Gå til innhold

Systemet slås av etter 59sek! Hvordan fjerne det?!

Shoo

Av Shoo
i IKT-drift og sikkerhet

Anbefalte innlegg

Shoo

Shoo

Skrevet
Skrevet (endret)

Har helt glemt hvordan jeg fikset dette problemet.

 

Det som skjer, er at det popper opp et vindu som sier: "Systemet må slås av om 59sek. Lagre all arbeid. Ulagret arbeid vil gå tapt..."

 

Alternativet jeg har, er jo Start -> Kjør -> Shutdown, men jeg husker ikke hvordan man fikk fjernet dette.

 

Det har ikke noe med mitt hardware å gjøre (oppgraderte minne nylig til 2GB RAM), men en form for malware/trojan. Har fikset dette før, men som sagt, så husker jeg ikke hvordan.

 

Prøvd også å Google, men finner ikke noen konkrete svar på dette, dessverre.

 

Her er HJT-logg:

 

Klikk for å se/fjerne innholdet nedenfor

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:39:35, on 01.10.2007

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

 

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

F:\Programmer\Ad-Aware SE Professional 1.06\aawservice.exe

D:\WINDOWS\Explorer.EXE

D:\WINDOWS\SOUNDMAN.EXE

D:\Programfiler\Java\jre1.6.0_02\bin\jusched.exe

D:\WINDOWS\System32\RunDLL32.exe

D:\WINDOWS\System32\LVCOMSX.EXE

D:\WINDOWS\system32\spoolsv.exe

F:\Programmer\logitech\LogiTray.exe

D:\WINDOWS\System32\svdhost.exe

D:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe

F:\Programmer\Ad-Aware SE Professional 1.06\AAWTray.exe

D:\WINDOWS\System32\ctfmon.exe

F:\Programmer\logitech\FxSvr2.exe

D:\WINDOWS\System32\nvsvc32.exe

F:\Programmer\Alcohol 120\StarWind\StarWindService.exe

D:\WINDOWS\System32\svchost.exe

F:\Programmer\Ad-Aware SE Professional 1.06\Ad-Watch2007.exe

F:\Programmer\Ad-Aware SE Professional 1.06\Ad-Aware2007.exe

D:\Programfiler\Mozilla Firefox\firefox.exe

F:\Programmer\HJT\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O1 - Hosts: 200.124.131.116 casinocontroller.com

O2 - BHO: Koblingshjelpeprogram for Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programfiler\Java\jre1.6.0_02\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - F:\Programmer\FlashFXP\IEFlash.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} D:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [iMJPMIG8.1] D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "D:\Programfiler\Java\jre1.6.0_02\bin\jusched.exe"

O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [LVCOMSX] D:\WINDOWS\System32\LVCOMSX.EXE

O4 - HKLM\..\Run: [LogitechVideoRepair] F:\Programmer\logitech\ISStart.exe

O4 - HKLM\..\Run: [LogitechVideoTray] F:\Programmer\logitech\LogiTray.exe

O4 - HKLM\..\Run: [Microsoft Updates] svdhost.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [AAWTray] F:\Programmer\Ad-Aware SE Professional 1.06\AAWTray.exe

O4 - HKLM\..\Run: [Ad-Watch] F:\Programmer\Ad-Aware SE Professional 1.06\Ad-Watch2007.exe

O4 - HKLM\..\RunServices: [Microsoft Updates] svdhost.exe

O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [LogitechSoftwareUpdate] F:\Programmer\logitech\ManifestEngine.exe boot

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe (User 'Default user')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programfiler\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programfiler\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra button: Europa Casino - {4C826F10-D34B-4ba8-B609-1FB8C6482A05} - F:\Programmer\Europa Casino\casino.exe

O9 - Extra 'Tools' menuitem: Europa Casino - {4C826F10-D34B-4ba8-B609-1FB8C6482A05} - F:\Programmer\Europa Casino\casino.exe

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - F:\Programmer\Ad-Aware SE Professional 1.06\aawservice.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - F:\Programmer\Alcohol 120\StarWind\StarWindService.exe

O23 - Service: Session Manager Subsystem (Windows smss) - Unknown owner - C:\WINDOWS\system32\drivers\etc\smss.exe (file missing)

 

Som dere ser, så har jeg fetet ut de oppgavene som jeg er usikker på. Godt mulig at det er andre oppgaver der som også ser farlige ut, men det overlater jeg til dere å bedømme.

 

Noen som kan hjelpe meg med dette?

 

PS: Vurderer å la F-Secure kjøre i bakgrunnen inntil videre. De nye F-Secure versjonene bruker enormt med ressurser (minne), så alt går treigt når den kjører i bakgrunnen... Noen tips/anbefalinger å komme med her, kanskje?

Endret av Shoo
Lenke til kommentar

Videoannonse

Videoannonse
Annonse
PerB

PerB

Skrevet
Skrevet

I tillegg har du svdhost.exe. Dette blir bl.a. omtalt som "Part of the Orvell Monitoring application. Keyloggers can monitor and record keystrokes, e-mails, instant messenger chat sessions, and any other activity you do on your computer." på nettet.

Lenke til kommentar
Shoo

Shoo

Skrevet
  • Forfatter
Skrevet
Skriver du "Shutdown -a" forhindrer du at maskinen skrur seg av.

 

Viruset heter MSBLAST

 

Her har du guide for å fikse det:

 

http://www.pchell.com/virus/msblast.shtml

 

Edit:

Det kan også være sassr virus

 

http://www.pchell.com/virus/sasser.shtml

9610758[/snapback]

 

Ah! Var det der det var. Hadde helt glemt det. Takker for tipsene. Bør være fjernet nå.

 

I tillegg har du svdhost.exe.  Dette blir bl.a. omtalt som "Part of the Orvell Monitoring application. Keyloggers can monitor and record keystrokes, e-mails, instant messenger chat sessions, and any other activity you do on your computer." på nettet.

9610848[/snapback]

 

Ja. Oppdaget ikke den der før i etterkant av scanningen. Denne har jeg også fjernet. Er det kanskje eget program som fjerner dette, eller holder det med å slette det via HJT?

Lenke til kommentar
norbat

norbat

Skrevet
Skrevet

Klikk Start->Kjør

Skriv: services.msc

 

Finn følgende tjeneste som du stopper og deaktiverer:

Session Manager Subsystem

 

Last ned SDFix.exe.

Pakk ut programmet.

 

Restart i sikker modus (tapp f8 under oppstart)

 

Bruk utforsker til å finne og slett (i fet):

C:\WINDOWS\system32\drivers\etc\smss.exe

 

Kjør RunThis.bat i SDfix-mappa.

 

Det lages en rapport (Report.txt) som du poster sammen med ny hjt-logg.

Lenke til kommentar
Shoo

Shoo

Skrevet
  • Forfatter
Skrevet (endret)

Da har jeg gjort de overnevnte sakene, men jeg fant ingen 'smss.exe' i etc-mappen når jeg kjørte i sikkermodus.

 

Uansett, her er loggene:

 

SDFix:

 

Klikk for å se/fjerne innholdet nedenfor

SDFix: Version 1.107

 

Run by shoo on 06.10.2007 at 17:44

 

Microsoft Windows XP [Versjon 5.1.2600]

 

Running From: F:\PROGRA~1\SDFix\SDFix

 

Safe Mode:

Checking Services:

 

Name:

MSDisk

MSWindows

wgareg

 

ImagePath:

"D:\WINDOWS\System32\irdvxc.exe" /service

"D:\WINDOWS\System32\urdvxc.exe" /service

D:\WINDOWS\System32\wgareg.exe

 

MSDisk - Deleted

MSWindows - Deleted

wgareg - Deleted

 

Restoring Windows Registry Values

Restoring Windows Default Hosts File

 

HJT:

 

Klikk for å se/fjerne innholdet nedenfor

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:55:10, on 06.10.2007

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

 

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\system32\spoolsv.exe

D:\WINDOWS\System32\nvsvc32.exe

F:\Programmer\Alcohol 120\StarWind\StarWindService.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\Explorer.EXE

D:\WINDOWS\SOUNDMAN.EXE

D:\Programfiler\Java\jre1.6.0_02\bin\jusched.exe

D:\WINDOWS\System32\RunDLL32.exe

D:\WINDOWS\System32\LVCOMSX.EXE

D:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe

D:\WINDOWS\System32\ctfmon.exe

D:\WINDOWS\System32\wuauclt.exe

D:\WINDOWS\system32\NOTEPAD.EXE

F:\Programmer\HJT\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: Koblingshjelpeprogram for Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programfiler\Java\jre1.6.0_02\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - F:\Programmer\FlashFXP\IEFlash.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [iMJPMIG8.1] D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "D:\Programfiler\Java\jre1.6.0_02\bin\jusched.exe"

O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [LVCOMSX] D:\WINDOWS\System32\LVCOMSX.EXE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Network Translation Service] ".\4.tmp" *

O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [LogitechSoftwareUpdate] F:\Programmer\logitech\ManifestEngine.exe boot

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe (User 'Default user')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programfiler\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programfiler\Java\jre1.6.0_02\bin\ssv.dll

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - F:\Programmer\Alcohol 120\StarWind\StarWindService.exe

 

Ser dere noe galt nå, kanskje?

Endret av Shoo
Lenke til kommentar
norbat

norbat

Skrevet
Skrevet (endret)

Hent Combofix, og legg det på skrivebordet

 

Kjør combofix.exe, og følg veiledningen.

Du må ikke klikke på vinduet mens programmet kjører.

 

Post loggfilen fra combofix (vanligvis c:\combofix.txt) + ny hjt-logg

(Legg gjerne loggene mellom skjul-tagger )

Endret av norbat
Lenke til kommentar
Shoo

Shoo

Skrevet
  • Forfatter
Skrevet

Combofix:

 

Klikk for å se/fjerne innholdet nedenfor

ComboFix 07-10-06.5 - shoo 2007-10-06 18:43:08.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.1.1252.1.1044.18.1672 [GMT 2:00]

Running from: D:\Documents and Settings\shoo\Skrivebord\ComboFix.exe

* Created a new restore point

.

 

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

 

D:\WINDOWS\system32\drivers\npf.sys

D:\WINDOWS\system32\packet.dll

D:\WINDOWS\system32\wpcap.dll

 

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

 

 

-------\LEGACY_NPF

-------\NPF

 

 

((((((((((((((((((((((((( Files Created from 2007-09-06 to 2007-10-06 )))))))))))))))))))))))))))))))

.

 

2007-10-06 18:42 51,200 --a------ D:\WINDOWS\NirCmd.exe

2007-10-06 17:51 1,422 --a------ D:\Documents and Settings\shoo\clean.reg

2007-10-06 17:44 <DIR> d-------- D:\WINDOWS\ERUNT

2007-10-01 12:08 26,112 --a------ D:\WINDOWS\system32\xpsp1hfm.exe

2007-09-28 02:34 <DIR> d-------- D:\Documents and Settings\All Users\Programdata\Lavasoft

2007-09-17 16:42 <DIR> d-------- D:\Documents and Settings\shoo\Programdata\F-Secure

2007-09-17 03:52 <DIR> d-------- D:\Documents and Settings\All Users\Programdata\fssg

2007-09-08 01:10 4,096 --a------ D:\WINDOWS\d3dx.dat

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\sxrnvrwc.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\sxrnvrwc.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\sxrnvrwc.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\sxrnvrwc.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\qrhwwttl.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\jqqnhzbw.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\hrlvbcnb.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\UpdateCtr\tetxhhrk.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\UpdateCtr\qsnjecwj.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\UpdateCtr\nhjshetj.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\UpdateCtr\jllevtvv.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\UpdateCtr\cktnbsnh.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\sysinfo\vtvkbewl.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\sysinfo\rtcetqje.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\sysinfo\kqhrrntq.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\sysinfo\kchsvzvh.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\sysinfo\jjvejzwv.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\sysinfo\htslzjnj.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\sysinfo\btnzqsvx.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\sysinfo\bsshvvxj.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\Remote Assistance\zhrketjx.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\Remote Assistance\vqhtleej.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\Remote Assistance\Interaction\Server\wvqqwcxs.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\Remote Assistance\Interaction\Server\tbtkernc.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\Remote Assistance\Interaction\Server\nlnnesks.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\Remote Assistance\Interaction\Server\hknrjzjh.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\Remote Assistance\Interaction\Server\clkjwkkb.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\Remote Assistance\Interaction\Common\hnxhhztj.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\Remote Assistance\Interaction\Common\cvlbjjxq.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\Remote Assistance\Interaction\Common\blnjeejz.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\Remote Assistance\Interaction\Client\zlntnekb.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\Remote Assistance\Interaction\Client\nljjzkzs.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\Remote Assistance\Interaction\Client\ljqebnhk.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\Remote Assistance\Interaction\Client\knshnhcr.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\Remote Assistance\Interaction\Client\crthjrct.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\Remote Assistance\Interaction\Client\bwhkktks.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\Remote Assistance\enzstctb.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\Remote Assistance\Common\nslentrc.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\Remote Assistance\Common\hwenlbbe.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\Remote Assistance\Common\bqwjtjje.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\rc\sxrwxthr.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\panels\khktnsbx.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\panels\evxtnhzh.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\NetDiag\rkszxcrl.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\NetDiag\ktrswcec.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\errors\hrkkxvqb.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\ErrMsg\bwnrxrwl.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\DVDUpgrd\bzsesbnl.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\DFS\lsenrzlv.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\DFS\hcenshwx.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\DFS\erhrccst.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\CompatCtr\tzkbcesw.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\CompatCtr\sjkkqekt.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\CompatCtr\jvhnnwsr.exe

2007-10-06 16:50 57856 --a------ D:\WINDOWS\PCHEALTH\HELPCTR\System\CompatCtr\bbhhkqkt.exe

2007-10-05 20:36 57856 --a------ D:\WINDOWS\Help\xktzqkhs.exe

2007-10-05 20:36 57856 --a------ D:\WINDOWS\Help\Tours\WindowsMediaPlayer\Cnt\lvhrnnjl.exe

2007-10-05 20:36 57856 --a------ D:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\khlhnssl.exe

2007-10-05 20:36 57856 --a------ D:\WINDOWS\Help\slnqelxw.exe

2007-10-05 20:36 57856 --a------ D:\WINDOWS\Help\rbkelkrk.exe

2007-10-05 20:36 57856 --a------ D:\WINDOWS\Help\jzjsqrrn.exe

2007-10-05 20:36 57856 --a------ D:\WINDOWS\Help\jtlbcthx.exe

2007-10-05 19:54 --------- d-------- D:\Documents and Settings\shoo\Programdata\foobar2000

2007-10-05 17:59 --------- d-------- D:\Documents and Settings\shoo\Programdata\uTorrent

2007-10-04 22:12 --------- d-------- D:\Programfiler\Fellesfiler\Wise Installation Wizard

2007-10-01 12:45 --------- d-a------ D:\Documents and Settings\All Users\Programdata\TEMP

2007-09-15 16:32 --------- d-------- D:\Programfiler\MSN Messenger

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"@"="" []

"IMJPMIG8.1"="D:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2002-08-29 06:38]

"PHIME2002ASync"="D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2002-08-29 06:39]

"PHIME2002A"="D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.exe" [2002-08-29 06:39]

"NvCplDaemon"="D:\WINDOWS\System32\NvCpl.dll" [2007-04-19 13:26]

"nwiz"="nwiz.exe" [2007-04-19 13:26 D:\WINDOWS\system32\nwiz.exe]

"SoundMan"="SOUNDMAN.EXE" [2007-04-16 15:28 D:\WINDOWS\soundman.exe]

"SunJavaUpdateSched"="D:\Programfiler\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]

"NvMediaCenter"="NvMCTray.dll" [2007-04-19 13:26 D:\WINDOWS\system32\nvmctray.dll]

"LVCOMSX"="D:\WINDOWS\System32\LVCOMSX.EXE" [2005-07-19 17:32]

"Adobe Reader Speed Launcher"="D:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]

"Network Translation Service"=".\4.tmp *" []

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"@"="" []

"ctfmon.exe"="D:\WINDOWS\System32\ctfmon.exe" [2002-09-09 23:13]

"LogitechSoftwareUpdate"="F:\Programmer\logitech\ManifestEngine.exe" [2005-06-08 14:44]

 

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]

"Network Translation Service"=".\4.tmp" *

 

S1 lusbaudio;Logitech USB-mikrofon;D:\WINDOWS\System32\drivers\OVSound2.sys

S3 autorun;autorun;\??\D:\huadio.tmp

S3 QCEmerald;Logitech QuickCam Web;D:\WINDOWS\System32\DRIVERS\OVCE.sys

S3 xlink;XLink Driver (xlink.sys);D:\WINDOWS\System32\Drivers\xlink.sys

S4 Windows smss;Session Manager Subsystem;C:\WINDOWS\system32\drivers\etc\smss.exe

 

.

**************************************************************************

 

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-10-06 18:45:16

Windows 5.1.2600 Service Pack 1 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

Completion time: 2007-10-06 18:46:00 - machine was rebooted

D:\ComboFix-quarantined-files.txt ... 2007-10-06 18:45

.

--- E O F ---

 

 

HJT:

 

Klikk for å se/fjerne innholdet nedenfor

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:47:03, on 06.10.2007

Platform: Windows XP SP1 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Boot mode: Normal

 

Running processes:

D:\WINDOWS\System32\smss.exe

D:\WINDOWS\system32\winlogon.exe

D:\WINDOWS\system32\services.exe

D:\WINDOWS\system32\lsass.exe

D:\WINDOWS\system32\svchost.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\system32\spoolsv.exe

D:\WINDOWS\Explorer.EXE

D:\WINDOWS\SOUNDMAN.EXE

D:\Programfiler\Java\jre1.6.0_02\bin\jusched.exe

D:\WINDOWS\System32\RunDLL32.exe

D:\WINDOWS\System32\LVCOMSX.EXE

D:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe

D:\WINDOWS\System32\ctfmon.exe

D:\WINDOWS\System32\nvsvc32.exe

F:\Programmer\Alcohol 120\StarWind\StarWindService.exe

D:\WINDOWS\System32\svchost.exe

D:\WINDOWS\system32\notepad.exe

D:\WINDOWS\System32\wuauclt.exe

D:\Programfiler\Mozilla Firefox\firefox.exe

F:\Programmer\HJT\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: Koblingshjelpeprogram for Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Programfiler\Java\jre1.6.0_02\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - F:\Programmer\FlashFXP\IEFlash.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx

O4 - HKLM\..\Run: [iMJPMIG8.1] D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE D:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "D:\Programfiler\Java\jre1.6.0_02\bin\jusched.exe"

O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [LVCOMSX] D:\WINDOWS\System32\LVCOMSX.EXE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Network Translation Service] ".\4.tmp" *

O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\System32\ctfmon.exe

O4 - HKCU\..\Run: [LogitechSoftwareUpdate] F:\Programmer\logitech\ManifestEngine.exe boot

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\System32\ctfmon.exe (User 'Default user')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programfiler\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Programfiler\Java\jre1.6.0_02\bin\ssv.dll

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - D:\WINDOWS\System32\nvsvc32.exe

O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - F:\Programmer\Alcohol 120\StarWind\StarWindService.exe

 

Slik.

Lenke til kommentar
norbat

norbat

Skrevet
Skrevet

Hvis du lar 'oppdateringen' velge selv, vil du sikkert se at det er noe å installere.

 

I all hovedsak tenker jeg på SP2. Du har en rimelig 'utdatert' windowsversjon og burde vel for lenge siden ha fått muligheten til å installere dette. Hvorfor det ikke er gjort kan bare du svare på.

 

Uansett bør du kjøre en virusscan (før en evt. installasjon av SP2). Følgende prog. er en 'engangsscanner' som du kan kjøre fra sikker modus:

 

Hent deretter DrWeb

 

Restart i Sikker modus (tapp F8 under oppstart)

 

Kjør drweb-cureit.exe (si ja til å kjøre en express scan)

Når dette er ferdig klikker du på Option -> Change settings.

Under fanearket Scan, fjerner du haken ved Heuristic analysis.

Under fanearket Actions, skal alle punkt under Malware settes til Rename.

 

Velg partisjon du vil scanne og klikk deretter på den grønne pilen for

å starte scanningen. Velg "yes to all" når det finner noe for første gang.

 

Når scanningen er ferdig, gå til "file" – Trykk på- "Save Report list".

En fil med navn "drweb.csv" vil da ligge på skrivebordet. Den kunne det ha vært interessant å sett på.

Lenke til kommentar
Shoo

Shoo

Skrevet
  • Forfatter
Skrevet

Ja-a... Man kan jo lure... Fjernet Windows Update da den poppet opp litt for ofte etter min smak, så det er nok det som er grunnen til at jeg er så "langt etter" når det gjelder oppdateringer. Skal gå til anskaffelse av SP2 snart.

 

Det ser iallfall ut som om de voldsomme probleme er løst for nå, men som du peker på, så skal jeg nok gå i bresjen for å sikre PC-en litt mer.

 

Litt off-topic, men F-Secure 6.0 er vel et bra virusprogram til å ha kjørende i bakgrunnen, sant?

Lenke til kommentar
norbat

norbat

Skrevet
Skrevet

Kjenner ikke så mye til F-secure, men vil tro det er like godt som de fleste andre av-prog.

 

Selv om alt tilsynelatende kjører ok, så oppfordrer jeg deg til å kjøre den nevnte DrWeb. :)

 

-Og det er egentlig ikke noe problem å skur av automatisk oppdatering hvis man passer på å sjekke innimellom. Der har det glippet litt, ja :)

Lenke til kommentar
Shoo

Shoo

Skrevet
  • Forfatter
Skrevet (endret)

Yep, der har det glippet litt, dessverre for meg det. Men retter det opp igjen før det er for seint...

 

Hva skal jeg gjøre med 'drweb.csv' som blir lagt på skrivebordet?

 

EDIT: Må forresten nevne at den spywarefri-tråden din er en god ting for de fleste som ikke vet å holde seg spywarefri. Tok meg friheten å legge en liten link til den i signaturen min, for å få flere til å titte innom tråden din, nor.

Endret av Shoo
Lenke til kommentar

Opprett en konto eller logg inn for å kommentere

Du må være et medlem for å kunne skrive en kommentar

Opprett konto

Det er enkelt å melde seg inn for å starte en ny konto!

Start en konto

Logg inn

Har du allerede en konto? Logg inn her.

Logg inn nå
Gå til emneliste

  • Hvem er aktive   0 medlemmer

    • Ingen innloggede medlemmer aktive
×
×
  • Opprett ny...