Lite trolig virus eller spy, men vil være sikker. pc'en blir verre og verre for hver dag.

[MysticoN]

Hei. Jeg har hatt enda mer problemer med pc'en min i det siste. Det startet med Både IDE HD'en og DVD brenneren min forsvant. De er koblet på samme ide kabel og jeg har sjekket at kabler og pin er sån det skal være.

 

 

 

Dagen etter sluttet alt av usb porter å virke, eller de virker kun når de vil. jeg må f.eks dra ut og inn tastatur usb kabelen 100 ganger får å få  brukt tastaturet. 

 

Får heller ikke koblet til kamera.

 

Pc'en bruker også LANG tid på å boote, etter han har telt opp minne og ferdig med alt det der blir skjermen svart i 2-5min før jeg kommer inn i windows. Win E knappen funker heller ikke lengre (explorer).

 

 

 

Får masse "has stopped working" meldinger av div dll filer, f.eks:

 

Problem signature:

  Problem Event Name: APPCRASH

  Application Name: rundll32.exe

  Application Version: 6.0.6000.16386

  Application Timestamp: 4549bb52

  Fault Module Name: Lycosa.cpl

  Fault Module Version: 4.0.0.4

  Fault Module Timestamp: 46fb80f8

  Exception Code: c0000005

  Exception Offset: 000000000000156b

  OS Version: 6.0.6001.2.1.0.768.3

  Locale ID: 1044

  Additional Information 1: 3571

  Additional Information 2: 2614448ffba536371069177ccc50513d

  Additional Information 3: 3cd8

  Additional Information 4: a55c4a0634b058c42330f90669000cc0

 

Read our privacy statement:

  http://go.microsoft.com/fwlink/?linkid=501...mp;clcid=0x0409

 

Har kjørt panda antivirus 2008, og SUPERAntiSpyware fult oppgradert på full scan uten å finne noe annet enn "kaker"

 

 

 

 

som sakt, så tror jeg ikke at dette kan være virus/spy, men velger likavel å lage denne posten for å være sikker:

 

 

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:18:30, on 23.07.2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

 

Running processes:

C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Program Files (x86)\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files (x86)\Panda Security\Panda Antivirus 2008\ApVxdWin.exe

C:\Program Files (x86)\Panda Security\Panda Antivirus 2008\WebProxy.exe

C:\Program Files (x86)\Opera\opera.exe

C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll

F2 - REG:system.ini: UserInit=userinit.exe

O1 - Hosts: ::1 localhost

O1 - Hosts: 66.98.148.65 auto.search.msn.com

O1 - Hosts: 66.98.148.65 auto.search.msn.es

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files (x86)\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files (x86)\Panda Security\Panda Antivirus 2008\APVXDWIN.EXE" /s

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files (x86)\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - Global Startup: SetPointII.lnk = ?

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.6.0_05\bin\ssv.dll

O13 - Gopher Prefix: 

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files (x86)\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - http://www.nanoscan.com/as/cabs/ascstubie.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O20 - AppInit_DLLs: C:\Windows\SysWOW64\guard32.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)

O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\Comodo\Firewall\cmdagent.exe

O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)

O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files (x86)\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)

O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files (x86)\Panda Security\Panda Antivirus 2008\PsCtrls.exe

O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files (x86)\Common Files\Panda Software\PavShld\pavprsrv.exe

O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files (x86)\Panda Security\Panda Antivirus 2008\pavsrvx86.exe

O23 - Service: PD91Agent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe

O23 - Service: PD91Engine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe

O23 - Service: PD91VMDefrag - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91VMDefrag.exe

O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files (x86)\Panda Security\Panda Antivirus 2008\psimsvc.exe

O23 - Service: Panda PSK service (PskSvcRetail) - Panda Software International - C:\Program Files (x86)\Panda Security\Panda Antivirus 2008\PskSvc.exe

O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)

O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)

O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)

O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)

O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe

O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)

O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)

O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)

O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

O23 - Service: Zune Wireless Configuration Service (ZuneWlanCfgSvc) - Unknown owner - C:\Windows\system32\ZuneWlanCfgSvc.exe (file missing)

 

--

End of file - 8229 bytes

 

 

kjører Vista 64b så combofix får jeg ikke kjørt. takker for alt av hjelp!!!

 

 

Edit: Skan nevnes at den rundll32.exe meldingen får jeg når jeg prøver å gå inn på razer menyen (Razer tastatur).

 

Får også opp en jmicron.com ting like etter biosen, er vel ide ting eller?!

Endret 23. juli 2008 av MysticoN

[Wubbable]

Googlet litt for deg, mange som nevner at nero kan være årsaken... De fikset det med å laste ned og installere nyeste versjon

 

Ellers ser HJT loggen ren ut, med unntak av en god del ting du ikke trenger i bakgrunnen, som bare gjør maskinen treg:

 

Java Update Scheduler - Java oppdateres utrolig sjeldent

Logitech Desktop Messenger - Ubrukelig møkk fra logitech

Nero MediaHome Indexing Service - med mindre du faktisk bruker mediahome, disable den

 

Og, jo flere realtime scannere du har, jo treigere går det... Anbefaler at du får deg en sikkerhetspakke fra ett firma som har brannmur, antivirus/spyware i ett

[Bludd]

Det har nettopp kommet en ny versjon av Java med noen viktige sikkerhetsoppdateringer. Det er anbefalt å oppdatere til nyeste versjon av JRE.

Endret 24. juli 2008 av Bludd

[Wubbable]

Nettopp, som i mange uker siden?

[Bludd]

Bare 2 uker og OP kjører fortsatt update 5, mens update 7 er nyeste. Uansett, viktig å oppdatere JRE. F.eks. bruker Sparebank 1 Java (BankID) til autentisering.

Endret 24. juli 2008 av Bludd

[Wubbable]

Forstår ikke hvorfor sun ikke bare kan lage en liten scheduled task istedet for å ha et lite program i bakgrunnen 24/7