hvordan får jeg fjernet trojan.downloader?

[maymay]

Fått virus på den andre PC-en, Får ikke fjernet det...

 

Noe som har noen gode forslag??

 

 

 

maymay

[norbat]

Last ned Hijackthis. Legg det i en egen mappe på skrivebordet.

Start programmet, velg "Do a system scan and save a logfile". Loggfilen kopierer du og poster.

[maymay]

logfile er før jeg kjørte combofix og SAS

 

log2 er etterpå...

 

det popper ikke opp noen varsler lenger, og PC-en fungerer bedre.

logfile.txt

log2.txt

[norbat]

Kjør HJT og sett merke framfor følgende linjer, klikk Fix checked:

 

O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Programfiler\PokerStars\PokerStarsUpdate.exe

O20 - Winlogon Notify: tuvvurr - tuvvurr.dll (file missing)

 

Ut over dette ser loggen din fin ut

 

Du bør nullstille gjenopprettingsmappa slik at du ikke blir infisert ved en evt. systemgjenoppretting.

Kontrollpanel->system->systemgjenoppretting .

Sett merke framfor "Slå av Systemgjenopprettingen .....",

restart pc,

fjern merket igjen for å aktivere funksjonen.

 

(Kunne vært interessant og sett combofix-loggen (c:\combofix.txt) + SAS-loggen (preferences->statistics/logs))

[maymay]

(Kunne vært interessant og sett combofix-loggen (c:\combofix.txt) + SAS-loggen (preferences->statistics/logs))

9634970[/snapback]

 

Da var det gjort... takker så mye for hjelpen

 

Hmmm... finner ikke SAS-loggen, fant bare de to andre...

ComboFix.txt

ComboFix_quarantined_files.txt

[maymay]

fant SAS loggen trur jeg he he

 

men får ikke lastet den opp...

Endret 5. oktober 2007 av maymay

[norbat]

Ok,

 

Surt trygt

[Mesias]

hei. jeg har det samme problemet

kan denne loggen hjelpe meg? jeg kjørte det samme programmet, men aner ikke hva jeg skal gjøre etter at ejg har loggen :J kan du leie meg skate gjennom det^^?

 

logg: (sorry for at poster here driten)

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 00:53:48, on 06.10.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programfiler\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\WINDOWS\CTHELPER.EXE

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

C:\Programfiler\Java\jre1.5.0_03\bin\jusched.exe

C:\Programfiler\ATI Technologies\ATI.ACE\cli.exe

C:\Programfiler\iTunes\iTunesHelper.exe

C:\Programfiler\MSN Messenger\MsnMsgr.Exe

C:\Programfiler\iPod\bin\iPodService.exe

C:\Programfiler\Online Video Add-on\icmntr.exe

C:\Programfiler\ATI Technologies\ATI.ACE\cli.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\MSN Messenger\usnsvc.exe

C:\Programfiler\Online Video Add-on\icthis.exe

C:\PROGRA~1\MOZILL~1\FIREFOX.EXE

C:\Documents and Settings\Tobias\Mine dokumenter\Ny mappe (2)\HijackThis.exe

 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://as.starware.com/dp/search?x=wKX1ILE...mzPFuzxwT8K1mo=

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O3 - Toolbar: (no name) - {D49E9D35-254C-4c6a-9D17-95018D228FF5} - (no file)

O3 - Toolbar: IE Custom Tools - {41F6170D-6AF8-4188-8D92-9DDAB3C71A78} - C:\Programfiler\Online Video Add-on\ictmdl.dll (file missing)

O4 - HKLM\..\Run: [ATIPTA] C:\Programfiler\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [smcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Programfiler\Java\jre1.5.0_03\bin\jusched.exe

O4 - HKLM\..\Run: [ATICCC] "C:\Programfiler\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Programfiler\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [utopia Angel] "C:\Utopia\Angel\Angel.exe"

O4 - HKCU\..\Run: [DAEMON Tools] "C:\Programfiler\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKCU\..\Run: [steam] D:\spill\steam\\Steam.exe -silent

O4 - HKLM\..\Policies\Explorer\Run: [some] C:\Programfiler\Online Video Add-on\icthis.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{26ABB37A-A380-4005-8C21-BFD8D6B64506}: NameServer = 85.255.113.93,85.255.112.23

O17 - HKLM\System\CCS\Services\Tcpip\..\{8873DF38-2032-451A-94C3-844CDDB74671}: NameServer = 85.255.113.93,85.255.112.23

O17 - HKLM\System\CCS\Services\Tcpip\..\{A18DD654-0E56-4070-8C2A-0A4C4E1C82BC}: NameServer = 85.255.113.93,85.255.112.23

O17 - HKLM\System\CCS\Services\Tcpip\..\{E5DF8921-ADE5-4D4E-A789-79588C15DFF7}: NameServer = 85.255.113.93,85.255.112.23

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.113.93 85.255.112.23

O17 - HKLM\System\CS1\Services\Tcpip\..\{26ABB37A-A380-4005-8C21-BFD8D6B64506}: NameServer = 85.255.113.93,85.255.112.23

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.113.93 85.255.112.23

O17 - HKLM\System\CS2\Services\Tcpip\..\{26ABB37A-A380-4005-8C21-BFD8D6B64506}: NameServer = 85.255.113.93,85.255.112.23

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.113.93 85.255.112.23

O21 - SSODL: contrabandists - {dfa61db1-388e-4c87-8d56-540fa229bcb4} - C:\WINDOWS\system32\dpfwu.dll (file missing)

O22 - SharedTaskScheduler: contrabandists - {dfa61db1-388e-4c87-8d56-540fa229bcb4} - C:\WINDOWS\system32\dpfwu.dll (file missing)

O22 - SharedTaskScheduler: ataxics - {16be3225-e902-4d2a-ac98-aab162796927} - (no file)

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programfiler\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programfiler\Fellesfiler\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Programfiler\iPod\bin\iPodService.exe

O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Programfiler\Sygate\SPF\Smc.exe

 

--

End of file - 6444 bytes

[norbat]

Mesias,

 

Kunne du opprette en egen tråd der du legger hjt-loggen (det blir litt surr når man legger inn logger og spm. i andres tråder.)

 

Du oppretter ny tråd ved å klikke på 'Nytt emne'-knappen.

Loggen din viser div. infeksjoner, men vi har medisin mot dette

 

Edit: Velkommen til forumet, forresten.

Endret 6. oktober 2007 av norbat