hjelp med Hjt logg

[ebakka]

hei

har fått et virus som heter: backdoor.win32.agent.dbo

er det noen som kan hjelpe meg med å få bort den da jeg ikke vet hva jeg skal gjøre?

 

har kjørt Hjt:

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 01:20:42, on 27.01.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\Ahead\InCD\InCDsrv.exe

C:\WINDOWS\system32\svchost.exe

E:\programmer\Ad Aware SE\aawservice.exe

C:\WINDOWS\Explorer.EXE

E:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE

C:\Programfiler\D-Link\AirPlus G\AirGCFG.exe

C:\Programfiler\ANI\ANIWZCS2 Service\WZCSLDR2.exe

C:\WINDOWS\system32\ctfmon.exe

E:\programmer\Acer P630\wcescomm.exe

E:\PROGRA~1\ACERP6~1\rapimgr.exe

C:\WINDOWS\system32\spoolsv.exe

E:\programmer\F-Secure\Ventelo Sikkerhet\Anti-Virus\fsgk32st.exe

E:\programmer\F-Secure\Ventelo Sikkerhet\Anti-Virus\FSGK32.EXE

E:\programmer\F-Secure\Ventelo Sikkerhet\Common\FSMA32.EXE

C:\WINDOWS\System32\nvsvc32.exe

E:\programmer\F-Secure\Ventelo Sikkerhet\Common\FSMB32.EXE

E:\programmer\F-Secure\Ventelo Sikkerhet\Common\FCH32.EXE

E:\programmer\F-Secure\Ventelo Sikkerhet\Anti-Virus\fssm32.exe

E:\programmer\F-Secure\Ventelo Sikkerhet\Anti-Virus\fsqh.exe

E:\programmer\F-Secure\Ventelo Sikkerhet\Common\FAMEH32.EXE

E:\programmer\F-Secure\Ventelo Sikkerhet\FSAUA\program\fsaua.exe

E:\programmer\F-Secure\Ventelo Sikkerhet\FWES\Program\fsdfwd.exe

E:\programmer\F-Secure\Ventelo Sikkerhet\FSGUI\fsguidll.exe

E:\programmer\F-Secure\Ventelo Sikkerhet\FSAUA\program\fsus.exe

E:\programmer\F-Secure\Ventelo Sikkerhet\Anti-Virus\fsav32.exe

C:\WINDOWS\System32\svchost.exe

C:\Programfiler\BitTorrent\bittorrent.exe

C:\Programfiler\Internet Explorer\IEXPLORE.EXE

C:\Documents and Settings\Eivind\Skrivebord\Ht\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.startsiden.no/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\programmer\Spybot\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [EM_EXEC] E:\PROGRA~1\Logitech\MOUSEW~1\SYSTEM\EM_EXEC.EXE

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Programfiler\D-Link\AirPlus G\AirGCFG.exe

O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programfiler\ANI\ANIWZCS2 Service\WZCSLDR2.exe

O4 - HKLM\..\Run: [F-Secure Manager] "E:\programmer\F-Secure\Ventelo Sikkerhet\Common\FSM32.EXE" /splash

O4 - HKLM\..\Run: [F-Secure TNB] "E:\programmer\F-Secure\Ventelo Sikkerhet\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [H/PC Connection Agent] "E:\programmer\Acer P630\wcescomm.exe"

O4 - HKCU\..\Run: [updateMgr] "C:\Programfiler\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETTVERKSTJENESTE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programfiler\Fellesfiler\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programfiler\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html...YNO_ZS7760XXXNO

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\j2re1.4.2_04\bin\npjpi142_04.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\j2re1.4.2_04\bin\npjpi142_04.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\ACERP6~1\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\ACERP6~1\INetRepl.dll

O9 - Extra 'Tools' menuitem: Opprett mobil favoritt... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - E:\PROGRA~1\ACERP6~1\INetRepl.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {1C3DE665-D259-4C72-9D7D-C51FCB4CCFB9} (Panasonic Network Camera) - http://cftdynocam.viewnetcam.com:50000/SysCamInst.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by106fd.bay106.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/16476b66b12d53...ip/RdxIE601.cab

O16 - DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} (AxisMediaControl Class) - http://srif.eurofrag.com/axis/AMC.cab

O16 - DPF: {A8739816-022C-11D6-A85D-00C04F9AEAFB} (Web Camera Server Control) - http://aloha.dnsalias.org:81/wg_webeye.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse...pDownloader.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - E:\programmer\Ad Aware SE\aawservice.exe

O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - E:\programmer\F-Secure\Ventelo Sikkerhet\Anti-Virus\fsgk32st.exe

O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - E:\programmer\F-Secure\Ventelo Sikkerhet\FSAUA\program\fsaua.exe

O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - E:\programmer\F-Secure\Ventelo Sikkerhet\FWES\Program\fsdfwd.exe

O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - E:\programmer\F-Secure\Ventelo Sikkerhet\Common\FSMA32.EXE

O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe

O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Programfiler\Ahead\InCD\InCDsrv.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

 

--

End of file - 7760 bytes

 

takker for svar..

[5-7]

Du kan ihvertfall trykke fix checked på denne

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

[snippsat]

Last ned til skrivebord SDFix

Pakk ut til C:\SDFix

 

Neste punkt.

Boot trykk f8 sikkerhtmodus.

Mappe C:\SDFix->kjør RunThis.bat

Svar ja.

Press any key og boot normalt.

Når ferdig,finn Report.txt

Post den her.

Og en ny hjt-logg.

Endret 29. januar 2008 av SNIPPSAT

[5-7]

Litt OT: Hvordan så du at han trengte denne? Bare en anbefaling , eller ligger det noe der?

Prøver å lære meg å lese disse loggene bedre.

 

EDIT: Så må jeg visst også lære meg å lese førstepost bedre, og ikke hoppe rett til loggen..

Endret 27. januar 2008 av 5-7

[snippsat]

Bør bruke litt tid på dette med logger ja.

Ikke bare bruke http://www.hijackthis.de/

Et godt utgangspunkt,for og komme videre.

Og lese postene til norbat er lurt.

 

Det jeg vil at sdfix skal fixe er dette.

O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe

 

Så får vi se Report.txt

Om den har gjort det.

Endret 27. januar 2008 av SNIPPSAT