[LØST] Vi trenger hjelp med trojan vundo.

killerbanana · 17. april 2008

vi har en data som har blitt overtatt av en liten snik, med andre ord, en trojan vundo. Og han vil bare ha selskap, så han får andre kjipinger til å komme. Og vi kommer ikke inn på internett, så vi får ikke lastet ned noe som helst. Hva kan vi gjøre? :ohmy:

Endret 19. april 2008 av killerbanana

r2d290 · 17. april 2008

Alternativ1: Boot trykk f8 flere ganger,velg sikkerhetmodus med nettverk.

Alternativ2: Last ned de følgende filene med en annen maskin, og flytt dem over med minnepinne

Gjør dette.

Last ned HijackThis legg i egen mappe på skrivebordet.

Start programmet og velg "Trykk "do a systemscan and save a logfile"" .

Loggfilen kopierer du og limer inn i posten din.

Helst med skjult tekst [1skjul] logg her [1/skjul] fjern 1 for skjult tekst.

Endret 17. april 2008 av r2d290

killerbanana · 17. april 2008

vi har lastet ned og flyttet over, men får ikke åpnet filen. I tillegg fjerner den automatisk .exe bak filen.

r2d290 · 17. april 2008

vi har lastet ned og flyttet over, men får ikke åpnet filen. I tillegg fjerner den automatisk .exe bak filen.

Hmm... prøv å gjøre det andre alternativet med sikkerhetsmodus.

Hvis det ikke fungerer, kan du prøve en blanding: last ned fila fra en annen maskin, start den infiserte maskina i sikkerhetsmodus (uten internett), og legg hijackthis-fila inn hit. Prøv deretter å kjøre denne hijackthis-fila i sikkerhetsmoduset...

det at maskina fjerner .exe, tipper jeg har med at du har skjult filetternavn for kjente filtyper på denne maskina. For å se filetternavnet, kan du gå inn i min datamaskin->verktøy->mappealternativer, og fjerne haken for "skjul filetternavn for kjente filetternavn" (eller no sånt... sitter ikke i windows nå, så er ikke helt sikker)

edit: sjekk også at hijackthis-fila fungerer på en annen maskin (for å fjerne muligheten av at det kan være hijackthisfila som er ødelagt)

Endret 17. april 2008 av r2d290

killerbanana · 17. april 2008

Logfile

Klikk for å se/fjerne innholdet nedenfor

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:49:47, on 17.04.2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\WLTRAY.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\WINDOWS\AcerOrbiCam.exe

C:\Program Files\Picasa2\PicasaMediaDetector.exe

C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE

C:\DOCUME~1\PSYCHO~1\LOCALS~1\Temp\RtkBtMnt.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\wuauclt.exe

C:\PROGRA~1\LAUNCH~1\LManager.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\igfxext.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: (no name) - {F4D76F09-7896-458a-890F-E1F05C46069F} - (no file)

O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll

O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [Acer OrbiCam] C:\WINDOWS\AcerOrbiCam.exe

O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe

O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [beep for long support] C:\Documents and Settings\All Users.WINDOWS\Application Data\view name beep for\proc style.exe

O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"

O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [1d0f117a] rundll32.exe "C:\WINDOWS\system32\aybcipvj.dll",b

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

O4 - HKCU\..\Run: [way tool] C:\DOCUME~1\PSYCHO~1\APPLIC~1\DRIVEB~1\FunkObjSeek.exe

O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users.WINDOWS\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ww\msntabres.dll.mui/229?9db251d1bef749bbaca2e3b8e0774ab8

O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ww\msntabres.dll.mui/230?9db251d1bef749bbaca2e3b8e0774ab8

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/contr...vex/TmHcmsX.CAB

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by120fd.bay120.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab56986.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O23 - Service: Automatisk LiveUpdate-planlegging - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE

O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE

O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--

End of file - 10926 bytes

Klikk for å se/fjerne innholdet nedenfor

snippsat · 17. april 2008

Hei!

Du for prøve og lage en logg til.

Last Combofix ned ,legg på skrivebordet.

Ikke klikk på vindu mens programet kjører.

post logg C:\combofix.txt

killerbanana · 17. april 2008

ser ut til at dataen fungerer sånn den skal igjen nå, så tusen takk for hjelpen

Men har ett spørsmål til, har to operativsystem på dataen, og bruker bare det ene, så er det noen som vet hvordan man fjerner det som ikke er i bruk?

snippsat · 17. april 2008

Fikk du kjørt combofix?

Skull hatt loggen,det er ting som bør fjernes.

Dette så jeg hijackthis loggen.

Det er rimlig greit og fjerne,men trenger combofix loggen.

Endret 17. april 2008 av SNIPPSAT

killerbanana · 17. april 2008

Fikk fjernet 28 virus med combofix tingen, men jeg klarer ikke å finne ut hvor loggen har lagt seg :innocent:

snippsat · 17. april 2008

Under root c:\(ikke mapper)

combofix.txt

du kan godt søke,viss du ikke finner den.

Endret 17. april 2008 av SNIPPSAT

killerbanana · 17. april 2008

Klikk for å se/fjerne innholdet nedenfor

ComboFix 08-04-16.5 - Psychopath 2008-04-17 20:15:17.2 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.564 [GMT 2:00]

Running from: C:\Documents and Settings\Psychopath\My Documents\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

Klikk for å se/fjerne innholdet nedenfor

Detter var det eneste jeg fant, men den så så liten ut

snippsat · 17. april 2008

Ta et søk først "combofix.txt"

Kunne du kjørt den en til gang til.

Last Combofix ned ,legg på skrivebordet.

Her ser du fra posten min før,du skulle legge den på skrivebordet.

Kan godt laste ned på nytt og kjøre,legg den nå på skrivebordet.

Da ligger loggen under c:\

combofix.txt

Endret 17. april 2008 av SNIPPSAT

killerbanana · 17. april 2008

Sånn da

Klikk for å se/fjerne innholdet nedenfor

ComboFix 08-04-16.5 - Psychopath 2008-04-17 21:19:14.3 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.558 [GMT 2:00]

Running from: C:\Documents and Settings\Psychopath\My Documents\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((( Files Created from 2008-03-17 to 2008-04-17 )))))))))))))))))))))))))))))))

.

2008-04-17 20:21 . 2008-04-17 20:21 <DIR> d--hs---- C:\FOUND.011

2008-04-17 19:10 . 2008-04-17 19:10 <DIR> d-------- C:\Program Files\Alwil Software

2008-04-17 19:10 . 2008-03-29 19:45 1,146,232 --a------ C:\WINDOWS\system32\aswBoot.exe

2008-04-17 19:10 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx

2008-04-17 19:10 . 2008-03-29 19:23 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr

2008-04-17 19:10 . 2008-03-29 19:35 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys

2008-04-17 19:10 . 2008-01-17 17:34 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys

2008-04-17 19:10 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys

2008-04-17 19:10 . 2008-03-29 19:27 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys

2008-04-17 19:10 . 2008-03-29 19:26 26,944 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys

2008-04-17 19:10 . 2008-03-29 19:29 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys

2008-04-17 19:10 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys

2008-04-17 18:12 . 2008-04-17 18:12 <DIR> d-------- C:\VundoFix Backups

2008-04-17 17:48 . 2008-04-17 17:48 <DIR> d-------- C:\Program Files\Trend Micro

2008-04-17 16:24 . 2008-04-17 16:24 <DIR> d--h----- C:\WINDOWS\PIF

2008-04-16 16:20 . 2008-04-16 16:20 <DIR> d--hs---- C:\FOUND.010

2008-04-16 15:02 . 2008-04-16 15:02 <DIR> d-------- C:\Program Files\DAEMON Tools Lite

2008-04-16 14:57 . 2008-04-16 14:57 <DIR> d-------- C:\Documents and Settings\Psychopath\Application Data\DAEMON Tools

2008-04-15 20:42 . 2008-04-17 14:36 714 ---hs---- C:\WINDOWS\system32\shdakxsq.ini

2008-04-14 20:51 . 2008-04-14 20:51 354 ---hs---- C:\WINDOWS\system32\jagaevxi.ini

2008-04-13 20:47 . 2008-04-14 20:47 294 ---hs---- C:\WINDOWS\system32\wjbjnqij.ini

2008-04-12 20:46 . 2008-04-12 20:47 1,770 ---hs---- C:\WINDOWS\system32\khqtgqfl.ini

2008-04-11 20:44 . 2008-04-12 20:45 1,710 ---hs---- C:\WINDOWS\system32\amnkxvro.ini

2008-04-10 19:26 . 2008-04-11 20:44 1,306 ---hs---- C:\WINDOWS\system32\cadxdmsn.ini

2008-04-09 19:31 . 2008-04-10 18:05 1,186 ---hs---- C:\WINDOWS\system32\rcevadll.ini

2008-04-08 19:27 . 2008-04-09 19:31 1,006 ---hs---- C:\WINDOWS\system32\chklojfa.ini

2008-04-08 18:06 . 2008-04-08 18:06 <DIR> d--hs---- C:\FOUND.009

2008-04-07 19:22 . 2008-04-08 18:15 886 ---hs---- C:\WINDOWS\system32\kjlsckbe.ini

2008-04-06 19:20 . 2008-04-07 19:04 818 ---hs---- C:\WINDOWS\system32\limdyjxh.ini

2008-04-05 19:19 . 2008-04-07 19:20 706 ---hs---- C:\WINDOWS\system32\yykbkinr.ini

2008-04-04 18:14 . 2008-04-05 19:15 354 ---hs---- C:\WINDOWS\system32\lxnmnuqf.ini

2008-04-03 21:22 . 2008-04-03 21:22 54,156 --ah----- C:\WINDOWS\QTFont.qfn

2008-04-03 21:22 . 2008-04-03 21:22 1,409 --a------ C:\WINDOWS\QTFont.for

2008-04-03 18:13 . 2008-04-04 15:29 894 ---hs---- C:\WINDOWS\system32\ksbnganl.ini

2008-04-02 18:13 . 2008-04-03 16:43 714 ---hs---- C:\WINDOWS\system32\bhiuinkp.ini

2008-04-01 18:09 . 2008-04-02 14:08 594 ---hs---- C:\WINDOWS\system32\mmgvpkth.ini

2008-03-31 21:16 . 2008-04-01 02:00 594 ---hs---- C:\WINDOWS\system32\afnbseme.ini

2008-03-30 22:23 . 2008-03-31 21:10 534 ---hs---- C:\WINDOWS\system32\pddmknfy.ini

2008-03-29 21:17 . 2008-03-30 22:17 414 ---hs---- C:\WINDOWS\system32\xcmnynpg.ini

2008-03-29 20:07 . 2008-03-29 21:09 354 ---hs---- C:\WINDOWS\system32\ggahnfwk.ini

2008-03-28 20:01 . 2008-04-17 14:35 101,091 --a------ C:\WINDOWS\BM1e3c22e6.xml

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-04-17 18:27 2,752 ----a-w C:\WINDOWS\system32\PerfStringBackup.TMP

2008-04-16 12:57 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys

2008-03-14 05:50 --------- d-----w C:\Program Files\EA GAMES

2008-03-06 19:32 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf

2008-03-06 19:32 23,904 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys

2008-03-06 19:32 10,537 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.cat

2008-03-03 13:57 --------- d-sh--w C:\Program Files\Common Files\WindowsLiveInstaller

2008-03-03 13:56 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller

2008-02-19 12:48 --------- d-----w C:\Program Files\Den lengste reisen

2008-02-19 11:03 --------- d-----w C:\Program Files\directx

2008-02-17 13:14 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec

2007-03-31 08:02 44,541,440 ----a-w C:\Program Files\fsavcs_603_spion-og_virusvern_internetshield_webscan_emailscan_(komplett).msi

2007-03-16 12:49 19,994,184 ----a-w C:\Program Files\QuickTimeInstaller.exe

2007-03-15 17:50 727,138,334 ----a-w C:\Program Files\MyCDExtra.ncd

2007-03-12 17:59 552,448 ----a-w C:\Program Files\matpakke.pps

2007-03-10 16:18 6,718,976 ----a-w C:\Program Files\winamp533_full_emusic-7plus.exe

2007-03-05 18:06 4,003,432 ----a-w C:\Program Files\SweetImSetup.exe

2007-02-28 18:04 9,453,630 ----a-w C:\Program Files\vlc-0.8.6a-win32.exe

2007-02-28 14:08 4,222,516 ----a-w C:\Program Files\ABC-win32-v3.1.exe

2007-02-27 21:14 1,002,752 ----a-w C:\Program Files\JournalViewer1.5_KB886179_ENU.exe

2007-02-27 21:13 7,290,120 ----a-w C:\Program Files\setup.exe

2006-02-19 01:28 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll

.

Klikk for å se/fjerne innholdet nedenfor

snippsat · 17. april 2008

Det er ikke hele loggen.

Du kan gjøre dette,når du gjør dette vil combofix starte.

Prøv da og få med hele loggen.

Riktig for skjult tekst.

[1skjul] logg her [1/skjul] fjern 1 for skjult tekst.

Du har en dobbel skjul greie.

Kopiere fet tekst->lim inn i notisblokk.

Lagre på skrivebordet som CFScript.txt.

Gjør som på bildet,Post logg c:\combofix.txt

File::

C:\WINDOWS\system32\shdakxsq.ini

C:\WINDOWS\system32\jagaevxi.ini

C:\WINDOWS\system32\wjbjnqij.ini

C:\WINDOWS\system32\khqtgqfl.ini

C:\WINDOWS\system32\amnkxvro.ini

C:\WINDOWS\system32\cadxdmsn.ini

C:\WINDOWS\system32\rcevadll.ini

C:\WINDOWS\system32\chklojfa.ini

C:\WINDOWS\system32\kjlsckbe.ini

C:\WINDOWS\system32\limdyjxh.ini

C:\WINDOWS\system32\yykbkinr.ini

C:\WINDOWS\system32\lxnmnuqf.ini

C:\WINDOWS\system32\ksbnganl.ini

C:\WINDOWS\system32\bhiuinkp.ini

C:\WINDOWS\system32\mmgvpkth.ini

C:\WINDOWS\system32\afnbseme.ini

C:\WINDOWS\system32\pddmknfy.ini

C:\WINDOWS\system32\xcmnynpg.ini

C:\WINDOWS\system32\ggahnfwk.ini

Folder::

C:\VundoFix Backups

Endret 17. april 2008 av SNIPPSAT

killerbanana · 17. april 2008

Klikk for å se/fjerne innholdet nedenfor

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:55, on 2008-04-17

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\WLTRAY.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\WINDOWS\AcerOrbiCam.exe

C:\Program Files\Picasa2\PicasaMediaDetector.exe

C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\PROGRA~1\LAUNCH~1\LManager.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\igfxext.exe

C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

C:\DOCUME~1\PSYCHO~1\LOCALS~1\Temp\RtkBtMnt.exe

C:\Program Files\Internet Explorer\iexplore.exe

c:\program files\winamp toolbar\WinampTbServer.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Windows Live Toolbar\msn_sl.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL

O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll