[LØST] Vi trenger hjelp med trojan vundo.

killerbanana · 19. april 2008

da håper vi at vi har gjort det riktig, men når vi gjorde dette skrudde dataen seg av, fordi det oppstod en feil eller noe sånt noe

Klikk for å se/fjerne innholdet nedenfor

ComboFix 08-04-16.5 - Psychopath 2008-04-19 17:11:00.5 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.529 [GMT 2:00]

Running from: C:\Documents and Settings\Psychopath\My Documents\ComboFix.exe

Command switches used :: C:\Documents and Settings\Psychopath\Desktop\CFScript.txt.txt

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::

C:\WINDOWS\system32\afnbseme.ini

C:\WINDOWS\system32\amnkxvro.ini

C:\WINDOWS\system32\bhiuinkp.ini

C:\WINDOWS\system32\cadxdmsn.ini

C:\WINDOWS\system32\chklojfa.ini

C:\WINDOWS\system32\ggahnfwk.ini

C:\WINDOWS\system32\jagaevxi.ini

C:\WINDOWS\system32\khqtgqfl.ini

C:\WINDOWS\system32\kjlsckbe.ini

C:\WINDOWS\system32\ksbnganl.ini

C:\WINDOWS\system32\limdyjxh.ini

C:\WINDOWS\system32\lxnmnuqf.ini

C:\WINDOWS\system32\mmgvpkth.ini

C:\WINDOWS\system32\pddmknfy.ini

C:\WINDOWS\system32\rcevadll.ini

C:\WINDOWS\system32\shdakxsq.ini

C:\WINDOWS\system32\wjbjnqij.ini

C:\WINDOWS\system32\xcmnynpg.ini

C:\WINDOWS\system32\yykbkinr.ini

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\VundoFix Backups

C:\WINDOWS\system32\afnbseme.ini

C:\WINDOWS\system32\amnkxvro.ini

C:\WINDOWS\system32\bhiuinkp.ini

C:\WINDOWS\system32\cadxdmsn.ini

C:\WINDOWS\system32\chklojfa.ini

C:\WINDOWS\system32\ggahnfwk.ini

C:\WINDOWS\system32\jagaevxi.ini

C:\WINDOWS\system32\khqtgqfl.ini

C:\WINDOWS\system32\kjlsckbe.ini

C:\WINDOWS\system32\ksbnganl.ini

C:\WINDOWS\system32\limdyjxh.ini

C:\WINDOWS\system32\lxnmnuqf.ini

C:\WINDOWS\system32\mmgvpkth.ini

C:\WINDOWS\system32\pddmknfy.ini

C:\WINDOWS\system32\rcevadll.ini

C:\WINDOWS\system32\shdakxsq.ini

C:\WINDOWS\system32\wjbjnqij.ini

C:\WINDOWS\system32\xcmnynpg.ini

C:\WINDOWS\system32\yykbkinr.ini

.

((((((((((((((((((((((((( Files Created from 2008-03-19 to 2008-04-19 )))))))))))))))))))))))))))))))

.

2008-04-19 11:36 . 2008-04-19 11:36 <DIR> d--hs---- C:\FOUND.013

2008-04-18 12:08 . 2008-04-18 12:08 <DIR> d-------- C:\Program Files\TSBin

2008-04-18 12:08 . 2008-04-18 12:08 <DIR> d-------- C:\Program Files\CSBin

2008-04-18 12:08 . 2006-02-07 02:47 278,528 --a------ C:\Program Files\Sims2EP3_Uninst.exe

2008-04-18 12:07 . 2008-04-18 12:07 <DIR> d-------- C:\Program Files\TSData

2008-04-17 21:25 . 2008-04-17 21:25 <DIR> d--hs---- C:\FOUND.012

2008-04-17 20:21 . 2008-04-17 20:21 <DIR> d--hs---- C:\FOUND.011

2008-04-17 19:10 . 2008-04-17 19:10 <DIR> d-------- C:\Program Files\Alwil Software

2008-04-17 19:10 . 2008-03-29 19:45 1,146,232 --a------ C:\WINDOWS\system32\aswBoot.exe

2008-04-17 19:10 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx

2008-04-17 19:10 . 2008-03-29 19:23 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr

2008-04-17 19:10 . 2008-03-29 19:35 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys

2008-04-17 19:10 . 2008-01-17 17:34 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys

2008-04-17 19:10 . 2008-03-29 19:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys

2008-04-17 19:10 . 2008-03-29 19:27 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys

2008-04-17 19:10 . 2008-03-29 19:26 26,944 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys

2008-04-17 19:10 . 2008-03-29 19:29 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys

2008-04-17 19:10 . 2008-03-29 19:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys

2008-04-17 17:48 . 2008-04-17 17:48 <DIR> d-------- C:\Program Files\Trend Micro

2008-04-17 16:24 . 2008-04-17 16:24 <DIR> d--h----- C:\WINDOWS\PIF

2008-04-16 16:20 . 2008-04-16 16:20 <DIR> d--hs---- C:\FOUND.010

2008-04-16 15:02 . 2008-04-16 15:02 <DIR> d-------- C:\Program Files\DAEMON Tools Lite

2008-04-16 14:57 . 2008-04-16 14:57 <DIR> d-------- C:\Documents and Settings\Psychopath\Application Data\DAEMON Tools

2008-04-08 18:06 . 2008-04-08 18:06 <DIR> d--hs---- C:\FOUND.009

2008-04-03 21:22 . 2008-04-03 21:22 54,156 --ah----- C:\WINDOWS\QTFont.qfn

2008-04-03 21:22 . 2008-04-03 21:22 1,409 --a------ C:\WINDOWS\QTFont.for

2008-03-28 20:01 . 2008-04-17 14:35 101,091 --a------ C:\WINDOWS\BM1e3c22e6.xml

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-04-19 09:41 2,752 ----a-w C:\WINDOWS\system32\PerfStringBackup.TMP

2008-04-16 12:57 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys

2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys

2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys

2008-03-14 05:50 --------- d-----w C:\Program Files\EA GAMES

2008-03-06 19:32 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf

2008-03-06 19:32 23,904 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys

2008-03-06 19:32 10,537 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.cat

2008-03-03 13:57 --------- d-sh--w C:\Program Files\Common Files\WindowsLiveInstaller

2008-03-03 13:56 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller

2008-03-01 16:36 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll

2008-02-29 08:55 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe

2008-02-29 08:55 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe

2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe

2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll

2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll

2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll

2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll

2008-02-20 05:32 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll

2008-02-19 12:48 --------- d-----w C:\Program Files\Den lengste reisen

2008-02-19 11:03 --------- d-----w C:\Program Files\directx

2008-02-15 05:44 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll

2007-03-31 08:02 44,541,440 ----a-w C:\Program Files\fsavcs_603_spion-og_virusvern_internetshield_webscan_emailscan_(komplett).msi

2007-03-16 12:49 19,994,184 ----a-w C:\Program Files\QuickTimeInstaller.exe

2007-03-15 17:50 727,138,334 ----a-w C:\Program Files\MyCDExtra.ncd

2007-03-12 17:59 552,448 ----a-w C:\Program Files\matpakke.pps

2007-03-10 16:18 6,718,976 ----a-w C:\Program Files\winamp533_full_emusic-7plus.exe

2007-03-05 18:06 4,003,432 ----a-w C:\Program Files\SweetImSetup.exe

2007-02-28 18:04 9,453,630 ----a-w C:\Program Files\vlc-0.8.6a-win32.exe

2007-02-28 14:08 4,222,516 ----a-w C:\Program Files\ABC-win32-v3.1.exe

2007-02-27 21:14 1,002,752 ----a-w C:\Program Files\JournalViewer1.5_KB886179_ENU.exe

2007-02-27 21:13 7,290,120 ----a-w C:\Program Files\setup.exe

2006-02-19 01:28 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll

2006-02-06 22:42 10,134 ----a-w C:\Program Files\Sims2EP3.ico

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2007-12-13 17:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]

[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]

[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]

[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]

"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-12-13 17:49 1185120]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]

[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]

[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]

[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00 15360]

"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 16:21 1449984]

"way tool"="C:\DOCUME~1\PSYCHO~1\APPLIC~1\DRIVEB~1\FunkObjSeek.exe" [ ]

"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 11:39 486856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 12:00 110592 C:\WINDOWS\system32\bthprops.cpl]

"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2005-11-11 20:40 1236992]

"RTHDCPL"="RTHDCPL.EXE" [2006-12-18 19:12 16062464 C:\WINDOWS\RTHDCPL.exe]

"SkyTel"="SkyTel.EXE" [2006-05-16 02:04 2879488 C:\WINDOWS\SkyTel.exe]

"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 13:07 761946]

"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

"Acer OrbiCam"="C:\WINDOWS\AcerOrbiCam.exe" [2006-11-22 18:03 401408]

"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-05-02 08:08 366400]

"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.exe" [2006-06-15 12:36 229376]

"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]

"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152]

"beep for long support"="C:\Documents and Settings\All Users.WINDOWS\Application Data\view name beep for\proc style.exe" [ ]

"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2006-07-20 22:15 593920]

"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-23 12:17 94208]

"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-23 12:13 77824]

"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-23 12:17 118784]

"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 17:38 583048]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-03-29 19:37 79224]

Klikk for å se/fjerne innholdet nedenfor

snippsat · 19. april 2008

Ja da har combofix fått slettet filer.

He det er forsatt ikke hele loggen.

Du har en dobbelskjul greie.

Se på denne igjen.

Riktig for skjult tekst.

[1skjul] logg her [1/skjul] fjern 1 for skjult tekst.

Klikk for å se/fjerne innholdet nedenfor

logg her

Se nederst på loggen din der har du et skjult vindu til.

Prøv og få med hele combofix loggen.

Og kan ta en hijackthis logg nå,så får vis se.

Endret 19. april 2008 av SNIPPSAT

r2d290 · 19. april 2008

Bare sånn info fra siden: ved å trykke reply, ser man hvordan han lager taggene... Det han gjør feil, er å glemme å sett skråstreken i siste tagg. Som snipp sier:

[1skjul] logg her [1/skjul]

Du skal BARE fjerne 1-tallet! skråstreken "/" skal være med!

edit: la på et smilefjes for ikke å bli oppfattet som sur

Endret 19. april 2008 av r2d290

killerbanana · 19. april 2008

Men hvis ikke dette er hele loggen, så vet ikke vi hva vi skal gjøre for å få hele

Vi oppfatter inegen som sure her altså, vi er bare kjempe takknemlige for å få hjelp :!:

her er hijackthis loggen :

Klikk for å se/fjerne innholdet nedenfor

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:39, on 2008-04-19

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\WLTRAY.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\WINDOWS\AcerOrbiCam.exe

C:\Program Files\Picasa2\PicasaMediaDetector.exe

C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\PROGRA~1\LAUNCH~1\LManager.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\WINDOWS\system32\igfxext.exe

C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe

C:\DOCUME~1\PSYCHO~1\LOCALS~1\Temp\RtkBtMnt.exe

C:\Program Files\Internet Explorer\iexplore.exe

c:\program files\winamp toolbar\WinampTbServer.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL

O2 - BHO: (no name) - {0A94B111-4504-4e26-AB05-E61E474AA38B} - (no file)

O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: (no name) - {F4D76F09-7896-458a-890F-E1F05C46069F} - (no file)

O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [Acer OrbiCam] C:\WINDOWS\AcerOrbiCam.exe

O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe

O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [beep for long support] C:\Documents and Settings\All Users.WINDOWS\Application Data\view name beep for\proc style.exe

O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

O4 - HKCU\..\Run: [way tool] C:\DOCUME~1\PSYCHO~1\APPLIC~1\DRIVEB~1\FunkObjSeek.exe

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users.WINDOWS\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ww\msntabres.dll.mui/229?9db251d1bef749bbaca2e3b8e0774ab8

O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ww\msntabres.dll.mui/230?9db251d1bef749bbaca2e3b8e0774ab8

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/contr...vex/TmHcmsX.CAB

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by120fd.bay120.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab56986.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab

O20 - Winlogon Notify: efcabxv - efcabxv.dll (file missing)

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE

O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE

O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)

O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: PsExec (PSEXESVC) - Unknown owner - C:\WINDOWS\PSEXESVC.EXE

O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--

End of file - 10595 bytes

snippsat · 19. april 2008

Steng alt kjør kun hijackthis.

Start HijackThis "scan" finn disse linjene merk dem,så trykk fix checked.

R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL

O2 - BHO: (no name) - {0A94B111-4504-4e26-AB05-E61E474AA38B} - (no file)

O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - (no file)

O3 - Toolbar: (no name) - {F4D76F09-7896-458a-890F-E1F05C46069F} - (no file)

O4 - HKLM\..\Run: [beep for long support] C:\Documents and Settings\All Users.WINDOWS\Application Data\view name beep for\proc style.exe

O4 - HKCU\..\Run: [way tool] C:\DOCUME~1\PSYCHO~1\APPLIC~1\DRIVEB~1\FunkObjSeek.exe

O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users.WINDOWS\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

O20 - Winlogon Notify: efcabxv - efcabxv.dll (file missing)

Last ned kjør CCleaner

'Valg'->'Avansert'. Fjern avkryssingen framfor: "bare slett midlertidige filer som er eldere enn 48 t.

Kjør register-renser og"svar ja til og reparere"

Last ned oppdatere og kjør full scan SAS free

Post loggen fra SAS (preferences->statistics/logs)

Nå som du har fått til skjult tekst,kunne du du fått med hele combofix

loggen.

Kan godt kjøre comofix på nytt har du ikke loggen.

Etter dette restart og ny hijackthis logg.

Endret 19. april 2008 av SNIPPSAT

killerbanana · 19. april 2008

Her er loggene

superantispyware greia

Klikk for å se/fjerne innholdet nedenfor

SUPERAntiSpyware Scan Log

http://www.superantispyware.com

Generated 04/19/2008 at 07:54 PM

Application Version : 4.0.1154

Core Rules Database Version : 3442

Trace Rules Database Version: 1434

Scan type : Complete Scan

Total Scan Time : 00:27:16

Memory items scanned : 560

Memory threats detected : 0

Registry items scanned : 5885

Registry threats detected : 0

File items scanned : 21861

File threats detected : 11

Adware.Tracking Cookie

C:\Documents and Settings\Psychopath\Cookies\psychopath@doubleclick[1].txt

C:\Documents and Settings\Psychopath\Cookies\[email protected][1].txt

C:\Documents and Settings\Psychopath\Cookies\psychopath@advertising[2].txt

Adware.Vundo-Variant/Small-A

C:\SYSTEM VOLUME INFORMATION\_RESTORE{A3FA504C-0313-4116-A99E-AF542C32AA10}\RP361\A0077439.DLL

C:\SYSTEM VOLUME INFORMATION\_RESTORE{A3FA504C-0313-4116-A99E-AF542C32AA10}\RP361\A0077440.DLL

C:\SYSTEM VOLUME INFORMATION\_RESTORE{A3FA504C-0313-4116-A99E-AF542C32AA10}\RP361\A0077442.DLL

C:\SYSTEM VOLUME INFORMATION\_RESTORE{A3FA504C-0313-4116-A99E-AF542C32AA10}\RP361\A0077447.DLL

C:\SYSTEM VOLUME INFORMATION\_RESTORE{A3FA504C-0313-4116-A99E-AF542C32AA10}\RP361\A0077449.DLL

C:\SYSTEM VOLUME INFORMATION\_RESTORE{A3FA504C-0313-4116-A99E-AF542C32AA10}\RP361\A0077451.DLL

Adware.Vundo-Variant

C:\SYSTEM VOLUME INFORMATION\_RESTORE{A3FA504C-0313-4116-A99E-AF542C32AA10}\RP361\A0077446.DLL

combofixen :

Klikk for å se/fjerne innholdet nedenfor

ComboFix 08-04-16.5 - Psychopath 2008-04-19 20:09:30.6 - FAT32x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.473 [GMT 2:00]

Running from: C:\Documents and Settings\Psychopath\My Documents\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((( Files Created from 2008-03-19 to 2008-04-19 )))))))))))))))))))))))))))))))

.

2008-04-19 19:25 . 2008-04-19 19:25 <DIR> d-------- C:\Program Files\SUPERAntiSpyware

2008-04-19 19:25 . 2008-04-19 19:25 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard

2008-04-19 19:25 . 2008-04-19 19:25 <DIR> d-------- C:\Documents and Settings\Psychopath\Application Data\SUPERAntiSpyware.com

2008-04-19 19:25 . 2008-04-19 19:25 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\SUPERAntiSpyware.com

2008-04-19 19:15 . 2008-04-19 19:15 <DIR> d-------- C:\Program Files\CCleaner

2008-04-19 17:17 . 2008-04-19 17:17 <DIR> d--hs---- C:\FOUND.014