Irreterende Win32/virut.gen virus

[war2war]

Har fått et **** plagsomt virus, infiserer alle exe filer som blir kjørt, har hatt dette viruset før,da måtte jeg formatere hele maskina kom ikke inn på explorer til slutt.

 

Bruker eset NOD32 antivirus,men får ikke fjernet det. Ser ikke ut som det er noe hjelp på symantec heller.

Noen som vet hvordan man fjerner dette. Andre gang jeg har fått dette. Aldri hatt problemer med å fjerne virus før dette, dette var et vansklig virus.

 

Heter :Win32/virut.gen

Endret 14. november 2007 av war2war

[norbat]

Kunne du ha postet en hjt-logg?

 

Last ned Hijackthis. Legg det i en egen mappe på skrivebordet.

Start programmet, velg "Do a system scan and save a logfile". Loggfilen kopierer du og poster.

[war2war]

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 00:45:34, on 15.11.2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe

C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

C:\Program Files\Eset\nod32krn.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Eset\nod32kui.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

C:\Program Files\Nero\Nero8\InCD\NBHGui.exe

C:\Program Files\Nero\Nero8\InCD\InCD.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.no/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://update.microsoft.com/microsoftupdate

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [Media Codec Update Service] C:\Program Files\Essentials Codec Pack\update.exe -silent

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [securDisc] C:\Program Files\Nero\Nero8\InCD\NBHGui.exe

O4 - HKLM\..\Run: [inCD] C:\Program Files\Nero\Nero8\InCD\InCD.exe

O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1193946732593

O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo.../sysreqlab2.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1193946699656

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jin...ows-i586-jc.cab

O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero8\InCD\InCDsrv.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

 

--

End of file - 6250 bytes

[norbat]

Den loggen ser grei ut.

 

Er det slik at NOD finner det, men får ikke fjernet/reparert de infisere filene?

Et alt. er å prøve å kjøre scannen fra sikker modus

 

Vi kunne ha prøvd en annen scan:

 

Hent Combofix, og legg det på skrivebordet

 

Kjør combofix.exe, og følg veiledningen.

Post loggfilen fra combofix (c:\combofix.txt)

 

Det kunne også vært en ide og sjekket med en onlinescan. Det finnes et utvalg av dem, bla. Bitdefender og Housecal. Hva sier de om dette?

[war2war]

Den loggen ser grei ut.

 

Er det slik at NOD finner det, men får ikke fjernet/reparert de infisere filene?

Et alt. er å prøve å kjøre scannen fra sikker modus

 

Vi kunne ha prøvd en annen scan:

 

Hent Combofix, og legg det på skrivebordet

 

Kjør combofix.exe, og følg veiledningen.

Post loggfilen fra combofix (c:\combofix.txt)

 

Det kunne også vært en ide og sjekket med en onlinescan. Det finnes et utvalg av dem, bla. Bitdefender og Housecal. Hva sier de om dette?

 

 

NOD finner filene som "suspicious files" men finner dem ikke i "In-depth analsysis"

 

her er combo fix loggen:

 

ComboFix 07-11-08.1 - John 2007-11-15 16:25:21.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.403 [GMT 1:00]

Running from: C:\Documents and Settings\X\Desktop\New Folder\ComboFix.exe

* Created a new restore point

.

 

((((((((((((((((((((((((( Files Created from 2007-10-15 to 2007-11-15 )))))))))))))))))))))))))))))))

.

 

2007-11-15 16:24 51,200 --a------ C:\WINDOWS\NirCmd.exe

2007-11-15 00:58 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7

2007-11-15 00:58 <DIR> d-------- C:\Documents and Settings\X\Application Data\AVG7

2007-11-15 00:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft

2007-11-15 00:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7

2007-11-15 00:58 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll

2007-11-15 00:58 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll

2007-11-15 00:45 <DIR> d-------- C:\Program Files\Trend Micro

2007-11-14 21:16 <DIR> d-------- C:\Program Files\EsetOnlineScanner

2007-11-13 20:32 <DIR> d-------- C:\Documents and Settings\X\Application Data\Nero

2007-11-13 20:29 <DIR> d-------- C:\Program Files\Nero

2007-11-13 20:29 <DIR> d-------- C:\Program Files\Common Files\Nero

2007-11-13 20:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero

2007-11-12 20:45 <DIR> d-------- C:\Documents and Settings\X\Application Data\Microsoft Games

2007-11-12 20:42 <DIR> d-------- C:\Program Files\DIFX

2007-11-12 20:42 36,864 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys

2007-11-12 17:42 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll

2007-11-12 17:42 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll

2007-11-12 17:42 1,358,192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll

2007-11-12 17:42 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll

2007-11-12 17:42 444,776 --a------ C:\WINDOWS\system32\d3dx10_35.dll

2007-11-12 17:42 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll

2007-11-12 17:42 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll

2007-11-12 17:42 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll

2007-11-12 17:42 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll

2007-11-12 17:07 <DIR> d-------- C:\Program Files\Microsoft Games

2007-11-12 00:51 <DIR> d-------- C:\Program Files\Smart Projects

2007-11-10 22:37 <DIR> d-------- C:\Program Files\MagicISO

2007-11-10 21:52 <DIR> d-------- C:\Documents and Settings\X\Contacts

2007-11-08 00:26 <DIR> d-------- C:\Program Files\DVD Decrypter

2007-11-07 23:48 <DIR> d-------- C:\WINDOWS\Sun

2007-11-07 23:48 <DIR> d-------- C:\Program Files\Java

2007-11-07 23:47 <DIR> d-------- C:\Program Files\Common Files\Java

2007-11-06 21:04 <DIR> d-------- C:\Documents and Settings\X\Application Data\BitTorrent

2007-11-04 18:49 271,224 --a------ C:\WINDOWS\system32\mucltui.dll

2007-11-03 20:42 <DIR> d-------- C:\Program Files\BitTorrent_DNA

2007-11-03 20:42 <DIR> d-------- C:\Documents and Settings\X\Application Data\BitTorrent DNA

2007-11-03 20:41 <DIR> d-------- C:\Program Files\BitTorrent

2007-11-02 01:52 <DIR> d-------- C:\Program Files\Xvid

2007-11-02 01:52 765,952 --a------ C:\WINDOWS\system32\xvidcore.dll

2007-11-02 01:52 180,224 --a------ C:\WINDOWS\system32\xvidvfw.dll

2007-11-02 01:19 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2007-11-02 01:18 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE

2007-11-02 01:18 <DIR> d-------- C:\Program Files\MSN Messenger

2007-11-02 01:17 <DIR> d-------- C:\Program Files\Essentials Codec Pack

2007-11-02 01:02 <DIR> d-------- C:\Documents and Settings\X\Application Data\Leadertech

2007-11-01 22:00 <DIR> d-------- C:\WINDOWS\pss

2007-11-01 21:58 <DIR> d-------- C:\WINDOWS\nview

2007-11-01 21:58 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe

2007-11-01 21:57 <DIR> d-------- C:\NVIDIA

2007-11-01 21:37 <DIR> d-------- C:\WINDOWS\Downloaded Installations

2007-11-01 21:37 <DIR> d-------- C:\Program Files\Common Files\Adobe

2007-11-01 21:33 <DIR> d-------- C:\Program Files\SystemRequirementsLab

2007-11-01 21:33 664 --a------ C:\WINDOWS\system32\d3d9caps.dat

2007-11-01 21:33 552 --a------ C:\WINDOWS\system32\d3d8caps.dat

2007-11-01 21:15 <DIR> d-------- C:\Program Files\MSBuild

2007-11-01 21:13 <DIR> d-------- C:\WINDOWS\system32\XPSViewer

2007-11-01 21:12 <DIR> d-------- C:\Program Files\Reference Assemblies

2007-11-01 21:12 14,048 --------- C:\WINDOWS\system32\spmsg2.dll

2007-11-01 21:04 <DIR> d-------- C:\Program Files\MSXML 6.0

2007-11-01 21:04 <DIR> d-------- C:\Program Files\MSXML 4.0

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-11-12 16:42 --------- d--h--w C:\Program Files\InstallShield Installation Information

2007-11-01 20:03 --------- d-----w C:\Program Files\Windows Media Connect 2

2007-11-01 19:51 60,416 ----a-w C:\WINDOWS\ALCFDRTM.EXE

2007-11-01 19:47 --------- d-----w C:\Program Files\Realtek Sound Manager

2007-11-01 19:47 --------- d-----w C:\Program Files\Common Files\InstallShield

2007-11-01 19:47 --------- d-----w C:\Program Files\AvRack

2007-11-01 19:39 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys

2007-11-01 19:39 298,104 ----a-w C:\WINDOWS\system32\imon.dll

2007-11-01 19:39 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys

2007-11-01 19:25 --------- d-----w C:\Program Files\microsoft frontpage

2007-09-17 01:10 356,352 ----a-w C:\WINDOWS\system32\nvusmb.exe

2007-09-17 01:10 356,352 ----a-w C:\WINDOWS\system32\nvunrm.exe

2007-09-17 01:10 356,352 ----a-w C:\WINDOWS\system32\NVUNINST.EXE

2007-09-17 00:07 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll

2007-09-17 00:07 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll

2007-09-17 00:07 8,491,008 ----a-w C:\WINDOWS\system32\nvcpl.dll

2007-09-17 00:07 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe

2007-09-17 00:07 6,853,088 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys

2007-09-17 00:07 6,746,112 ----a-w C:\WINDOWS\system32\nvoglnt.dll

2007-09-17 00:07 6,344,704 ----a-w C:\WINDOWS\system32\nvdisps.dll

2007-09-17 00:07 5,783,040 ----a-w C:\WINDOWS\system32\nv4_disp.dll

2007-09-17 00:07 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll

2007-09-17 00:07 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll

2007-09-17 00:07 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe

2007-09-17 00:07 425,984 ----a-w C:\WINDOWS\system32\keystone.exe

2007-09-17 00:07 364,544 ----a-w C:\WINDOWS\system32\nvapi.dll

2007-09-17 00:07 36,864 ----a-w C:\WINDOWS\system32\nvcodins.dll

2007-09-17 00:07 36,864 ----a-w C:\WINDOWS\system32\nvcod.dll

2007-09-17 00:07 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll

2007-09-17 00:07 3,551,232 ----a-w C:\WINDOWS\system32\nvvitvs.dll

2007-09-17 00:07 3,334,144 ----a-w C:\WINDOWS\system32\nvgames.dll

2007-09-17 00:07 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll

2007-09-17 00:07 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll

2007-09-17 00:07 2,371,584 ----a-w C:\WINDOWS\system32\nvwss.dll

2007-09-17 00:07 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll

2007-09-17 00:07 155,716 ----a-w C:\WINDOWS\system32\nvsvc32.exe

2007-09-17 00:07 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe

2007-09-17 00:07 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll

2007-09-17 00:07 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe

2007-09-17 00:07 1,478,656 ----a-w C:\WINDOWS\system32\nview.dll

2007-09-17 00:07 1,339,392 ----a-w C:\WINDOWS\system32\nvdspsch.exe

2007-09-17 00:07 1,150,976 ----a-w C:\WINDOWS\system32\nvmobls.dll

2007-09-17 00:07 1,019,904 ----a-w C:\WINDOWS\system32\nvwimg.dll

2007-08-21 06:25 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-11-01 20:39]

"SoundMan"="SOUNDMAN.EXE" [2004-11-15 11:20 C:\WINDOWS\SOUNDMAN.EXE]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07]

"nwiz"="nwiz.exe" [2007-09-17 01:07 C:\WINDOWS\system32\nwiz.exe]

"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07]

"Media Codec Update Service"="C:\Program Files\Essentials Codec Pack\update.exe" [2007-04-08 17:44]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]

"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2006-09-26 21:07]

"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-11-15 00:58]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [2007-08-03 12:51]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]

"C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]

"C:\Program Files\BitTorrent_DNA\dna.exe"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]

C:\Program Files\Nero\Nero8\InCD\InCD.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

"C:\Program Files\Messenger\msmsgs.exe" /background

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]

"C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]

C:\Program Files\Nero\Nero8\InCD\NBHGui.exe

 

R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3;C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

 

*Newly Created Service* - AVG7ALRT

*Newly Created Service* - AVG7CORE

*Newly Created Service* - AVG7RSW

*Newly Created Service* - AVG7RSXP

*Newly Created Service* - AVG7UPDSVC

*Newly Created Service* - AVGCLEAN

*Newly Created Service* - AVGEMS

*Newly Created Service* - AVGTDI

*Newly Created Service* - CATCHME

.

**************************************************************************

 

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-11-15 16:26:43

Windows 5.1.2600 Service Pack 2 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

Completion time: 2007-11-15 16:27:13

.

--- E O F ---

[norbat]

Combofix-loggen ser grei ut.

 

Får du noe info om hva fila heter og hvor den evt. ligger på systemet?

Har du kjørt noen av onlinescannerne?

[war2war]

Combofix-loggen ser grei ut.

 

Får du noe info om hva fila heter og hvor den evt. ligger på systemet?

Har du kjørt noen av onlinescannerne?

 

 

Kjørte BitDefender, fant 13 (virus detected:Win32.Virtob.2.Gen) (kjært barn har mange navn:)

alle så til å være i ESET aka NOD32 - karantene.

oppdaterte til siste NOD32 update 2661, finner ikke noe,mere virus.

Får bare "NOD32 submissions of suspicious files"

 

Har du en fremgangs måte for disse win32.virut virusene?

Endret 15. november 2007 av war2war

[norbat]

Er det slik at du fortsatt plages med virus og hva gjør evt. dette?

 

De virusene som er i karantene, er uskadeliggjort, men det visste du sikkert. Disse er det bare å slette permanent fra PC-en.