Hjelp, har fått keylogger og virus (trojan)

Zerpin · 1. november 2007

Hei.

Jeg har lastet ned et program, der fulgte det med virus og keylogger og det suger skikkelig.

Norbat kan du hjelpe meg med dette?

norbat · 1. november 2007

Last ned Hijackthis. Legg det i en egen mappe på skrivebordet.

Start programmet, velg "Do a system scan and save a logfile". Loggfilen kopierer du og poster.

Zerpin · 2. november 2007

HJT logg

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 09:58:37, on 02.11.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Programfiler\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\ATI Technologies\ATI.ACE\cli.exe

C:\Programfiler\NavNT\vptray.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Programfiler\Sunbelt Software\CounterSpy\Consumer\sunserver.exe

C:\Programfiler\Messenger\msmsgs.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\NavNT\defwatch.exe

C:\Programfiler\NavNT\rtvscan.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\MsgSys.EXE

C:\Programfiler\ATI Technologies\ATI.ACE\cli.exe

C:\Programfiler\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.no/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.serial99.com/?a

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: (no name) - {86DA0852-9FFB-49C5-A195-CB53FD97A2A1} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: (no name) - {F244C050-3D11-49FB-8EBF-43045F512645} - (no file)

O4 - HKLM\..\Run: [ATICCC] "C:\Programfiler\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [vptray] C:\Programfiler\NavNT\vptray.exe

O4 - HKLM\..\Run: [siSUSBRG] C:\WINDOWS\SiSUSBrg.exe

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [sunServer] C:\Programfiler\Sunbelt Software\CounterSpy\Consumer\sunserver.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Programfiler\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKLM\..\Policies\Explorer\Run: [issearch.exe] issearch.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134

norbat · 2. november 2007

Hent Smitfraudfix, legg det på skrivebordet

Restart i sikker modus (tapp F8 under oppstart, velg sikker modus)

Kjør Smitfraudfix, velg valg 2.

Fra normal modus:

Last ned SAS, installer, oppdater og kjør en full (Complete) scan.

Post følgende logger:

SAS (preferences->statistics/logs)

Smitfraudfix (C:\rapport.txt)

Ny hjt-logg

Zerpin · 2. november 2007

SAS logg

PERAntiSpyware Scan Log

http://www.superantispyware.com

Generated 11/02/2007 at 11:46 AM

Application Version : 3.9.1008

Core Rules Database Version : 3336

Trace Rules Database Version: 1337

Scan type : Complete Scan

Total Scan Time : 00:45:57

Memory items scanned : 523

Memory threats detected : 0

Registry items scanned : 5716

Registry threats detected : 15

File items scanned : 34684

File threats detected : 7

Adware.Tracking Cookie

C:\Documents and Settings\Jonas\Cookies\jonas@advertising[2].txt

C:\Documents and Settings\Jonas\Cookies\[email protected][1].txt

C:\Documents and Settings\Jonas\Cookies\[email protected][2].txt

C:\Documents and Settings\Jonas\Cookies\[email protected][1].txt

Trojan.NewDotNet

HKU\.DEFAULT\Software\New.net

HKU\S-1-5-18\Software\New.net

Trojan.Unknown Origin

HKLM\SOFTWARE\Microsoft\MSSMGR

HKLM\SOFTWARE\Microsoft\MSSMGR#Data

HKLM\SOFTWARE\Microsoft\MSSMGR#LSTV

HKLM\SOFTWARE\Microsoft\MSSMGR#Brnd

HKLM\SOFTWARE\Microsoft\MSSMGR#Rid

HKLM\SOFTWARE\Microsoft\MSSMGR#LID

C:\VUNDOFIX BACKUPS\SERVICES.DLL.BAD

Adware.Toolbar888

HKCR\MyToolBar.MyToolBarObj.1

HKCR\MyToolBar.MyToolBarObj.1\CLSID

HKLM\Software\Classes\MyToolBar.MyToolBarObj.1

HKLM\Software\Classes\MyToolBar.MyToolBarObj.1\CLSID

Trojan.Malware

HKCR\MezziaCodec.Chl

HKCR\MezziaCodec.Chl\CLSID

Unclassified.PC MightyMax

HKU\S-1-5-21-796845957-1532298954-725345543-1002\Software\PC MightyMax

Trojan.SpySheriff

C:\DOCUMENTS AND SETTINGS\JONAS\HPNUNPYS.EXE

Smitfraudfix logg

SmitFraudFix v2.246

Scan done at 10:44:16,39, 02.11.2007

Run from C:\Documents and Settings\Jonas\Skrivebord\SmitfraudFix

OS: Microsoft Windows XP [Versjon 5.1.2600] - Windows_NT

The filesystem type is NTFS

Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix

!Attention, following keys are not inevitably infected!

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]

"incestuously"="{03413bf7-e34c-445b-bfc0-a2b127255871}"

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{7719505F-598E-441C-92D1-1C93C061B3DB}: DhcpNameServer=192.168.3.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{D8F10DC2-29C0-455B-8387-890A049F9DD2}: DhcpNameServer=192.168.1.1 4.2.2.2 4.2.2.3

HKLM\SYSTEM\CCS\Services\Tcpip\..\{E5A3FB4C-6749-42F2-9F5B-1CA91109CF1A}: DhcpNameServer=192.169.1.1

HKLM\SYSTEM\CS1\Services\Tcpip\..\{7719505F-598E-441C-92D1-1C93C061B3DB}: DhcpNameServer=192.168.3.1

HKLM\SYSTEM\CS1\Services\Tcpip\..\{D8F10DC2-29C0-455B-8387-890A049F9DD2}: DhcpNameServer=192.168.1.1 4.2.2.2 4.2.2.3

HKLM\SYSTEM\CS1\Services\Tcpip\..\{E5A3FB4C-6749-42F2-9F5B-1CA91109CF1A}: DhcpNameServer=192.169.1.1

HKLM\SYSTEM\CS2\Services\Tcpip\..\{7719505F-598E-441C-92D1-1C93C061B3DB}: DhcpNameServer=192.168.3.1

HKLM\SYSTEM\CS2\Services\Tcpip\..\{D8F10DC2-29C0-455B-8387-890A049F9DD2}: DhcpNameServer=192.168.1.1 4.2.2.2 4.2.2.3

HKLM\SYSTEM\CS2\Services\Tcpip\..\{E5A3FB4C-6749-42F2-9F5B-1CA91109CF1A}: DhcpNameServer=192.169.1.1

HKLM\SYSTEM\CS3\Services\Tcpip\..\{7719505F-598E-441C-92D1-1C93C061B3DB}: DhcpNameServer=192.168.3.1

HKLM\SYSTEM\CS3\Services\Tcpip\..\{D8F10DC2-29C0-455B-8387-890A049F9DD2}: DhcpNameServer=192.168.1.1 4.2.2.2 4.2.2.3

HKLM\SYSTEM\CS3\Services\Tcpip\..\{E5A3FB4C-6749-42F2-9F5B-1CA91109CF1A}: DhcpNameServer=192.169.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.3.1

HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.3.1

HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.3.1

HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.3.1

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System

!Attention, following keys are not inevitably infected!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix

!Attention, following keys are not inevitably infected!

SrchSTS.exe by S!Ri

Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

*NY* HJT Logg

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:10:09, on 02.11.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Programfiler\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Programfiler\ATI Technologies\ATI.ACE\cli.exe

C:\Programfiler\NavNT\vptray.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Programfiler\Sunbelt Software\CounterSpy\Consumer\sunserver.exe

C:\Programfiler\Messenger\msmsgs.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programfiler\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Programfiler\NavNT\defwatch.exe

C:\Programfiler\NavNT\rtvscan.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\MsgSys.EXE

C:\Programfiler\ATI Technologies\ATI.ACE\cli.exe

C:\Programfiler\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\NOTEPAD.EXE