Spionvaretrøbbel. Hjelp meg

maslaksen · 30. oktober 2007

Jeg har problemer med noe "Your privacy is in danger" greier. Vet ikke helt hvordan jeg skal gjøre det. Har kjørt Hitman Pro 2 en gang og fjerna en del. Men fant fortsatt mye drit når jeg sjekka nå nettopp. Hadde vært evig takknemlig om noen kunne hjulpet meg. Har også kjørt CCleaner. Bør ha PC-en fikset før 3 i dag.. :dribble:

Har fått fjerna privacy-bakgrunnen slik;

egenskaper/skrivebord/tilpass/web. Jeg tok vekk krysset ved privacy ikonet. Jeg kommer ikke inn på noen nettsteder. Blir overført til directnameservice.com hvor det ikke er noe.

Legger ved en HJT-logg:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:30:06, on 30.10.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

C:\Programfiler\Webroot\Spy Sweeper\SpySweeper.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe

C:\Programfiler\Telenor\Online Start\Telenor.exe

C:\Programfiler\iTunes\iTunesHelper.exe

C:\Programfiler\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe

C:\Programfiler\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe

C:\Programfiler\iPod\bin\iPodService.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Hitman Pro\hitmanpro2.exe

C:\Programfiler\Hitman Pro\downloads\ewido_micro.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\rundll32.exe

C:\Programfiler\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

O2 - BHO: (no name) - AutorunsDisabled - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: MSVPS System - {64DE95E5-0A25-4DD9-A472-97BC1D419101} - C:\WINDOWS\movctrlswd.dll

O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)

O2 - BHO: Online Start Plugin - {DB87CDE1-EF9C-44EB-A42F-6D0B3C72C516} - C:\Programfiler\Telenor\Online Start\IEFixItNowPlugin.dll

O3 - Toolbar: The nssfrch - {2106BEDE-F5E8-4DE8-A081-A7E5EAD1529B} - C:\WINDOWS\nssfrch.dll

O4 - HKLM\..\Run: [TkBellExe] "C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [pccguide.exe] "C:\Programfiler\Trend Micro\Internet Security 2007\pccguide.exe"

O4 - HKLM\..\Run: [Telenor Online Start] "C:\Programfiler\Telenor\Online Start\Telenor.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Programfiler\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [NI.UGA6P_0001_N122M2210] "c:\documents and settings\compaq_eier\programdata\install_en[1].exe"

O4 - HKLM\..\Run: [spySweeper] C:\Programfiler\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray

O4 - HKCU\..\Run: [OE] "C:\Programfiler\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"

O4 - HKCU\..\Run: [QuickTime Task] "C:\Programfiler\QuickTime\qttask.exe" -atboottime

O4 - HKCU\..\Run: [updateMgr] "C:\Programfiler\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - Global Startup: Hurtigstart for Adobe Reader.lnk = C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - blank (file missing)

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - blank (file missing)

O9 - Extra button: (no name) - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - (no file)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by15fd.bay15.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

O16 - DPF: {F00F4763-7355-4725-82F7-0DA94A256D46} (IncrediMail) - http://www5.incredimail.com/contents/setup...p1/imloader.cab

O18 - Protocol: fin - {5C472352-90D0-4214-BF20-8E4A2B82F980} - (no file)

O21 - SSODL: ocgrep - {50CAD810-F84C-4E50-A4CE-A65349C0DEF0} - C:\WINDOWS\ocgrep.dll

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Programfiler\iPod\bin\iPodService.exe

O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

O23 - Service: Spionprogrambeskyttelse fra Trend Micro (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programfiler\Spyware Doctor\svcntaux.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programfiler\Spyware Doctor\swdsvc.exe

O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Programfiler\Webroot\Spy Sweeper\SpySweeper.exe

O24 - Desktop Component 0: Privacy Protection - about:home

--

End of file - 6415 bytes

Endret 30. oktober 2007 av maslaksen

norbat · 30. oktober 2007

Hent Smitfraudfix, legg det på skrivebordet

Restart i sikker modus (tapp F8 under oppstart, velg sikker modus)

Kjør Smitfraudfix, velg valg 2.

Fra normal modus:

Hent SAS, installer og oppdater og kjør en 'complete' scan.

Post en ny HJT-logg sammen med loggen fra SAS (preferences->statistics/logs) og Smitfraudfix (C:\rapport.txt)

maslaksen · 30. oktober 2007

Ok. Nå har jeg kjørt smitfraudfix i safemode, kjørt SAS og lagd en ny HJT logg.

Smitfraud i safe mode:

SmitFraudFix v2.244

Scan done at 12:04:04,42, 30.10.2007

Run from J:\SmitfraudFix

OS: Microsoft Windows XP [Versjon 5.1.2600] - Windows_NT

The filesystem type is NTFS

Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix

!Attention, following keys are not inevitably infected!

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\bxsbang.dll Deleted

Deleting [HKEY_CLASSES_ROOT\CLSID\{5449880B-7D3E-43A8-82F1-C66FBD45BA1C}]

C:\WINDOWS\kthemup.exe Deleted

C:\WINDOWS\movctrlswd.dll Deleted

C:\WINDOWS\nssfrch.dll Deleted

C:\WINDOWS\ocgrep.dll Deleted

Deleting [HKEY_CLASSES_ROOT\CLSID\{50CAD810-F84C-4E50-A4CE-A65349C0DEF0}]

C:\WINDOWS\system32\ot.ico Deleted

C:\DOCUME~1\ALLUSE~1\START-~1\Online Security Guide.url Deleted

C:\DOCUME~1\ALLUSE~1\START-~1\Security Troubleshooting.url Deleted

C:\DOCUME~1\COMPAQ~1\FAVORI~1\Antivirus Test Online.url Deleted

C:\DOCUME~1\COMPAQ~1\FAVORI~1\Error Cleaner.url Deleted

C:\DOCUME~1\COMPAQ~1\FAVORI~1\Privacy Protector.url Deleted

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{1C6E31D0-6CB2-4CD3-8B38-85C8A34A9FD4}: DhcpNameServer=10.0.0.138

HKLM\SYSTEM\CCS\Services\Tcpip\..\{AC4E2B1A-220B-4DC5-983B-E5117F68B9D1}: DhcpNameServer=10.0.1.10

HKLM\SYSTEM\CS1\Services\Tcpip\..\{1C6E31D0-6CB2-4CD3-8B38-85C8A34A9FD4}: DhcpNameServer=10.0.0.138

HKLM\SYSTEM\CS1\Services\Tcpip\..\{AC4E2B1A-220B-4DC5-983B-E5117F68B9D1}: DhcpNameServer=10.0.1.10

HKLM\SYSTEM\CS2\Services\Tcpip\..\{1C6E31D0-6CB2-4CD3-8B38-85C8A34A9FD4}: DhcpNameServer=10.0.0.138

HKLM\SYSTEM\CS2\Services\Tcpip\..\{AC4E2B1A-220B-4DC5-983B-E5117F68B9D1}: DhcpNameServer=10.0.1.10

HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=10.0.1.10

HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=10.0.1.10

HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=10.0.1.10

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System

!Attention, following keys are not inevitably infected!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix

!Attention, following keys are not inevitably infected!

SrchSTS.exe by S!Ri

SAS normal mode:

SUPERAntiSpyware Scan Log

http://www.superantispyware.com

Generated 10/30/2007 at 12:16 PM

Application Version : 3.9.1008

Core Rules Database Version : 3143

Trace Rules Database Version: 1159

Scan type : Complete Scan

Total Scan Time : 00:02:15

Memory items scanned : 459

Memory threats detected : 0

Registry items scanned : 5304

Registry threats detected : 0

File items scanned : 3752

File threats detected : 0

Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

HJT logg etter:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:26:14, on 30.10.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\Fellesfiler\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

C:\WINDOWS\System32\svchost.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

C:\Programfiler\Webroot\Spy Sweeper\SpySweeper.exe

C:\Programfiler\Fellesfiler\Real\Update_OB\realsched.exe

C:\Programfiler\Trend Micro\Internet Security 2007\pccguide.exe

C:\Programfiler\Telenor\Online Start\Telenor.exe

C:\Programfiler\iTunes\iTunesHelper.exe

C:\Programfiler\Webroot\Spy Sweeper\SpySweeperUI.exe

C:\Programfiler\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe

C:\Programfiler\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe

C:\Programfiler\Webroot\Spy Sweeper\SSU.EXE

C:\Programfiler\iPod\bin\iPodService.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\wbem\wmiapsrv.exe

C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe