Gå til innhold

Virus etter installasjon av program

voffen

Av voffen
i IKT-drift og sikkerhet

Anbefalte innlegg

voffen

voffen

Skrevet
Skrevet

Installerte DVD shrink og under inst. fant Norton 2 virus/ormer. Trodde alt var OK, men etter en omstart var Norton borte... Prøvde å kjøre Housecall fra TrendMicro men det stoppet opp etter en tids kjøring. Driver nå å kjøre gjennom Kaspary Online Scanner som har funnet 16 "virus" og 15 infected object.

 

Har kjørt HijackThis med følgende resultat:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 21:13:43, on 24.09.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccProxy.exe

C:\Programfiler\Fellesfiler\Symantec Shared\SNDSrvc.exe

C:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\SCardSvr.exe

C:\Programfiler\Fellesfiler\Symantec Shared\DJSNETCN.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\alg.exe

C:\Programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Programfiler\Logitech\SetPoint\SetPoint.exe

C:\Programfiler\Fellesfiler\Logitech\khalshared\KHALMNPR.EXE

C:\Programfiler\Fellesfiler\Symantec Shared\NMAIN.EXE

C:\Programfiler\Internet Explorer\iexplore.exe

C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WLLoginProxy.exe

F:\Programfiler\WinRAR\WinRAR.exe

J:\HiJackThis_v2.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.aftenposten.no/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Programfiler\Macrogaming\SweetIMBarForIE\toolbar.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: SWEETIE Class - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\Programfiler\Macrogaming\SweetIMBarForIE\toolbar.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll

O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programfiler\google\googletoolbar4.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programfiler\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

O2 - BHO: Online Start Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Programfiler\Telenor\Online Start\IEFixItNowPlugin.dll

O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll

O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Programfiler\Macrogaming\SweetIMBarForIE\toolbar.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Programfiler\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programfiler\google\googletoolbar4.dll

O4 - HKLM\..\Run: [NVMixerTray] --"C:\Programfiler\NVIDIA Corporation\NvMixer\NVMixerTray.exe"

O4 - HKLM\..\Run: [ccApp] --"C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [PinnacleDriverCheck] --C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg

O4 - HKLM\..\Run: [sweetIM] --C:\Programfiler\Macrogaming\SweetIM\SweetIM.exe

O4 - HKLM\..\Run: [QuickTime Task] --"C:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [NvCplDaemon] --RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] --nwiz.exe /install

O4 - HKLM\..\Run: [soundMan] --SOUNDMAN.EXE

O4 - HKLM\..\Run: [WINDVDPatch] --CTHELPER.EXE

O4 - HKLM\..\Run: [updReg] --C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [Jet Detection] --F:\Programfiler\PROGRAM\ADGJDet.exe

O4 - HKLM\..\Run: [Telenor Online Start] --"C:\Programfiler\Telenor\Online Start\Telenor.exe"

O4 - HKLM\..\Run: [NvMediaCenter] --RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\RunServices: [DJSNetCN] C:\Programfiler\Fellesfiler\Symantec Shared\DJSNETCN.exe

O4 - HKCU\..\Run: [CTFMON.EXE] --C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [H/PC Connection Agent] --"C:\Programfiler\Microsoft ActiveSync\Wcescomm.exe"

O4 - HKCU\..\Run: [LDM] --C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - HKCU\..\Run: [swg] C:\Programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Gamma Loader.lnk = ?

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - Global Startup: Logitech SetPoint.lnk = ?

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://F:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Programfiler\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Programfiler\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Programfiler\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Programfiler\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll

O9 - Extra 'Tools' menuitem: Opprett mobil favoritt... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll

O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O15 - Trusted Zone: www.sf-anytime.com

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite...vex-2.0.6.0.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Automatisk LiveUpdate-planlegging - Unknown owner - --"C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe" (file missing)

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Programfiler\Norton Internet Security\ccPwdSvc.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programfiler\Norton Internet Security\comHost.exe

O23 - Service: Symantec Licensing Detect Internet Connection (DJSNETCN) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\DJSNETCN.exe

O23 - Service: Google Updater Service (gusvc) - Unknown owner - --"C:\Programfiler\Google\Common\Google Updater\GoogleUpdaterService.exe" (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - --"C:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe" (file missing)

O23 - Service: iPodService - Unknown owner - --C:\Programfiler\iPod\bin\iPodService.exe (file missing)

O23 - Service: LiveUpdate - Unknown owner - --"C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE" (file missing)

O23 - Service: Norton AntiVirus Auto-Protect-tjeneste (navapsvc) - Symantec Corporation - C:\Programfiler\Norton Internet Security\Norton AntiVirus\navapsvc.exe

O23 - Service: NNServ - Unknown owner - --"C:\Programfiler\NewDotNet\nnrun.exe" "C:\Programfiler\NewDotNet\nncore.dll" ServiceStart (file missing)

O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\Security Console\NSCSRVCE.EXE

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Office Source Engine (ose) - Unknown owner - --"C:\Programfiler\Fellesfiler\Microsoft Shared\Source Engine\OSE.EXE" (file missing)

O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Programfiler\Norton Internet Security\Norton AntiVirus\SAVScan.exe

O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - Unknown owner - --C:\Programfiler\Spyware Doctor\svcntaux.exe (file missing)

O23 - Service: Spyware Doctor Service (sdCoreService) - Unknown owner - --C:\Programfiler\Spyware Doctor\swdsvc.exe (file missing)

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: Messenger Sharing Folders USN Journal Reader-tjeneste (usnjsvc) - Unknown owner - --"C:\Programfiler\MSN Messenger\usnsvc.exe" (file missing)

O23 - Service: Windows Media Player Network Sharing Service (WMPNetworkSvc) - Unknown owner - --"C:\Programfiler\Windows Media Player\WMPNetwk.exe" (file missing)

 

--

End of file - 12401 bytes

 

 

Ser det er hjelp å få av dere "virusjegere" der ute ;) så jeg håper noe kan hjelpe meg...

Lenke til kommentar

Videoannonse

Videoannonse
Annonse
voffen

voffen

Skrevet
  • Forfatter
Skrevet
Hent Combofix, og legg det på skrivebordet

 

Kjør combofix.exe, og følg veiledningen.

Du må ikke klikke på vinduet mens programmet kjører.

 

Post loggfilen fra combofix (vanligvis c:\combofix.txt)

9566961[/snapback]

 

CF fant noen filer som ble slettet. Her er loggen:

 

ComboFix 07-09-21.2 - "Vegard" 2007-09-24 22:29:50.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1044.18.1609 [GMT 2:00]

* Created a new restore point

.

 

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

C:\DOCUME~1\Vegard\PROGRA~1\inst.exe

C:\Programfiler\newdotnet

C:\Programfiler\newdotnet\nnrun.exe

C:\Programfiler\newdotnet\readme.html

C:\Programfiler\newdotnet\uninstall.exe

C:\Programfiler\newdotnet\uninstall6_38.exe

C:\WINDOWS\NDNuninstall6_38.exe

C:\WINDOWS\NDNuninstall7_22.exe

C:\WINDOWS\NDNuninstall7_48.exe

 

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

 

 

-------\LEGACY_NNSERV

-------\NNServ

 

 

((((((((((((((((((((((((( Files Created from 2007-08-24 to 2007-09-24 )))))))))))))))))))))))))))))))

.

 

2007-09-24 22:29 51,200 --a------ C:\WINDOWS\NirCmd.exe

2007-09-24 20:17 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab

2007-09-24 20:17 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\PROGRA~1\Kaspersky Lab

2007-09-24 20:09 <DIR> d-------- C:\DOCUME~1\Vegard\PROGRA~1\Vso

2007-09-24 19:11 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys

2007-09-24 19:03 <DIR> d-------- C:\DOCUME~1\Vegard\.housecall6.6

2007-09-24 13:41 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys

2007-09-24 13:41 47,360 --a------ C:\DOCUME~1\Vegard\PROGRA~1\pcouffin.sys

2007-09-24 13:41 <DIR> d-------- C:\Programfiler\DVDFab Platinum 3

2007-09-17 19:22 <DIR> d-------- C:\Programfiler\Telenor

2007-09-17 19:22 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\PROGRA~1\Telenor

2007-09-16 14:29 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\PROGRA~1\Ubisoft

2007-09-15 16:19 <DIR> d-------- C:\DOCUME~1\Vegard\Contacts

2007-09-07 20:44 <DIR> d-------- C:\Programfiler\kellogg

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-09-24 20:08 --------- d-------- C:\DOCUME~1\Vegard\PROGRA~1\Azureus

2007-09-24 14:29 --------- d-------- C:\DOCUME~1\Vegard\PROGRA~1\Canon

2007-09-24 13:43 --------- d-------- C:\Programfiler\Fellesfiler\Symantec Shared

2007-09-24 12:27 --------- d-------- C:\DOCUME~1\ALLUSE~1\PROGRA~1\DVD Shrink

2007-09-22 13:44 --------- d-------- C:\DOCUME~1\Vegard\PROGRA~1\LimeWire

2007-09-21 12:07 --------- d-------- C:\Programfiler\SpeedFan

2007-09-21 11:14 --------- d--h----- C:\Programfiler\InstallShield Installation Information

2007-09-20 09:11 --------- d-------- C:\Programfiler\Norton Internet Security

2007-09-17 14:23 --------- d-------- C:\DOCUME~1\Vegard\PROGRA~1\DVD Profiler

2007-09-15 16:18 --------- d-------- C:\Programfiler\MSN Messenger

2007-09-07 20:43 --------- d-------- C:\Programfiler\Disney Interactive

2007-08-21 00:23 --------- d-a------ C:\DOCUME~1\ALLUSE~1\PROGRA~1\TEMP

2007-08-07 16:28 --------- d-------- C:\Programfiler\POI-Warner GoPal Edition

2007-08-07 14:14 --------- d-------- C:\Programfiler\Microsoft ActiveSync

2007-08-07 14:12 --------- d-------- C:\Programfiler\MUSICMATCH

2007-08-07 13:49 --------- d-------- C:\DOCUME~1\Vegard\PROGRA~1\GoPal Assistant

2007-01-19 21:27:36 1,056 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

 

*Note* empty entries & legit default entries are not shown

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NVMixerTray"="--C:\Programfiler\NVIDIA Corporation\NvMixer\NVMixerTray.exe" []

"ccApp"="--C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe" []

"PinnacleDriverCheck"="--C:\WINDOWS\system32\PSDrvCheck.exe" []

"SweetIM"="--C:\Programfiler\Macrogaming\SweetIM\SweetIM.exe" []

"QuickTime Task"="--C:\Programfiler\QuickTime\qttask.exe" []

"NvCplDaemon"="--C:\WINDOWS\system32\NvCpl.dll" []

"nwiz"="--nwiz.exe" []

"SoundMan"="--SOUNDMAN.EXE" []

"WINDVDPatch"="--CTHELPER.EXE" []

"UpdReg"="--C:\WINDOWS\UpdReg.EXE" []

"Jet Detection"="--F:\Programfiler\PROGRAM\ADGJDet.exe" []

"Telenor Online Start"="--C:\Programfiler\Telenor\Online Start\Telenor.exe" []

"NvMediaCenter"="--C:\WINDOWS\system32\NvMcTray.dll" []

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="--C:\WINDOWS\system32\ctfmon.exe" []

"H/PC Connection Agent"="C:\Programfiler\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 17:56]

"LDM"="--C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" []

"swg"="C:\Programfiler\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-23 18:12]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]

"DJSNetCN"=C:\Programfiler\Fellesfiler\Symantec Shared\DJSNETCN.exe

 

C:\DOCUME~1\ALLUSE~1\START-~1\PROGRA~1\Oppstart\

Adobe Gamma Loader.lnk - C:\Programfiler\Fellesfiler\Adobe\Calibration\Adobe Gamma Loader.exe [2006-02-13 23:30:45]

Logitech Desktop Messenger.lnk - C:\Programfiler\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-02-25 23:29:17]

Logitech SetPoint.lnk - C:\Programfiler\Logitech\SetPoint\SetPoint.exe [2007-01-02 17:22:59]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{93994DE8-8239-4655-B1D1-5F4E91300429}"= C:\PROGRA~1\DVDREG~1\DVDShell.dll [2004-10-09 15:18 49152]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"appinit_dlls"=MsgPlusLoader.dll

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start-meny^Programmer^Oppstart^Hurtigstart for Adobe Reader.lnk]

path=C:\Documents and Settings\All Users\Start-meny\Programmer\Oppstart\Hurtigstart for Adobe Reader.lnk

backup=C:\WINDOWS\pss\Hurtigstart for Adobe Reader.lnkCommon Startup

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start-meny^Programmer^Oppstart^Logitech Harmony Remote Software 7.lnk]

path=C:\Documents and Settings\All Users\Start-meny\Programmer\Oppstart\Logitech Harmony Remote Software 7.lnk

backup=C:\WINDOWS\pss\Logitech Harmony Remote Software 7.lnkCommon Startup

 

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

"C:\Programfiler\Fellesfiler\Ahead\lib\NMBgMonitor.exe"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDElbyCDFL]

"F:\Programfiler\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]

"F:\Programfiler\Elaborate Bytes\CloneCD\CloneCDTray.exe"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox]

C:\Programfiler\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

"C:\Programfiler\iTunes\iTunesHelper.exe"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]

KHALMNPR.EXE

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]

"C:\Documents and Settings\Vegard\Mine dokumenter\Dokumenter\Veronika\Mine dokumenter\MsgPlus.exe"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]

"C:\Programfiler\Musicmatch\Musicmatch Jukebox\mmtask.exe"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]

"C:\Programfiler\Musicmatch\Musicmatch Jukebox\mm_tray.exe"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

C:\WINDOWS\system32\NeroCheck.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\New.net Startup]

rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,ClientStartup -s

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot]

 

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]

f:\Programfiler\PowerISO\PWRISOVM.EXE

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

"C:\Programfiler\QuickTime\qttask.exe" -atboottime

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]

"C:\Programfiler\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

C:\Programfiler\Valve\Steam\\Steam.exe -silent

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

"C:\Programfiler\Java\jre1.5.0_11\bin\jusched.exe"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SweetIM]

C:\Programfiler\Macrogaming\SweetIM\SweetIM.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

C:\Programfiler\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]

F:\Programfiler\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]

%systemroot%\system32\dumprep 0 -u

 

R0 sojubus;sojubus;C:\WINDOWS\system32\DRIVERS\sojubus.sys

R0 sojuscsi;sojuscsi;C:\WINDOWS\system32\DRIVERS\sojuscsi.sys

R1 DCxxMJPG;Pinnacle DC10plus, Motion-JPEG VideoIO Board;C:\WINDOWS\system32\drivers\DCxxMJPG.sys

R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys

R3 cxbu0wdm;CardMan 3x21;C:\WINDOWS\system32\DRIVERS\cxbu0wdm.sys

S2 Automatisk LiveUpdate-planlegging;Automatisk LiveUpdate-planlegging;--"C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe"

S3 ovt519;D-Link VGA Webcam;C:\WINDOWS\system32\Drivers\ov519vid.sys

S3 SE27bus;Sony Ericsson Device 039 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\SE27bus.sys

S3 SE27mdfl;Sony Ericsson Device 039 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\SE27mdfl.sys

S3 SE27mdm;Sony Ericsson Device 039 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\SE27mdm.sys

S3 SE27mgmt;Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\SE27mgmt.sys

S3 se27nd5;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS);C:\WINDOWS\system32\DRIVERS\se27nd5.sys

S3 SE27obex;Sony Ericsson Device 039 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\SE27obex.sys

S3 se27unic;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM);C:\WINDOWS\system32\DRIVERS\se27unic.sys

S3 SUSCOM;Susteen Serial port driver;C:\WINDOWS\system32\DRIVERS\SUSCOM.SYS

 

 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6be1b9c4-f60e-11da-824c-00508def01ed}]

AutoRun\command- O:\setupSNK.exe

 

*Newly Created Service* - COMHOST

.

Contents of the 'Scheduled Tasks' folder

"2007-09-21 18:22:46 C:\WINDOWS\Tasks\Norton AntiVirus - Kjør fullstendig systemsøk - Vegard.job"

"2006-10-26 21:01:31 C:\WINDOWS\Tasks\Norton AntiVirus - Kjør Norton QuickScan - Vegard.job"

.

**************************************************************************

 

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-09-24 22:35:17

Windows 5.1.2600 Service Pack 2 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

Completion time: 2007-09-24 22:36:57 - machine was rebooted

C:\ComboFix-quarantined-files.txt ... 2007-09-24 22:36

.

--- E O F ---

Lenke til kommentar
norbat

norbat

Skrevet
Skrevet

Kopier og lim inn det under (i fet) i notisblokk:

 

Windows Registry Editor Version 5.00

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"appinit_dlls"=-

 

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\New.net Startup]

 

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]

 

Lagre fila som voffen.reg og legg den på skrivebordet.

 

Dobbeltklikk på fila og si ja til å legge til informasjonen.

 

Restart PC-en.

Lenke til kommentar
voffen

voffen

Skrevet
  • Forfatter
Skrevet
Kopier og lim inn det under (i fet) i notisblokk:

 

Windows Registry Editor Version 5.00

   

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] 

"appinit_dlls"=-

   

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\New.net Startup]   

 

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]

 

Lagre fila som voffen.reg  og legg den på skrivebordet.

 

Dobbeltklikk på fila og si ja til å legge til informasjonen.

 

Restart PC-en.

9567520[/snapback]

 

Da var det gjort. Er det flere trinn i "Renvaskelsen"? Vet du hva som er/var feil? Jeg skjønte ikke noe av de logg filene... :confused: Må NIS installeres på nytt?

Lenke til kommentar
voffen

voffen

Skrevet
  • Forfatter
Skrevet
Når du sier at Norton er borte, tenker du da på ikonet i systemfeltet (nede ved klokka) eller er hele programmet borte (sjekk i Alle programmet->Norton...)

 

Husker du hvilke 'Virus/trojanere' Norton fant?

9567798[/snapback]

Med borte mener jeg at det ikke starter ved oppstart og at ikonet er borte. Ligger under Alle prog men vil ikke starte... Det var noe med worm men jeg husker ikke mer. Har også fått et nytt IE ikon på skrivebordet. Hadde bare en snarvei til IE tidligere...

Lenke til kommentar
voffen

voffen

Skrevet
  • Forfatter
Skrevet
Når du sier at Norton er borte, tenker du da på ikonet i systemfeltet (nede ved klokka) eller er hele programmet borte (sjekk i Alle programmer->Norton...)

 

Husker du hvilke 'Virus/trojanere' Norton fant?

9567798[/snapback]

 

NIS lager vel også en logg som blir lagret? Noen som vet hvor?

Lenke til kommentar
norbat

norbat

Skrevet
Skrevet

Ok,

Vil nok tro at du må reinstallere Norton.

Men, det kunne være interessant og sett om ikke en systemgjenoppretting til et tidspunkt før du installerte dette DVD.... løser hele problemet ditt.

 

Tilbehør->systemverktøy->systemgjenoppretting.

 

Velg å gjenopprette til et tidligere tidspunkt og velg en dato før denne DVD...-installasjonen.

Lenke til kommentar
voffen

voffen

Skrevet
  • Forfatter
Skrevet
Ok,

Vil nok tro at du må reinstallere Norton.

Men, det kunne være interessant og sett om ikke en systemgjenoppretting til et tidspunkt før du installerte dette DVD.... løser hele problemet ditt.

 

Tilbehør->systemverktøy->systemgjenoppretting.

 

Velg å gjenopprette til et tidligere tidspunkt og velg en dato før denne DVD...-installasjonen.

9567935[/snapback]

Prøvde det før du kom på banen med dine glimrende forslag :thumbs: men da gikk det ikke. Kan prøve igjen.

Lenke til kommentar
BlueEAGLE

BlueEAGLE

Skrevet
Skrevet
Beklager men det var ikke DVDShrink men DVDFAb

På Siden-Vi-Ikke-Nevner-Med-Navn.... Silly me  :whistle:

9566789[/snapback]

 

Altså du lastet ned et program fra en annen side enn dvdfab.com også fikk du virus av å installere det? Vel, dette burde være en lærepenge for deg.

 

Det er min erfaring at sikkerhetskopiene er hendige å ha i slike situasjoner. Bare installer windows på nytt og hent dataene fra siste sikkerhetskopi. (Du tar vel sikkerhetskopier, gjør du ikke?)

 

Når du henter ned programmer så hent dem fra produsent eller lisensierte leverandører. Da kan du i det minste fall ha en sak om du blir infisert av et virus som leverandøren burde ha sjekket for. Tror ikke en slik sak har blitt prøvd ennå, men jeg mener det er skjødesløst om en leverandør leverer et produkt som er infisert med virus eller trojaner (Hvor mange husker plater med DRM beskyttelse som gjorde ting de ikke burde?)

Lenke til kommentar

Opprett en konto eller logg inn for å kommentere

Du må være et medlem for å kunne skrive en kommentar

Opprett konto

Det er enkelt å melde seg inn for å starte en ny konto!

Start en konto

Logg inn

Har du allerede en konto? Logg inn her.

Logg inn nå
Gå til emneliste
×
×
  • Opprett ny...