Trenger hjelp til å fjerne "SpyCrush"

J@9 · 2. oktober 2007

Hei!

Har påtatt meg jobben med å prøve å fikse PC-en til noen som fatter'n jobber sammen med.

Denne henegr seg opp i et kjør og jeg får advarsler om at det er funnet feil på PC-en osv om at noen prøver å infisere PC-en med spware eller skadelige virus.

Meldingen er på engelsk, og hver gang denne kommer opp så åpnes internett explorer, og prøver å komme seg inn på spycrush.com..

Jeg har funnet ei mappe i program filer som heter spycrush 3.2.. men jeg finner det ikke på legg til/fjern programmer, heller ikke på startmenyen, og i mappa er det ikke noe uninstall fil.

Så hvordan i hæ***** skal jeg få bort denne dritten?

Jeg har ikke noe cd-plater eller noe til PC-en her, så jeg får ikke lagt inn windows på nytt her og nå.

Så derfor hadde det vært fint om noen visste hvordan jeg kan få bort detta møkka programmet og fått sett om den blir bedre da

Sånn som den er nå så henger den seg opp i et kjør.. så det første jeg gjør når jeg komemr inn i windows er å avslutte så mye prosesser som mulig..

Måtte også stoppe explorer da den gikk konstant på 99% CPU bruk.

PC-en kjører Win XP home, som ser helt oppdatert ut, det er også lagt inn Norton Internet Security (blæææ..)

PS, har ikke koblet den til nettet, så jeg aner ikke hva den spycrush sida inneholder.. og jeg anbefaller ingen å prøve å åpne den heller.. da det garantert er et program som lager mer problemer enn det reparerer.

norbat · 2. oktober 2007

https://www.diskusjon.no/index.php?showtopi...dpost&p=8827780

Post gjerne en hjt-logg etterpå.

Last ned Hijackthis. Legg det i en egen mappe på skrivebordet.

Start programmet, velg "Do a system scan and save a logfile". Loggfilen kopierer du og poster.

Endret 2. oktober 2007 av norbat

J@9 · 2. oktober 2007

Hei!

Nå har jeg kjørt SmitfraudFix i sikkermodus, tok ikke å restartet før jeg kjørte rootchk.

Logg filene kommer her..

SmitFraudFix:

Klikk for å se/fjerne innholdet nedenfor

SmitFraudFix v2.235

Scan done at 18:59:11,85, 02.10.2007

Run from C:\Documents and Settings\Eier\Skrivebord\SmitfraudFix

OS: Microsoft Windows XP [Versjon 5.1.2600] - Windows_NT

The filesystem type is NTFS

Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix

!Attention, following keys are not inevitably infected!

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]

"{6f396a67-f473-48c9-9950-636ce17e584e}"="hellenophile"

[HKEY_CLASSES_ROOT\CLSID\{6f396a67-f473-48c9-9950-636ce17e584e}\InProcServer32]

@="C:\WINDOWS\system32\yesgnhr.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{6f396a67-f473-48c9-9950-636ce17e584e}\InProcServer32]

@="C:\WINDOWS\system32\yesgnhr.dll"

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

C:\WINDOWS\system32\yesgnhr.dll -> Hoax.Win32.Renos.gen.o

C:\WINDOWS\system32\yesgnhr.dll -> Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\main_uninstaller.exe Deleted

C:\WINDOWS\msmdev.dll Deleted

Deleting [HKEY_CLASSES_ROOT\CLSID\{F8586A66-16BC-4341-92DD-EBE781DD2C01}]

C:\WINDOWS\msmhost.dll Deleted

Deleting [HKEY_CLASSES_ROOT\CLSID\{7BA75ABE-9288-44C4-8773-455DC164A78B}]

C:\DOCUME~1\ALLUSE~1\START-~1\Online Security Guide.url Deleted

C:\DOCUME~1\ALLUSE~1\START-~1\Security Troubleshooting.url Deleted

C:\DOCUME~1\Eier\SKRIVE~1\Error Cleaner.url Deleted

C:\DOCUME~1\Eier\SKRIVE~1\Privacy Protector.url Deleted

C:\DOCUME~1\Eier\SKRIVE~1\Spyware?Malware Protection.url Deleted

C:\DOCUME~1\Eier\FAVORI~1\Error Cleaner.url Deleted

C:\DOCUME~1\Eier\FAVORI~1\Privacy Protector.url Deleted

C:\Programfiler\MW\ Deleted

»»»»»»»»»»»»»»»»»»»»»»»» DNS

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System

!Attention, following keys are not inevitably infected!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix

!Attention, following keys are not inevitably infected!

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

Rootchk:

Klikk for å se/fjerne innholdet nedenfor

********************************* ROOTCHK-(21-09-07)-LOG, by ejvindh

02.10.2007 19:02:08,14

The rootkits that are detected by this tool were not found.

********************************* ROOTCHK-LOG-end

catchme 0.3.1160 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-10-02 19:02:08

Windows 5.1.2600 Service Pack 2

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

hidden processes: 0

hidden services: 0

hidden files: 0

HiJackThis:

Klikk for å se/fjerne innholdet nedenfor

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:07:09, on 02.10.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccProxy.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

C:\Programfiler\Norton Internet Security\ISSVC.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\Fellesfiler\Symantec Shared\SNDSrvc.exe

C:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

C:\Programfiler\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\WINDOWS\System32\CTsvcCDA.exe

C:\Programfiler\Fellesfiler\Symantec Shared\DJSNETCN.exe

C:\Programfiler\Norton Internet Security\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\windows\system\hpsysdrv.exe

C:\HP\KBD\KBD.EXE

C:\WINDOWS\system32\CTHELPER.EXE

C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe

C:\Programfiler\NewSoft\Smart Start UP\PnPDetect.exe

C:\WINDOWS\system32\rundll32.exe

C:\Programfiler\Telenor\ecc\ecc.exe

C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe

C:\Programfiler\QuickTime\qttask.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Programfiler\Java\j2re1.4.2_06\bin\jusched.exe

C:\Programfiler\Messenger\msmsgs.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\PhotoWise\quicklnk.exe

C:\Programfiler\Telenor Sikker Lagring\safestorage.exe

C:\Documents and Settings\Eier\Skrivebord\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer by Tele2

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Programfiler\Fellesfiler\Symantec Shared\AdBlocking\NISShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programfiler\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded

O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe

O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb06.exe

O4 - HKLM\..\Run: [avserve2.exe] C:\WINDOWS\avserve2.exe

O4 - HKLM\..\Run: [smart Start UP] C:\Programfiler\NewSoft\Smart Start UP\PnPDetect.exe /Automation

O4 - HKLM\..\Run: [symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer

O4 - HKLM\..\Run: [ecc] C:\Programfiler\Telenor\ecc\ecc.exe

O4 - HKLM\..\Run: [ccApp] "C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [NI.UERSH_0001_N68M0602] "C:\Documents and Settings\Eier\Lokale innstillinger\Temporary Internet Files\Content.IE5\0XMBCDIN\ErrorSafeFreeInstall_no[1].exe" -nag

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Programfiler\Java\j2re1.4.2_06\bin\jusched.exe

O4 - HKLM\..\Run: [spyCrush 3.2] "C:\Programfiler\SpyCrush 3.2\SpyCrush 3.2.exe" /h

O4 - HKLM\..\Run: [NI.UWA6PH_0001_N91M2107] "c:\documents and settings\eier\programdata\winantiviruspro2006freeinstall_no[1].exe" -nag

O4 - HKLM\..\Run: [NI.UGA6P_0001_N111M1707] "C:\documents and settings\eier\programdata\install_en[1].exe" -nag

O4 - HKLM\..\Run: [ugdccw] "C:\PROGRA~1\YOURPR~1\UGDCcw.exe" -start

O4 - HKLM\..\RunServices: [DJSNetCN] C:\Programfiler\Fellesfiler\Symantec Shared\DJSNETCN.exe

O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook

O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [YourPrivacyGuard] C:\Programfiler\YourPrivacyGuard\GDC.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-18\..\RunOnce: [PlayCenter2] "C:\Programfiler\Creative\SBAudigy\PlayCenter2\MDEntry.EXE" "C:\Programfiler\Creative\SBAudigy\PlayCenter2" (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [PlayCenter2] "C:\Programfiler\Creative\SBAudigy\PlayCenter2\MDEntry.EXE" "C:\Programfiler\Creative\SBAudigy\PlayCenter2" (User 'Default user')

O4 - S-1-5-18 Startup: QuickLink.lnk = C:\Programfiler\PhotoWise\quicklnk.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: QuickLink.lnk = C:\Programfiler\PhotoWise\quicklnk.exe (User 'Default user')

O4 - Startup: QuickLink.lnk = C:\Programfiler\PhotoWise\quicklnk.exe

O4 - Startup: Registration-Studio 8 LE.lnk = C:\Programfiler\Pinnacle\Studio 8\Register\RegTool.exe

O4 - Startup: Telenor Sikker Lagring.lnk = C:\Programfiler\Telenor Sikker Lagring\safestorage.exe

O4 - Global Startup: Date Manager.lnk = C:\Programfiler\Date Manager\DateManager.exe

O4 - Global Startup: Hurtigstart for Adobe Reader.lnk = C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Programfiler\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: PrecisionTime.lnk = C:\Programfiler\PrecisionTime\PrecisionTime.exe

O4 - Global Startup: Weatherscope.lnk = C:\Programfiler\Weatherscope\Weatherscope.exe

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O16 - DPF: DnB-Betaling - http://www16.dnb.no/nettbank/bf.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1191095358875

O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedCon...n/bin/cabsa.cab

O16 - DPF: {C7B05B62-C8D7-438C-840B-4994DAAA8EEE} - http://webpdp.gator.com/v3/download/pdpplu...ptdmgainads.cab

O16 - DPF: {CAFEEFAC-0014-0000-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0) -

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programfiler\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Automatisk LiveUpdate-planlegging - Symantec Corporation - C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSetMgr.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe

O23 - Service: Symantec Licensing Detect Internet Connection (DJSNETCN) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\DJSNETCN.exe

O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Programfiler\Norton Internet Security\ISSVC.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: Norton AntiVirus Auto-Protect-tjeneste (navapsvc) - Symantec Corporation - C:\Programfiler\Norton Internet Security\Norton AntiVirus\navapsvc.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Programfiler\Norton Internet Security\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FELLES~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\Security Center\SymWSC.exe

--

End of file - 9972 bytes

PC-en ser mye mer stabil ut allerede

Men om det er noe mer som bør gjøres så si ifra

Skal kjøre en full scan ifra Norton nå.

Bare for sikkerhets skyld.

Ikke at jeg liker programmet men

norbat · 2. oktober 2007

Du er ikke helt clean ennå, men kjør gjerne Norton for deretter å poste en ny hjt-logg

J@9 · 2. oktober 2007

Norton fant ikke noe, så jeg sender PC-en tilbake som den er nå.. for den er jo mye bedre enn før.. og blir den værre så får jeg bare kjøre recovery for dem

norbat · 2. oktober 2007

Før du sender den fra deg, må du gjør følgende:

Se om du får avinstallert fra legg til/fjern programmer:

DataMangager

PrecisionTime

Kjør HJT, velg "Do a system scan only", sett merke framfor følgende linjer og klikk Fix checked:

O4 - HKLM\..\Run: [avserve2.exe] C:\WINDOWS\avserve2.exe

O4 - HKLM\..\Run: [NI.UERSH_0001_N68M0602] "C:\Documents and Settings\Eier\Lokale innstillinger\Temporary Internet Files\Content.IE5\0XMBCDIN\ErrorSafeFreeInstall_no[1].exe" -nag

O4 - HKLM\..\Run: [spyCrush 3.2] "C:\Programfiler\SpyCrush 3.2\SpyCrush 3.2.exe" /h

O4 - HKLM\..\Run: [NI.UWA6PH_0001_N91M2107] "c:\documents and settings\eier\programdata\winantiviruspro2006freeinstall_no[1].exe" -nag

O4 - HKLM\..\Run: [NI.UGA6P_0001_N111M1707] "C:\documents and settings\eier\programdata\install_en[1].exe" -nag

O4 - HKLM\..\Run: [ugdccw] "C:\PROGRA~1\YOURPR~1\UGDCcw.exe" -start

O4 - Global Startup: Date Manager.lnk = C:\Programfiler\Date Manager\DateManager.exe

O4 - Global Startup: PrecisionTime.lnk = C:\Programfiler\PrecisionTime\PrecisionTime.exe

O16 - DPF: {C7B05B62-C8D7-438C-840B-4994DAAA8EEE} - http://webpdp.gator.com/v3/download/pdpplu...ptdmgainads.cab

Hent Avenger og pakk det ut.

Start programmet, sett prikk i "Input Script Manually" og klikk på lupen.

I vinduet som kommer opp kopierer du og limer inn det som er i fet skrift under:

Files to delete:

C:\WINDOWS\avserve2.exe

Folders to delete:

C:\Programfiler\SpyCrush 3.2

C:\Programfiler\Date Manager

C:\Programfiler\PrecisionTime

Klikk på Trafikklyset. Restart PC-en.

Etter restart vil det komme en loggfil som forteller om den fikk fjernet det som er nevnt.

I tillegg til dette har jeg villet scannet med et godt antispywareprog. Kan anbefale SuperAntispyware: SAS (gratisversjonen)

Logg inn

Trenger hjelp til å fjerne "SpyCrush"

Anbefalte innlegg

J@9

Lenke til kommentar

Videoannonse

norbat

Lenke til kommentar

J@9

Lenke til kommentar

norbat

Lenke til kommentar

J@9

Lenke til kommentar

norbat

Lenke til kommentar

Opprett en konto eller logg inn for å kommentere

Opprett konto

Logg inn

Hvem er aktive 0 medlemmer