Shell32.dll Hvordan bli kvitt?

santacruze · 12. januar 2008

Har et virus men vet ikke helt hva det er eller gjør. AVG finner viruset men gjør ikke noe med det. har hørt at hvis man bruker internet explorer begynner det og gjøre ting (heldigvis har jeg opera)

lurer på hvordan man fjerner dette viruset, kan jeg bare slette filen?

takker for svar på forhånd!

dizzled · 12. januar 2008

Jeg hadde samme problemet før, men jeg bare formaterte. Men jeg tror den er umulig å slette om jeg husker riktig (det er en stund siden), eller så kommer den bare igjen og igjen. Prøvd et annet virus program? Jeg har byttet siden den gang, og NOD32 funker bra for meg i allefall

santacruze · 12. januar 2008

har ikke veldig lyst til og formatere for øyeblikket. noen forslag til antivirus program som kan fjerne den??

norbat · 12. januar 2008

Hent Combofix, og legg det på skrivebordet

Kjør combofix.exe, og følg veiledningen.

Du må ikke klikke på vinduet mens programmet kjører.

Post loggfilen fra combofix (c:\combofix.txt).

santacruze · 12. januar 2008

poste her?

santacruze · 12. januar 2008

skal gjøre det snart, men kan noen forklare meg hva det gjør?

norbat · 12. januar 2008

skal gjøre det snart, men kan noen forklare meg hva det gjør?

Det fjerner en del kjente infeksjoner og lager en logg som viser nylig opprettede filer samt noen registeroppføringer.

santacruze · 12. januar 2008

så den fjerner shell32?

norbat · 12. januar 2008

Kommer litt an på hvilken Shell32.dll dette er og om det er dette som er problemet. Host opp loggen, så tar vi et titt

santacruze · 12. januar 2008

ok! lastet ned noe veldig viktig (en patch) på 5 gig så hvis pcen måtte restarte hadde alt vært forjeves så begynner om 5-10 min! tusen hjertelig takk for hjelpen!

santacruze · 12. januar 2008

ComboFix 08-01-13.1 - Magnus 2008-01-13 22:13:23.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1044.18.1026 [GMT 1:00]

Running from: C:\Documents and Settings\Magnus\Skrivebord\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((( Files Created from 2007-12-13 to 2008-01-13 )))))))))))))))))))))))))))))))

.

2008-01-12 22:07 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe

2008-01-12 16:14 . 2008-01-12 16:14 <DIR> d-------- C:\Programfiler\Funcom

2008-01-12 16:14 . 2008-01-12 16:14 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\Funcom

2008-01-12 15:23 . 2008-01-12 15:40 <DIR> d-------- C:\WINDOWS\LastGood

2008-01-12 15:23 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll

2008-01-12 15:23 . 2007-10-12 15:14 1,374,232 --a------ C:\WINDOWS\system32\D3DCompiler_36.dll

2008-01-12 15:23 . 2007-10-02 09:56 444,776 --a------ C:\WINDOWS\system32\d3dx10_36.dll

2008-01-12 15:23 . 2007-10-22 03:39 267,272 --a------ C:\WINDOWS\system32\xactengine2_10.dll

2008-01-11 21:37 . 2008-01-12 17:22 <DIR> d-------- C:\Documents and Settings\Magnus\Programdata\OpenOffice.org2

2008-01-11 21:36 . 2008-01-11 21:36 <DIR> d-------- C:\Programfiler\OpenOffice.org 2.3

2008-01-09 23:41 . 2008-01-09 23:41 <DIR> d-------- C:\ConverterOutput

2008-01-09 23:40 . 2008-01-09 23:40 <DIR> d-------- C:\Programfiler\Cucusoft

2008-01-09 23:02 . 2008-01-09 23:02 <DIR> d-------- C:\Programfiler\Apex

2008-01-09 22:41 . 2008-01-09 22:41 <DIR> d-------- C:\Programfiler\Ipod Video Converter

2008-01-09 22:41 . 2005-05-14 21:09 2,179,072 --a------ C:\WINDOWS\system32\mfc71d.dll

2008-01-08 00:21 . 2008-01-08 00:21 <DIR> d-------- C:\Programfiler\Lavasoft

2008-01-08 00:21 . 2008-01-08 00:21 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\Lavasoft

2007-12-30 01:08 . 2007-12-30 01:08 <DIR> d-------- C:\Documents and Settings\Magnus\Programdata\Zylom

2007-12-30 01:07 . 2007-12-30 01:07 <DIR> d-------- C:\Programfiler\Zylom Games

2007-12-30 01:07 . 2007-12-30 01:07 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\Zylom

2007-12-20 17:51 . 2007-12-20 17:51 <DIR> d-------- C:\Program Files

2007-12-20 17:38 . 2007-12-20 17:38 <DIR> d-------- C:\WINDOWS\system32\AGEIA

2007-12-20 17:38 . 2007-12-20 17:38 <DIR> d-------- C:\Programfiler\AGEIA Technologies

2007-12-20 17:18 . 2007-12-20 17:18 <DIR> d-------- C:\Programfiler\Sony

2007-12-20 17:18 . 2007-12-20 17:18 <DIR> d-------- C:\Programfiler\Flying Lab Software

2007-12-20 11:48 . 2008-01-12 12:20 54,156 --ah----- C:\WINDOWS\QTFont.qfn

2007-12-20 11:48 . 2007-12-20 11:48 1,409 --a------ C:\WINDOWS\QTFont.for

2007-12-20 11:47 . 2007-12-20 11:47 <DIR> d-------- C:\Programfiler\iTunes

2007-12-20 11:47 . 2007-12-20 11:47 <DIR> d-------- C:\Programfiler\iPod

2007-12-20 11:47 . 2007-12-21 12:04 <DIR> d-------- C:\Documents and Settings\Magnus\Programdata\Apple Computer

2007-12-20 11:46 . 2007-12-20 17:39 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE

2007-12-20 11:46 . 2007-12-20 11:47 <DIR> d-------- C:\Programfiler\QuickTime

2007-12-20 11:46 . 2007-12-20 11:46 <DIR> d-------- C:\Programfiler\Fellesfiler\Apple

2007-12-20 11:46 . 2007-12-20 11:46 <DIR> d-------- C:\Programfiler\Apple Software Update

2007-12-20 11:46 . 2007-12-20 11:47 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\Apple Computer

2007-12-20 11:46 . 2007-12-20 11:46 <DIR> d-------- C:\Documents and Settings\All Users\Programdata\Apple

2007-12-20 11:46 . 2007-10-31 14:09 30,464 --a------ C:\WINDOWS\system32\drivers\usbaapl.sys

2007-12-16 15:00 . 2007-12-16 15:00 <DIR> d-------- C:\Programfiler\MSXML 6.0

2007-12-16 01:22 . 2007-12-16 01:22 <DIR> d-------- C:\WINDOWS\system32\nb-NO

2007-12-16 01:21 . 2007-12-16 01:21 <DIR> d-------- C:\Programfiler\MSBuild

2007-12-16 01:17 . 2007-12-16 01:31 <DIR> d-------- C:\WINDOWS\system32\XPSViewer

2007-12-16 01:16 . 2007-12-16 01:16 <DIR> d-------- C:\Programfiler\Reference Assemblies

2007-12-16 01:16 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-01-12 18:56 --------- d-----w C:\Programfiler\Steam

2008-01-12 16:22 --------- d-----w C:\Documents and Settings\Magnus\Programdata\AVG7

2008-01-12 14:42 --------- d--h--w C:\Programfiler\InstallShield Installation Information

2008-01-11 07:13 --------- d-----w C:\Documents and Settings\Magnus\Programdata\uTorrent

2008-01-10 18:55 --------- d-----w C:\Documents and Settings\Magnus\Programdata\gtk-2.0

2008-01-08 00:54 --------- d-----w C:\Documents and Settings\Magnus\Programdata\FrostWire

2008-01-07 23:21 --------- d-----w C:\Programfiler\Fellesfiler\Wise Installation Wizard

2007-12-20 16:57 --------- d-----w C:\Programfiler\The Witcher

2007-12-14 22:18 --------- d-----w C:\Documents and Settings\Magnus\Programdata\Hamachi

2007-12-14 14:00 --------- d-----w C:\Programfiler\Norton Security Scan

2007-12-12 18:08 --------- d-----w C:\Programfiler\SEGA

2007-12-12 17:44 --------- d-----w C:\Documents and Settings\Magnus\Programdata\InstallShield

2007-12-12 15:38 --------- d-----w C:\Documents and Settings\Magnus\Programdata\U3

2007-12-11 13:13 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys

2007-12-11 13:08 --------- d-----w C:\Programfiler\Hamachi

2007-12-10 22:23 --------- d-----w C:\Documents and Settings\All Users\Programdata\FLEXnet

2007-12-10 22:06 --------- d-----w C:\Programfiler\Fellesfiler\Adobe

2007-12-10 22:05 --------- d-----w C:\Programfiler\Fellesfiler\Macrovision Shared

2007-12-02 13:04 --------- d-----w C:\Documents and Settings\Magnus\Programdata\Ventrilo

2007-12-02 01:31 --------- d-----w C:\Documents and Settings\Magnus\Programdata\mIRC

2007-12-02 00:19 --------- d-----w C:\Programfiler\mIRC

2007-12-01 14:20 --------- d-----w C:\Programfiler\Ventrilo

2007-12-01 10:26 413,696 ----a-w C:\WINDOWS\system32\wrap_oal.dll

2007-12-01 10:26 110,592 ----a-w C:\WINDOWS\system32\OpenAL32.dll

2007-12-01 10:26 --------- d-----w C:\Programfiler\OpenAL

2007-12-01 10:26 --------- d-----w C:\Programfiler\Eidos

2007-11-30 23:39 --------- d-----w C:\Documents and Settings\Magnus\Programdata\Azureus

2007-11-30 23:36 --------- d-----w C:\Documents and Settings\All Users\Programdata\Azureus

2007-11-30 18:58 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys

2007-11-30 18:58 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe

2007-11-30 15:32 --------- d-----w C:\Programfiler\Codemasters

2007-11-29 11:44 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe

2007-11-26 14:52 --------- d-----w C:\Documents and Settings\All Users\Programdata\WhiteCap (Holiday Edition)

2007-11-21 13:27 --------- d-----w C:\Programfiler\Total Video Converter

2007-11-19 13:18 --------- d---a-w C:\Documents and Settings\All Users\Programdata\TEMP

2007-11-16 16:30 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll

2007-11-16 16:30 --------- d--h--r C:\Documents and Settings\Magnus\Programdata\SecuROM

2007-11-16 16:28 --------- d-----w C:\Programfiler\GameSpy

2007-11-16 16:27 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe

2007-11-16 16:27 22,328 ----a-w C:\Documents and Settings\Magnus\Programdata\PnkBstrK.sys

2007-11-14 17:01 --------- d-----w C:\Programfiler\Windows Media Connect 2

2007-11-14 16:44 --------- d-----w C:\Programfiler\FrostWire

2007-11-13 17:57 --------- d-----w C:\Documents and Settings\Magnus\Programdata\LimeWire

2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys

2007-11-07 09:30 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll

2007-10-30 23:13 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll

2007-10-30 23:13 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll

2007-10-29 22:45 1,290,752 ----a-w C:\WINDOWS\system32\quartz.dll

2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll

2007-10-24 00:47 96,760 ----a-w C:\WINDOWS\system32\dfshim.dll

2007-10-24 00:47 84,480 ----a-w C:\WINDOWS\system32\mscories.dll

2007-10-24 00:47 282,112 ----a-w C:\WINDOWS\system32\mscoree.dll

2007-10-24 00:47 158,720 ----a-w C:\WINDOWS\system32\mscorier.dll

2007-10-22 02:37 17,928 ----a-w C:\WINDOWS\system32\X3DAudio1_2.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Steam"="c:\programfiler\steam\steam.exe" [2007-11-30 08:00 1266936]

"AlcoholAutomount"="C:\Programfiler\Alcohol Soft\Alcohol 52\axcmd.exe" [2007-07-02 11:22 219008]

"DAEMON Tools Pro Agent"="C:\Programfiler\DAEMON Tools Pro\DTProAgent.exe" [2007-09-06 14:08 136136]

"MSMSGS"="C:\Programfiler\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-09-28 20:06 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMAXPnP"="C:\Programfiler\Analog Devices\Core\smax4pnp.exe" [2004-10-14 15:42 1404928]

"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]

"nwiz"="nwiz.exe" [2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe]

"PWRISOVM.EXE"="C:\Programfiler\PowerISO\PWRISOVM.EXE" [2007-08-07 01:05 200704]

"SunJavaUpdateSched"="C:\Programfiler\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07 81920]

"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-21 09:37 579072]

"Acrobat Assistant 8.0"="C:\Programfiler\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 23:24 620152]

"QuickTime Task"="C:\Programfiler\QuickTime\QTTask.exe" [2007-12-11 10:56 286720]

"iTunesHelper"="C:\Programfiler\iTunes\iTunesHelper.exe" [2007-12-11 12:10 267048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-09-28 20:06 15360]

"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-31 00:13 219136]

C:\Documents and Settings\Magnus\Start-meny\Programmer\Oppstart\

OpenOffice.org 2.3.lnk - C:\Programfiler\OpenOffice.org 2.3\program\quickstart.exe [2007-09-11 05:43:54]

C:\Documents and Settings\All Users\Start-meny\Programmer\Oppstart\

Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe [2007-12-10 23:05:31]

Adobe Acrobat Synchronizer.lnk - C:\Programfiler\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 00:01:50]

Winter Fun Wallpaper Changer.lnk - C:\WINDOWS\Installer\{038A524F-58DB-438A-8391-8F7F0CA14B9E}\Icon038A524F.exe [2007-11-15 12:35:15]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{84d1d2e3-86e4-11dc-a82c-001111b02c6d}]

\Shell\AutoRun\command - G:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9aa5322f-8975-11dc-a839-001111b02c6d}]

\Shell\AutoRun\command - K:\LaunchU3.exe -a

*Newly Created Service* - PROCEXP90

.

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-01-13 22:14:04

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-01-13 22:14:24

ComboFix2.txt 2008-01-13 21:11:47

.

2008-01-11 15:32:44 --- E O F ---

santacruze · 12. januar 2008

hmmm, før jeg kjørte programmet var cpuen min på 90-100% konstant, nå som pcen er reboote (etter programmet) holder den seg på 6-10 % er viruset borte?

norbat · 12. januar 2008

Loggen ser grei ut.

Hvor finner/fant AVG denne fila?

Last ned Hijackthis. Legg det i en egen mappe på skrivebordet.

Start programmet, velg "Do a system scan and save a logfile". Loggfilen kopierer du og poster.

santacruze · 12. januar 2008

filen ligger i windows mappen og avg kaller den type: Change

norbat · 12. januar 2008

Men det bruker AVG å melde når enkelte filer er forandret. Dette har ingenting med virus å gjøre.

Man kan slå av dette varselet om man ønsker.

Mer info: http://forum.grisoft.cz/freeforum/read.php...6,backpage=,sv=

Selv om ikke Shell32.dll står spesifikt, så gjelder det i all høyeste grad denne filen også.

Litt info om Shell32.dll: http://www.liutilities.com/products/wintas...ibrary/shell32/

Endret 12. januar 2008 av norbat

santacruze · 13. januar 2008

oki, takk så mye

Logg inn

Shell32.dll Hvordan bli kvitt?

Anbefalte innlegg

santacruze

Lenke til kommentar

Videoannonse

dizzled

Lenke til kommentar

santacruze

Lenke til kommentar

norbat

Lenke til kommentar

santacruze

Lenke til kommentar

santacruze

Lenke til kommentar

norbat

Lenke til kommentar

santacruze

Lenke til kommentar

norbat

Lenke til kommentar

santacruze

Lenke til kommentar

santacruze

Lenke til kommentar

santacruze

Lenke til kommentar

norbat

Lenke til kommentar

santacruze

Lenke til kommentar

norbat

Lenke til kommentar

santacruze

Lenke til kommentar

Opprett en konto eller logg inn for å kommentere

Opprett konto

Logg inn

Hvem er aktive 0 medlemmer