går du direkte til filen å fjerner den.

[Znoken]

Hva med de andre velkjente metodene, før man går amok ...?

 

Da tenker jeg på manuell fjerning osv...

9037960[/snapback]

 

Hva mener du med at man går amok hvis man legger ut en Hijackthis logg da...?? Er da en av de beste måtene for og sjekke om man har noe svineri på pc`n da..

 

Mitt råd til trådstarter er og legge ut en hijackthis logg da det er enkelt og greit for andre og sjekke om du er infisert eller ikke.....

Endret 9. juli 2007 av Znoken

[Korka]

Haha! GÅr som regel ikke ant å slette virus da vettu... Ikke manuelt... Til meg så gikk det ikke ant, fordi viruset var ibruk... Og visst det går ant å slette det, så tar det med seg et x antall systemmapper i fallet og

[Howard_]

Haha! GÅr som regel ikke ant å slette virus da vettu... Ikke manuelt... Til meg så gikk det ikke ant, fordi viruset var ibruk... Og visst det går ant å slette det, så tar det med seg et x antall systemmapper i fallet og

9038945[/snapback]

Start windows i sikkermodus, da er ikke viruset i bruk,men det kan komme igjen selv om du sletter det....

 

Sjekk registeret, de kan legge seg på de merkeligste plasser der inne.

[JULINGiKAKE]

Prøv å fjerne viruset i safemode. Når viruset er fjerna, må du slå av systemgjenoppretting ved å høyreklikke min datamaskin, egenskaper.

 

Ellers risikerer du at viruset dukker opp igjen hvis du må tilbake til et tidligere gjenopprettingspunkt

[Zeph]

Denne tråden var feilpostet og er blitt flyttet til riktig kategori.

[JohnnyR]

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 22:34:51, on 09.07.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccProxy.exe

C:\Programfiler\Fellesfiler\Symantec Shared\SNDSrvc.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe

c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe

c:\APPS\Powercinema\Kernel\TV\CLSched.exe

C:\Programfiler\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

C:\Programfiler\CyberLink\Shared Files\CLML_NTService\CLMLService.exe

C:\Programfiler\Fellesfiler\Symantec Shared\DJSNETCN.exe

c:\APPS\HIDSERVICE\HIDSERVICE.exe

C:\Programfiler\Norton Internet Security\Norton AntiVirus\navapsvc.exe

C:\Programfiler\Webroot\Spy Sweeper\SpySweeper.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Programfiler\Java\jre1.5.0_09\bin\jusched.exe

C:\Apps\Powercinema\PCMService.exe

C:\apps\ABoard\ABoard.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe

C:\WINDOWS\system32\Prismsvr.exe

C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe

C:\apps\ABoard\AOSD.exe

C:\WINDOWS\system32\rundll32.exe

C:\Programfiler\Fellesfiler\Ulead Systems\AutoDetector\monitor.exe

C:\Programfiler\Winamp\winampa.exe

C:\Programfiler\Webroot\Spy Sweeper\SpySweeperUI.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\MSN Messenger\MsnMsgr.Exe

C:\Programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\programfiler\steam\steam.exe

C:\Programfiler\Fellesfiler\Symantec Shared\Security Console\NSCSRVCE.EXE

C:\Programfiler\MSN Messenger\usnsvc.exe

C:\Programfiler\Webroot\Spy Sweeper\SSU.EXE

C:\Programfiler\Internet Explorer\iexplore.exe

C:\Programfiler\Ulead Systems\Ulead PhotoImpact 10 ESD\Iedit.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Programfiler\Winamp\winamp.exe

C:\Programfiler\Messenger\msmsgs.exe

C:\Documents and Settings\Gøran\Skrivebord\HijackThis\HiJackThis_v2.exe

 

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\nor.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.5.0_09\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll

O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programfiler\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programfiler\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O2 - BHO: AD Bot - {BCBCEE7B-2001-4971-B991-EB6E81C96CC5} - C:\WINDOWS\system32\adspipe.dll (file missing)

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll

O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programfiler\google\googletoolbar1.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Programfiler\Windows Live Toolbar\msntb.dll

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC

O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [ATIPTA] "C:\ATI Technologies\ATI Control Panel\atiptaxx.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Programfiler\Java\jre1.5.0_09\bin\jusched.exe"

O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"

O4 - HKLM\..\Run: [ACTIVBOARD] c:\apps\ABoard\ABoard.exe

O4 - HKLM\..\Run: [ccApp] "C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [PRISMSVR.EXE] "Prismsvr.exe" /APPLY

O4 - HKLM\..\Run: [TkBellExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] "rundll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [adstart] "C:\WINDOWS\System32\Rundll32.exe" "C:\WINDOWS\system32\adspipe.dll" DllVerify

O4 - HKLM\..\Run: [ulead AutoDetector v2] "C:\Programfiler\Fellesfiler\Ulead Systems\AutoDetector\monitor.exe"

O4 - HKLM\..\Run: [WinampAgent] C:\Programfiler\Winamp\winampa.exe

O4 - HKLM\..\Run: [spySweeper] "C:\Programfiler\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray

O4 - HKLM\..\RunServices: [DJSNetCN] "C:\Programfiler\Fellesfiler\Symantec Shared\DJSNETCN.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [skype] "C:\APPS\SKYPE\PHONE\SKYPE.EXE" /nosplash /minimized

O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [swg] C:\Programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [steam] "c:\programfiler\steam\steam.exe" -silent

O4 - HKCU\..\Run: [bitDownload] "C:\Programfiler\BitDownload\BitDownload.exe" /minimized

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Xfire.lnk = C:\Programfiler\Xfire\Xfire.exe

O4 - Global Startup: Hurtigstart for Adobe Reader.lnk = C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: &Windows Live Search - res://C:\Programfiler\Windows Live Toolbar\msntb.dll/search.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_09\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_09\bin\ssv.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\nor.htm

O15 - Trusted Zone: http://click.getmirar.com (HKLM)

O15 - Trusted Zone: http://click.mirarsearch.com (HKLM)

O15 - Trusted Zone: http://redirect.mirarsearch.com (HKLM)

O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)

O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://locator1.cdn.imagesrvr.com/sites/er...eInstall_no.cab

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Automatisk LiveUpdate-planlegging - Symantec Corporation - C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Programfiler\Norton Internet Security\ccPwdSvc.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe

O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programfiler\Norton Internet Security\comHost.exe

O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Programfiler\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe

O23 - Service: Symantec Licensing Detect Internet Connection (DJSNETCN) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\DJSNETCN.exe

O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: Norton AntiVirus Auto-Protect-tjeneste (navapsvc) - Symantec Corporation - C:\Programfiler\Norton Internet Security\Norton AntiVirus\navapsvc.exe

O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\Security Console\NSCSRVCE.EXE

O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Programfiler\Norton Internet Security\Norton AntiVirus\SAVScan.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Programfiler\Webroot\Spy Sweeper\SpySweeper.exe

O24 - Desktop Component 0: (no name) - http://www.crackedanimations.com/portfolio...animthumb02.jpg

 

--

End of file - 11774 bytes

 

 

 

 

 

 

 

Hijackthis logg

Endret 9. juli 2007 av JohnnyR

[JohnnyR]

"G›ran" - 2007-07-09 22:36:44 - ComboFix 07-07-10.1 - Service Pack 2

 

 

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

 

 

C:\WINDOWS\system32\packet.dll

 

 

((((((((((((((((((((((((( Files Created from 2007-06-09 to 2007-07-09 )))))))))))))))))))))))))))))))

 

 

2007-07-09 22:35 51,200 --a------ C:\WINDOWS\nircmd.exe

2007-07-09 22:02 786,432 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT

2007-07-09 22:02 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Siste

2007-07-09 22:02 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Programdata

2007-07-09 22:02 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Start-meny

2007-07-09 22:02 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Skrivebord

2007-07-09 22:02 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Mine dokumenter

2007-07-09 22:02 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Favoritter

2007-07-09 22:02 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Skrivere

2007-07-09 22:02 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Maler

2007-07-09 22:02 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Lokale innstillinger

2007-07-09 22:02 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\AndrMask

2007-07-09 22:02 <DIR> d-------- C:\DOCUME~1\NETWOR~1\PROGRA~1\Webroot

2007-07-09 22:02 <DIR> d-------- C:\DOCUME~1\ADMINI~1\PROGRA~1\Symantec

2007-07-09 22:02 <DIR> d-------- C:\DOCUME~1\ADMINI~1\PROGRA~1\Real

2007-07-09 13:10 23,864 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys

2007-07-09 13:10 21,816 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys

2007-07-09 13:10 20,280 --a------ C:\WINDOWS\system32\drivers\SSFS0BB8.sys

2007-07-09 13:10 164 --a------ C:\install.dat

2007-07-09 13:10 160,056 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys

2007-07-09 13:10 1,520,952 --a------ C:\WINDOWS\WRSetup.dll

2007-07-09 13:10 <DIR> d-------- C:\Programfiler\Webroot

2007-07-09 13:10 <DIR> d-------- C:\DOCUME~1\LOCALS~1\PROGRA~1\Webroot

2007-07-09 13:10 <DIR> d-------- C:\DOCUME~1\GRAN~1\PROGRA~1\Webroot

2007-07-09 13:10 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\PROGRA~1\Webroot

2007-06-29 20:27 162,432 --a------ C:\WINDOWS\system32\drivers\ithsgt.sys

2007-06-29 20:27 12,032 --a------ C:\WINDOWS\system32\drivers\lilsgt.sys

2007-06-29 20:21 <DIR> d-------- C:\Programfiler\Atari

2007-06-29 20:15 <DIR> d-------- C:\Programfiler\id Software

2007-06-29 20:12 <DIR> d--hs---- C:\WINDOWS\ftpcache

2007-06-28 02:27 <DIR> d---s---- C:\Programfiler\Xfire

2007-06-28 02:27 <DIR> d-------- C:\Programfiler\GameSpy Arcade

2007-06-28 02:27 <DIR> d-------- C:\DOCUME~1\GRAN~1\PROGRA~1\Xfire

 

 

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

 

2007-07-09 20:09:44 -------- d-----w C:\DOCUME~1\GRAN~1\PROGRA~1\BitDownload

2007-07-09 20:08:13 -------- d-----w C:\Programfiler\BitDownload

2007-07-09 20:07:25 -------- d-----w C:\Programfiler\Steam

2007-07-09 16:04:01 -------- d-----w C:\DOCUME~1\GRAN~1\PROGRA~1\OpenOffice.org2

2007-07-09 11:15:31 -------- d-----w C:\Programfiler\Fellesfiler\Symantec Shared

2007-07-03 20:28:18 -------- d-----w C:\Programfiler\Norton Internet Security

2007-06-29 20:45:48 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys

2007-06-29 18:19:14 -------- d--h--w C:\Programfiler\InstallShield Installation Information

2007-06-09 23:38:57 -------- d-----w C:\Programfiler\Windows Live Toolbar

2007-05-19 14:34:54 60,516 ----a-w C:\WINDOWS\system32\perfc014.dat

2007-05-19 14:34:54 385,092 ----a-w C:\WINDOWS\system32\perfh014.dat

2007-05-16 15:19:43 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll

2007-05-12 22:14:00 -------- d-----w C:\Programfiler\Postal 2 Demo

2007-05-12 18:53:13 -------- d-----w C:\Programfiler\Bethesda Softworks

2007-05-12 01:06:03 -------- d-----w C:\Programfiler\Winamp

2007-05-12 00:36:54 -------- d-----w C:\DOCUME~1\GRAN~1\PROGRA~1\MusicIP

2007-05-10 20:32:21 -------- d-----w C:\Programfiler\Microsoft CAPICOM 2.1.0.2

2007-04-25 14:23:31 144,896 ----a-w C:\WINDOWS\system32\schannel.dll

2007-04-18 16:15:14 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll

2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll

2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll

2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll

2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll

2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll

2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll

2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe

2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll

2007-04-16 20:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll

2007-04-16 20:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll

 

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

 

 

*Note* empty entries & legit default entries are not shown

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]

2005-09-23 21:12 63136 --a------ C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]

2006-10-12 03:25 434279 --a------ C:\Programfiler\Java\jre1.5.0_09\bin\ssv.dll

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]

2006-07-07 12:29 324416 --a------ C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9ECB9560-04F9-4bbc-943D-298DDF1699E1}]

2005-11-01 09:38 94336 --a------ C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8F38D8D-E480-4D52-B7A2-731BB6995FDD}]

2006-12-05 10:47 140888 --a------ C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]

2006-10-12 11:38 2108480 -ra------ c:\programfiler\google\googletoolbar1.dll

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]

2007-06-24 15:47 325048 --a------ C:\Programfiler\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BCBCEE7B-2001-4971-B991-EB6E81C96CC5}]

C:\WINDOWS\system32\adspipe.dll

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]

2007-02-12 15:56 546672 --a------ C:\Programfiler\Windows Live Toolbar\msntb.dll

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMan"="SOUNDMAN.EXE" [2005-05-17 18:48 C:\WINDOWS\SOUNDMAN.EXE]

"ATIPTA"="C:\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-22 21:05]

"SunJavaUpdateSched"="C:\Programfiler\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 03:10]

"PCMService"="c:\Apps\Powercinema\PCMService.exe" [2005-01-28 11:10]

"ACTIVBOARD"="c:\apps\ABoard\ABoard.exe" [2003-05-02 11:31]

"ccApp"="C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe" [2006-12-18 14:40]

"PRISMSVR.EXE"="Prismsvr.exe" [2004-03-04 14:40 C:\WINDOWS\system32\PRISMSVR.exe]

"TkBellExe"="C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" [2006-10-10 14:58]

"BluetoothAuthenticationAgent"="rundll32.exe" [2004-08-04 14:00 C:\WINDOWS\system32\rundll32.exe]

"Ulead AutoDetector v2"="C:\Programfiler\Fellesfiler\Ulead Systems\AutoDetector\monitor.exe" [2004-08-27 19:22]

"WinampAgent"="C:\Programfiler\Winamp\winampa.exe" [2007-04-25 17:44]

"SpySweeper"="C:\Programfiler\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-06-21 18:57]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00]

"Skype"="C:\APPS\SKYPE\PHONE\SKYPE.exe" [2005-04-19 16:14]

"MsnMsgr"="C:\Programfiler\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]

"swg"="C:\Programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-24 15:47]

"Steam"="c:\programfiler\steam\steam.exe" [2007-06-28 01:38]

"BitDownload"="C:\Programfiler\BitDownload\BitDownload.exe" [2007-04-04 15:18]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]

"DJSNetCN"="C:\Programfiler\Fellesfiler\Symantec Shared\DJSNETCN.exe"

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\WebrootSpySweeperService]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs BthServ

 

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{178246a5-d32a-11db-9aa8-0010a72afeb0}]

AutoRun\command- F:\Installer.exe

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ea4b22b6-a8c7-11db-9a76-0013d38ba19e}]

AutoRun\command- F:\wd_windows_tools\setup.exe

 

*Newly Created Service* - COMHOST

 

Contents of the 'Scheduled Tasks' folder

2007-07-09 17:30:00 C:\WINDOWS\tasks\Konfigurere PCen.job

2007-05-13 19:53:35 C:\WINDOWS\tasks\Norton AntiVirus - Kjør fullstendig systemsøk - Gøran.job

2007-07-06 18:00:00 C:\WINDOWS\tasks\Norton AntiVirus - Kjør fullstendig systemsøk - Unn Marit.job

2006-10-10 13:22:57 C:\WINDOWS\tasks\Registreringspåminnelse 3.job

2007-07-09 19:41:00 C:\WINDOWS\tasks\Se etter oppdateringer for Windows Live Toolbar.job

 

**************************************************************************

 

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net

Rootkit scan 2007-07-09 22:39:15

Windows 5.1.2600 Service Pack 2 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

 

Completion time: 2007-07-09 22:39:36

C:\ComboFix-quarantined-files.txt ... 2007-07-09 22:39

 

--- E O F ---

 

 

 

 

 

ComboFix logg

[norbat]

Start HJT, velg "Do a system scan only", sett merke framfor følgende linjer og klikk 'Fix checked':

 

O2 - BHO: AD Bot - {BCBCEE7B-2001-4971-B991-EB6E81C96CC5} - C:\WINDOWS\system32\adspipe.dll (file missing)

O4 - HKLM\..\Run: [adstart] "C:\WINDOWS\System32\Rundll32.exe" "C:\WINDOWS\system32\adspipe.dll" DllVerify

O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://locator1.cdn.imagesrvr.com/sites/er...eInstall_no.cab

 

Last ned Killbox

 

Start Killbox

Velg å 'Delete on reboot'

 

Følgende skal settes inn:

C:\WINDOWS\system32\adspipe.dll (mulig fila ikke finnes)

 

Restart

 

Last ned SAS, installer, oppdater og kjør en full (Complete) scan.

 

Post ny HJT-logg + loggen fra SAS (Preferences->statistics/logs)

[JohnnyR]

Start HJT, velg "Do a system scan only", sett merke framfor følgende linjer og klikk 'Fix checked':

 

O2 - BHO: AD Bot - {BCBCEE7B-2001-4971-B991-EB6E81C96CC5} - C:\WINDOWS\system32\adspipe.dll (file missing)

O4 - HKLM\..\Run: [adstart] "C:\WINDOWS\System32\Rundll32.exe" "C:\WINDOWS\system32\adspipe.dll" DllVerify

O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://locator1.cdn.imagesrvr.com/sites/er...eInstall_no.cab

 

Last ned Killbox

 

Start Killbox

Velg å 'Delete on reboot'

 

Følgende skal settes inn:

C:\WINDOWS\system32\adspipe.dll (mulig fila ikke finnes)

 

Restart

 

Last ned SAS, installer, oppdater og kjør en full (Complete) scan.

 

Post ny HJT-logg + loggen fra SAS (Preferences->statistics/logs)

9040469[/snapback]

 

Finner ikke denne: O4 - HKLM\..\Run: [adstart] "C:\WINDOWS\System32\Rundll32.exe" "C:\WINDOWS\system32\adspipe.dll" DllVerify

 

Så jeg kan heller ikke merke den ?

[norbat]

Kjør bare gjennom resten av veiledningen