Gå til innhold

Virus i msn messenger

Minnimus

Av Minnimus
i IKT-drift og sikkerhet

Anbefalte innlegg

Videoannonse

Videoannonse
Annonse
norbat

norbat

Skrevet
Skrevet

Last ned MSNFix, og pakk det ut på skrivebordet.

Kjør filen 'MSNFix.bat'. Følg veiledningen

 

 

Hent Combofix, og legg det på skrivebordet

 

Kjør combofix.exe, og følg veiledningen.

Du må ikke klikke på vinduet mens programmet kjører.

 

Post loggfilen fra combofix (c:\combofix.txt) + loggen fra MSNFix.

Lenke til kommentar
Minnimus

Minnimus

Skrevet
  • Forfatter
Skrevet (endret)

ComboFix 08-03-26.3 - 2008-03-27 22:52:25.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1044.18.153 [GMT 1:00]

Running from: C:\Documents and Settings\Skrivebord\ComboFix.exe

* Created a new restore point

 

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

-- Script messages for sUBs --

GREP -Fis \baiso

VFind -td "C:\WINDOWS\system32\*"

 

((((((((((((((((((((((((( Files Created from 2008-02-27 to 2008-03-27 )))))))))))))))))))))))))))))))

.

 

2008-03-01 16:36 . 2006-11-30 14:13 61,536 -ra------ C:\WINDOWS\SYSTEM32\DRIVERS\se45bus.sys

2008-03-01 16:36 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\usbccgp.sys

2008-03-01 16:36 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\usbccgp.sys

2008-03-01 16:36 . 2006-11-30 14:14 5,872 -ra------ C:\WINDOWS\SYSTEM32\DRIVERS\se45whnt.sys

2008-03-01 16:36 . 2006-11-30 14:14 5,872 -ra------ C:\WINDOWS\SYSTEM32\DRIVERS\se45wh.sys

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-03-27 21:57 --------- d-----w C:\Programfiler\Fellesfiler\Symantec Shared

2008-03-20 18:22 --------- d-----w C:\Documents and Settings\All Users\Programdata\Symantec

2008-02-13 23:26 --------- d-----w C:\Programfiler\Lavasoft

2008-02-13 23:26 --------- d-----w C:\Documents and Settings\Programdata\Lavasoft

2005-05-20 21:23 1,787,597 ----a-w C:\Programfiler\bitcomet.exe

2005-05-20 20:26 823,296 ----a-w C:\Programfiler\winmx353.exe

.

 

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]

"msnmsgr"="C:\Programfiler\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54 5674352]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="C:\Programfiler\Apoint\Apoint.exe" [2004-09-13 12:33 155648]

"IntelWireless"="C:\Programfiler\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 15:59 385024]

"Dell QuickSet"="C:\Programfiler\Dell\QuickSet\quickset.exe" [2004-10-07 20:44 610304]

"DVDLauncher"="C:\Programfiler\filer\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 17:54 57344]

"ccApp"="C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe" [2005-03-30 13:27 71256]

"URLLSTCK.exe"="C:\Programfiler\Norton Internet Security\UrlLstCk.exe" [2004-02-02 08:03 70760]

"UpdateManager"="C:\Programfiler\Fellesfiler\Sonic\Update Manager\sgtray.exe" [2004-01-07 02:01 110592]

"DMXLauncher"="C:\Programfiler\Dell\Media Experience\DMXLauncher.exe" [2004-09-15 02:01 86016]

"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05 127035]

"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2005-05-18 19:10 100056]

"SunJavaUpdateSched"="C:\Programfiler\Java\jre1.5.0_04\bin\jusched.exe" [2005-06-03 02:52 36975]

"iTunesHelper"="C:\Programfiler\iTunes\iTunesHelper.exe" [2005-06-24 14:16 278528]

"QuickTime Task"="C:\Programfiler\QuickTime\qttask.exe" [2005-09-26 06:20 98304]

"PicasaNet"="C:\Programfiler\Hello\Hello.exe" [ ]

"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 08:35 94208]

"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 08:32 77824]

"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 08:36 114688]

"Sony Ericsson PC Suite"="C:\Programfiler\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2006-11-24 00:06 487424]

"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 13:00 158208]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]

 

C:\Documents and Settings\All Users\Start-meny\Programmer\Oppstart\

BTTray.lnk - C:\Programfiler\Dell\Bluetooth Software\BTTray.exe [2004-04-08 23:23:40 561213]

Cisco Systems VPN Client.lnk - C:\Programfiler\Cisco Systems\VPN Client\vpngui.exe [2006-02-20 11:33:57 1385400]

Digital Line Detect.lnk - C:\Programfiler\Digital Line Detect\DLG.exe [2005-03-09 22:01:53 24576]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]

C:\Programfiler\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 17:08 110592 C:\Programfiler\Intel\Wireless\Bin\LgNotify.dll

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]

--a------ 2007-01-19 11:54 5674352 C:\Programfiler\MSN Messenger\MsnMsgr.exe

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

 

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"C:\\Programfiler\\Messenger\\msmsgs.exe"=

"C:\\Programfiler\\iTunes\\iTunes.exe"=

"C:\\Programfiler\\LimeWire\\LimeWire.exe"=

"C:\\Documents and Settings\\Skrivebord\\utorrent.exe"=

"C:\\Programfiler\\MSN Messenger\\msnmsgr.exe"=

"C:\\Programfiler\\MSN Messenger\\livecall.exe"=

 

S3 SE2Ebus;Sony Ericsson Device 046 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\SE2Ebus.sys [2006-11-10 17:23]

S3 SE2Emdfl;Sony Ericsson Device 046 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\SE2Emdfl.sys [2006-11-10 17:23]

S3 SE2Emdm;Sony Ericsson Device 046 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\SE2Emdm.sys [2006-11-10 17:23]

S3 SE2Emgmt;Sony Ericsson Device 046 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\SE2Emgmt.sys [2006-11-10 17:23]

S3 se2End5;Sony Ericsson Device 046 USB Ethernet Emulation SEMC46 (NDIS);C:\WINDOWS\system32\DRIVERS\se2End5.sys [2006-11-10 17:23]

S3 SE2Eobex;Sony Ericsson Device 046 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\SE2Eobex.sys [2006-11-10 17:23]

S3 se2Eunic;Sony Ericsson Device 046 USB Ethernet Emulation SEMC46 (WDM);C:\WINDOWS\system32\DRIVERS\se2Eunic.sys [2006-11-10 17:24]

 

*Newly Created Service* - CATCHME

.

Contents of the 'Scheduled Tasks' folder

"2008-03-14 20:18:01 C:\WINDOWS\Tasks\Norton AntiVirus - Søk på min datamaskin.job"

- C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exec/task:

"2008-03-26 22:55:50 C:\WINDOWS\Tasks\Symantec NetDetect.job"

- C:\Programfiler\Symantec\LiveUpdate\NDETECT.EXE

.

**************************************************************************

 

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-03-27 22:57:41

Windows 5.1.2600 Service Pack 2 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

Completion time: 2008-03-27 23:00:16

ComboFix-quarantined-files.txt 2008-03-27 22:00:07

Pre-Run: 33,961,529,344 byte ledig

Post-Run: 34,450,616,320 byte ledig

.

2008-03-12 10:55:12 --- E O F ---

Endret av Minnimus
Lenke til kommentar
Minnimus

Minnimus

Skrevet
  • Forfatter
Skrevet (endret)
Loggen viser ingen infeksjoner. Er det fortsatt slik at når du åpner MSN, så starter den å sende ut disse meldingene?

 

Hvis, kan du scanne med et antispywareprogram, eks. SAS (gratisversjonen).

 

har kjørt spybot i sikkerhetsmodus. får håpe det tar det. den sender ut linker selv når jeg ikke er pålogget

Endret av Minnimus
Lenke til kommentar
norbat

norbat

Skrevet
Skrevet

Hvordan går det?

Plages du fortsatt?

 

Hvis:

Da combofix loggen ikke viser noen filer knyttet til dette, kan det være en ide å avinstallere MSN for å se om ikke problemet ligger i selve programmet. Reinstaller så MSN og se om ikke ting og tang har blitt bedre

Lenke til kommentar
weebl

weebl

Skrevet
Skrevet

etter som at det er noe dritt som sendes sjøl når du ikke er på kan du jo bytte passordet ditt bare.

 

husker at jeg fikk en slik sak en gang for lenge siden når jeg skulle prøve ut noe som utga seg for å være en msn block chekcer.

Lenke til kommentar

Opprett en konto eller logg inn for å kommentere

Du må være et medlem for å kunne skrive en kommentar

Opprett konto

Det er enkelt å melde seg inn for å starte en ny konto!

Start en konto

Logg inn

Har du allerede en konto? Logg inn her.

Logg inn nå
Gå til emneliste
×
×
  • Opprett ny...