Hijack log

Kigger på den ;)

Takker John :) også længe siden jeg har været herinde...

Kalder lige på en ekspert til den her log :)

Den ser nemlig lidt mystisk ud og vil ikke lave rod i det

Ja det er faktisk længe siden :)

Disse kan du faktisk godt fikse:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchcentral.cc/search.php?v=4&aff=2861
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchcentral.cc/index.php?v=4&aff=2861
O4 - HKLM\..\RunOnce: [tlc] D:\WINDOWS\update13.js
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - D:\WINDOWS\web\related.htm

Nu ser den sådan ud:

Logfile of HijackThis v1.98.2
Scan saved at 21:38:41, on 10-09-2004
Platform: Windows XP SP1 (WinNT 5.01.3590)
MSIE: Internet Explorer v6.00 SP1 (6.00.3590.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\SYSTEM32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\PFShared\UmxCfg.exe
D:\Program Files\Common Files\PFShared\UmxPol.exe
D:\Program Files\Tiny Firewall Pro\UmxAgent.exe
D:\WINDOWS\MWW32\MANAGER\MWMDMSVC.EXE
D:\Program Files\Tiny Firewall Pro\UmxTray.exe
D:\WINDOWS\MWW32\MANAGER\MWSSW32.EXE
D:\WINDOWS\system32\serverappliance\appmgr.exe
D:\WINDOWS\system32\serverappliance\elementmgr.exe
D:\WINDOWS\System32\inetsrv\inetinfo.exe
D:\mailserver\mlsrvnt.exe
D:\WINDOWS\system32\serverappliance\srvcsurg.exe
D:\Program Files\Common Files\PFShared\umxlu.exe
D:\WINDOWS\system32\Dfssvc.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\System32\tp4mon.exe
D:\Program Files\Outlook Express\msimn.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Internet Explorer\IEXPLORE.EXE
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Tiny Firewall Pro\amon.exe
D:\Documents and Settings\Administrator.MIC-LAB\Desktop\hijack\hijackthis.exe

O2 - BHO: Zero Popup - {2EF37A01-884F-11d5-AC99-B112050ECB4F} - D:\PROGRA~1\ZEROPO~1\HTMLEdit.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [Modem Update Reminder] D:\WINDOWS\MWW32\manager\mwremind.exe autorun
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [AMonitor] D:\Program Files\Tiny Firewall Pro\amon.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1094603358768
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7E20485-19AE-478F-85E7-65F6F23ABE07}: NameServer = 212.242.40.3,212.242.40.51

Helt galt er den nu.. har lige installeret Spywareblaster og den startede ca 440 processer af spywareupdate.exe. Den er dog begyndt at lukke processerne men har dælme også sløvet min maskine..

Hva fan sker der??

Prøve at downloade denne engangsscanner: http://www.mwti.net/download/tools/mwav.exe

Fra fejlsikret tilstand kører du en scanning med mwav.exe – aktiver så den scanner mest muligt.

Genstart normalt. Fandt den noget?

vender tilbage om lidt med svar..

Husk at sætte mwav.exe til at scanne alle filer.

det gjorde jeg ;o) og den er noget længere om det end jeg troede, så hav tålmodighed. Den har fundet D:\WINDOWS\update13.js indtil videre..

Endelig blev den færdig og fy for den da...

File D:\WINDOWS\update13.js infected by "Trojan.JS.StartPage.a" Virus. Action Taken: File Deleted.

File C:\Documents and Settings\Administrator.XPSERVER\Desktop\ftpsetup.exe tagged as not-a-virus:RiskWare.ftp.BulletProof.221. No Action Taken.

File C:\Program Files\IntBar\rundlg32.dll infected by "TrojanClicker.Win32.Agent.n" Virus. Action Taken: File Deleted.

File C:\Program Files\ORL\VNC\VNCHooks.dll tagged as not-a-virus:RiskWare.RemoteAdmin.WinVNC.333. No Action Taken.

File C:\Program Files\ORL\VNC\vncviewer.exe tagged as not-a-virus:RiskWare.RemoteAdmin.WinVNC.333. No Action Taken.

File C:\Program Files\ORL\VNC\WinVNC.exe tagged as not-a-virus:RiskWare.RemoteAdmin.WinVNC.333. No Action Taken.

File C:\Program Files\RealVNC\WinVNC\othread2.dll tagged as not-a-virus:RiskWare.RemoteAdmin.WinVNC-Based.c. No Action Taken.

File C:\Program Files\RealVNC\WinVNC\vnchooks.dll tagged as not-a-virus:RiskWare.RemoteAdmin.WinVNC-Based.c. No Action Taken.

File C:\Program Files\RealVNC\WinVNC\winvnc.exe tagged as not-a-virus:RiskWare.RemoteAdmin.WinVNC-Based.c. No Action Taken.

File C:\Program Files\War-ftpd\war-ftpd.exe tagged as not-a-virus:RiskWare.ftp.PremierServer.b. No Action Taken.
File D:\Administrator.XPSERVER\Desktop\ftpsetup.exe tagged as not-a-virus:RiskWare.ftp.BulletProof.221. No Action Taken.
File D:\Documents and Settings\Administrator.MIC-LAB\Local Settings\Temporary Internet Files\Content.IE5\GHK9GLI9\CA27CPW1.HTM infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

File D:\Documents and Settings\Administrator.MIC-LAB\Local Settings\Temporary Internet Files\Content.IE5\GHK9GLI9\e9xr[1].chm infected by "TrojanDownloader.JS.gen" Virus. Action Taken: File Renamed.

File D:\Documents and Settings\Administrator.MIC-LAB\Local Settings\Temporary Internet Files\Content.IE5\KDMF8XIJ\bridge-c11[1].cab infected by "not-a-virus:AdvWare.Winad" Virus. Action Taken: File Renamed.

File D:\Documents and Settings\Administrator.MIC-LAB\Local Settings\Temporary Internet Files\Content.IE5\KDMF8XIJ\index[1].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

File D:\Documents and Settings\Administrator.MIC-LAB\Local Settings\Temporary Internet Files\Content.IE5\KXUF8L2R\fav[1].exe infected by "Trojan.Win32.StartPage.fg" Virus. Action Taken: File Deleted.

File D:\Documents and Settings\Administrator.MIC-LAB\Local Settings\Temporary Internet Files\Content.IE5\KXUF8L2R\hpp3n[1].hta infected by "Trojan.JS.StartPage.a" Virus. Action Taken: File Deleted.

File D:\Documents and Settings\Administrator.MIC-LAB\Local Settings\Temporary Internet Files\Content.IE5\KXUF8L2R\index[2].htm infected by "Exploit.HTML.Mht" Virus. Action Taken: File Renamed.

File D:\Download\DC520V1.21\Setup.EXE tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.

File D:\Download\DC520V1.21.zip tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File D:\www\aklaverportalen\lone\vnc.exe tagged as not-a-virus:RiskWare.RemoteAdmin.WinVNC.333. No Action Taken.

Tøm computerens midlertidige internetfiler og kom med en ny log fra HijackThis - tak.

noget tom ser den da ud nu ;o)

Logfile of HijackThis v1.98.2
Scan saved at 10:54:51, on 11-09-2004
Platform: Windows XP SP1 (WinNT 5.01.3590)
MSIE: Internet Explorer v6.00 SP1 (6.00.3590.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\SYSTEM32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\PFShared\UmxCfg.exe
D:\Program Files\Common Files\PFShared\UmxPol.exe
D:\Program Files\Tiny Firewall Pro\UmxAgent.exe
D:\WINDOWS\MWW32\MANAGER\MWMDMSVC.EXE
D:\Program Files\Tiny Firewall Pro\UmxTray.exe
D:\WINDOWS\MWW32\MANAGER\MWSSW32.EXE
D:\WINDOWS\system32\serverappliance\appmgr.exe
D:\WINDOWS\system32\serverappliance\elementmgr.exe
D:\WINDOWS\System32\inetsrv\inetinfo.exe
D:\mailserver\mlsrvnt.exe
D:\WINDOWS\system32\serverappliance\srvcsurg.exe
D:\Program Files\Common Files\PFShared\umxlu.exe
D:\WINDOWS\system32\Dfssvc.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\System32\tp4mon.exe
D:\WINDOWS\System32\svchost.exe
D:\Documents and Settings\Administrator.MIC-LAB\Desktop\TmSrvNT.exe
D:\WINDOWS\System32\timesync.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Documents and Settings\Administrator.MIC-LAB\Desktop\hijack\hijackthis.exe

O2 - BHO: Zero Popup - {2EF37A01-884F-11d5-AC99-B112050ECB4F} - D:\PROGRA~1\ZEROPO~1\HTMLEdit.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [Modem Update Reminder] D:\WINDOWS\MWW32\manager\mwremind.exe autorun
O4 - HKCU\..\Run: [AMonitor] D:\Program Files\Tiny Firewall Pro\amon.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1094603358768
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7E20485-19AE-478F-85E7-65F6F23ABE07}: NameServer = 212.242.40.3,212.242.40.51

Kender du selv dette program?:
D:\Documents and Settings\Administrator.MIC-LAB\Desktop\TmSrvNT.exe

Hvordan kører maskinen nu?

Har du de seneste opdateringer fra Windows Update?

tmsrvnt.exe er argosoft timeserver (nu afinstalleret)

Den kører men den er langsom når jeg fx skal skrive denne tekst og når jeg skal i menuer i fx IE.

Windows Update virker slet ikke på denne maskine.. (Kører Windows .net standard server)

Prøv lige CWShredder: http://danborg.org/spy/CWS/cwshredder.exe

Kør CWShredder, luk alle vinduer, undtagen CWShredder, klik på Fix. Programmet scanner nu. Når det er færdigt, så klik på Next og Exit.

Du kan også prøve med en sfc:
Indsæt din XP-cd i dit drev.
Gå i start
Kør
Skriv: sfc /scannow
(husk mellemrum mellem sfc og /scannow)
OK

Er der nogle systemfiler, som ikke har det så godt, så bliver de repareret og mangler der nogle, så bliver de gendannet.

Done!
Your system was completely clean.

Windows XP (5.01.3590 SP1)
CWShredder v1.59.1

Prøver sfc nu.-.

Jeg kunne ikke se at SFC gjorde noget andet end at scanne igennem og snurre på cd skiven..

Men nu er hastigheden på min skrivning skruet op ;o)

men msupdate virker stadig ikke.. :(

Er der ikke opdateringer tilgængelige? Eller får du ikke lov til at opdatere? http://windowsupdate.microsoft.com/


Du skal lige slå systemgendannelse fra: http://www.spywarefri.dk/virusscannere.htm#alle genstarte og slå systemgendannelse til igen.

Går ind på http://v5.windowsupdate.microsoft.com/v5consumer/default.aspx?ln=en-us og får følgende:

[Error number: 0x8007000D]
Windows Update has encountered an error and cannot display the requested page. You may find the following resources helpful in resolving the problem:
For self-help options:

Windows Update Response Center

Windows Update Troubleshooter

Windows Update Newsgroups
For assisted support options:

Microsoft Online Assisted Support (no-cost for Windows Update issues) 
(Husk nu hvilken version af windåse jeg kører ;))

Systemgendannelse findes da vist ikke på .net standard server ;o)

Ja, servere er desværre ikke min stærke side ;-)

Jeg må blive dig svar skyldig. Det kan være, der kommer en anden forbi, som kan hjælpe.

takker for din hjælp.. smid svar

kørte lige hijack igen og vupti:

Logfile of HijackThis v1.98.2
Scan saved at 15:24:01, on 11-09-2004
Platform: Windows XP SP1 (WinNT 5.01.3590)
MSIE: Internet Explorer v6.00 SP1 (6.00.3590.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\SYSTEM32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\PFShared\UmxCfg.exe
D:\Program Files\Common Files\PFShared\UmxPol.exe
D:\Program Files\Tiny Firewall Pro\UmxAgent.exe
D:\WINDOWS\MWW32\MANAGER\MWMDMSVC.EXE
D:\Program Files\Tiny Firewall Pro\UmxTray.exe
D:\WINDOWS\MWW32\MANAGER\MWSSW32.EXE
D:\WINDOWS\system32\serverappliance\appmgr.exe
D:\WINDOWS\system32\serverappliance\elementmgr.exe
D:\WINDOWS\System32\inetsrv\inetinfo.exe
D:\mailserver\mlsrvnt.exe
D:\WINDOWS\system32\serverappliance\srvcsurg.exe
D:\Program Files\Common Files\PFShared\umxlu.exe
D:\WINDOWS\system32\Dfssvc.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\System32\tp4mon.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\timesync.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\Program Files\Grisoft\AVG7\avgemc.exe
D:\Program Files\Grisoft\AVG7\avgcc.exe
D:\Program Files\Outlook Express\msimn.exe
D:\Documents and Settings\Administrator.MIC-LAB\Desktop\hijack\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.iwantsearch.com
R3 - URLSearchHook: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - D:\WINDOWS\Downloaded Program Files\rundlg32.dll
O2 - BHO: Zero Popup - {2EF37A01-884F-11d5-AC99-B112050ECB4F} - D:\PROGRA~1\ZEROPO~1\HTMLEdit.dll
O2 - BHO: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - D:\WINDOWS\Downloaded Program Files\rundlg32.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Search Bar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - D:\WINDOWS\Downloaded Program Files\rundlg32.dll
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [Modem Update Reminder] D:\WINDOWS\MWW32\manager\mwremind.exe autorun
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKCU\..\Run: [AMonitor] D:\Program Files\Tiny Firewall Pro\amon.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1094603358768
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7E20485-19AE-478F-85E7-65F6F23ABE07}: NameServer = 212.242.40.3,212.242.40.51

Fix disse med HijackThis:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.iwantsearch.com

O2 - BHO: StartBHO Class - {30192F8D-0958-44E6-B54D-331FD39AC959} - D:\WINDOWS\Downloaded Program Files\rundlg32.dll

O3 - Toolbar: Search Bar - {0E1230F8-EA50-42A9-983C-D22ABC2EED3B} - D:\WINDOWS\Downloaded Program Files\rundlg32.dll

Genstart i fejlsikret tilstand. Find og slet:

D:\WINDOWS\Downloaded Program Files\rundlg32.dll >>>> filen

Genstart normalt.

Prøv så at tage en tur med Ad-Aware: http://www.spywarefri.dk/vaerktoj.htm#adaware
Manual: http://www.spywarefri.dk/adaware.manual.htm

Kopier derefter en ny log fra HijackThis herind – tak.

Fil slettet.
Kørt adaware

Ny hijack log:
Logfile of HijackThis v1.98.2
Scan saved at 17:27:21, on 11-09-2004
Platform: Windows XP SP1 (WinNT 5.01.3590)
MSIE: Internet Explorer v6.00 SP1 (6.00.3590.0000)

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\SYSTEM32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Common Files\PFShared\UmxCfg.exe
D:\Program Files\Common Files\PFShared\UmxPol.exe
D:\Program Files\Tiny Firewall Pro\UmxAgent.exe
D:\WINDOWS\MWW32\MANAGER\MWMDMSVC.EXE
D:\Program Files\Tiny Firewall Pro\UmxTray.exe
D:\WINDOWS\MWW32\MANAGER\MWSSW32.EXE
D:\Documents and Settings\Administrator.MIC-LAB\Desktop\TmSrvNT.exe
D:\WINDOWS\system32\serverappliance\appmgr.exe
D:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
D:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
D:\WINDOWS\system32\serverappliance\elementmgr.exe
D:\WINDOWS\System32\inetsrv\inetinfo.exe
D:\mailserver\mlsrvnt.exe
D:\WINDOWS\System32\timesync.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\serverappliance\srvcsurg.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Common Files\PFShared\umxlu.exe
D:\WINDOWS\system32\Dfssvc.exe
D:\WINDOWS\System32\tp4mon.exe
D:\PROGRA~1\Grisoft\AVG7\avgcc.exe
D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\Outlook Express\msimn.exe
D:\Documents and Settings\Administrator.MIC-LAB\Desktop\hijack\hijackthis.exe

O2 - BHO: Zero Popup - {2EF37A01-884F-11d5-AC99-B112050ECB4F} - D:\PROGRA~1\ZEROPO~1\HTMLEdit.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - D:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [TrackPointSrv] tp4mon.exe
O4 - HKLM\..\Run: [Modem Update Reminder] D:\WINDOWS\MWW32\manager\mwremind.exe autorun
O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] D:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O4 - HKCU\..\Run: [AMonitor] D:\Program Files\Tiny Firewall Pro\amon.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F7E20485-19AE-478F-85E7-65F6F23ABE07}: NameServer = 212.242.40.3,212.242.40.51

Umiddelbart ser loggen ren ud!

Der er dælme også renset ud nu... Takker igen.. smid svar. :)

Prøv lige at genstarte et par gange for at se, om noget nyt "snavs" kommer til - tak.

Det vil jeg gøre... tak for nu..

Velbekomme ;-)