Virus eller ren?

tjekker den nu

Du skal nu til at i gang med at fixe:

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, luk hijackthis igen.
Dobbelttjek, så alt kommer med.


O4 - HKCU\..\Run: [start uploading] smsss.exe
O4 - HKCU\..\RunServices: [start uploading] smsss.exe


Gå i søg og søg efter:
smsss.exe

Slet hvad den finder


------------------------------------------------

Hent og kør ad-aware herfra: http://www.arlet.dk/spywarescanner.htm
scan hele computeren og slet alt hvad den finder

----------------------------------------------------------

Hent og kør denne scanner fra Kaspersky : http://www.spywareinfo.dk/download/mwav.exe
Sæt flueben i følgende: Memory, Startup folders, drive, Registry, System folders og Services.
Sæt prik i følgende: All local drives og Scan all files
Og så trykker du på Scan Clean

----------------------------------------------------------

Derefter genstarter du og sender en ny log herind, for at se om vi har fået den helt ren.

Hej Arlet
Ikke meget har ændret sig..
Åbnede og kørte HiJackThis som du sagde. Hvad virker den egentlig for? Jeg kan køre den, Fixe de to filer, køre scan igen (uden at lukke åbne programmer mellem hver scan), og de er der allerede igen - hvis de overhovedet bliver fjernet?..

Derefter søgte jeg efter smsss.exe - og den findes ikke. (Har været i "folders" og hide og hhv unhide de rigtige filer, så alt kan ses)
Jeg kørte så Ad-Aware SE PRO build 1.05 "Full System Scan" - den finder intet..
Kaspersky fandt heller intet, udover 15 fejl..
Her er nogle udvalgte linjer fra den enorme log:
Sun Jan 02 16:40:00 2005 => Options Selected by User:
Sun Jan 02 16:40:00 2005 => Memory Check: Enabled
Sun Jan 02 16:40:00 2005 => Registry Check: Enabled
Sun Jan 02 16:40:00 2005 => StartUp Folder Check: Enabled
Sun Jan 02 16:40:00 2005 => System Folder Check: Enabled
Sun Jan 02 16:40:00 2005 => System Area Check: Disabled
Sun Jan 02 16:40:00 2005 => Services Check: Enabled
Sun Jan 02 16:40:00 2005 => Drive Check: Disabled
Sun Jan 02 16:40:00 2005 => All Drive Check :Enabled
Sun Jan 02 16:40:00 2005 => Scanning Type: Scan And Clean
Sun Jan 02 16:40:00 2005 => Folder Check: Disabled
Sun Jan 02 16:40:07 2005 => ERROR!!! Invalid Entry \??\O:\INSTALL\GMSIPCI.SYS in SYSTEM\CurrentControlSet\Services\GMSIPCI...
Sun Jan 02 16:40:08 2005 => ERROR!!! Invalid Entry \??\O:\NTACCESS.sys in SYSTEM\CurrentControlSet\Services\NTACCESS...
Sun Jan 02 16:40:16 2005 => ERROR!!! ScanFile fails for C:\WINDOWS\SchedLgU.Txt
Sun Jan 02 16:41:42 2005 => ERROR!!! ScanFile fails for C:\DOCUME~1\LOCALS~1\Cookies\index.dat
Sun Jan 02 16:41:42 2005 => ERROR!!! ScanFile fails for C:\DOCUME~1\LOCALS~1\LOCALS~1\APPLIC~1\MICROS~1\Windows\UsrClass.dat
Sun Jan 02 16:41:42 2005 => ERROR!!! ScanFile fails for C:\DOCUME~1\LOCALS~1\LOCALS~1\APPLIC~1\MICROS~1\Windows\USRCLA~1.LOG
Sun Jan 02 16:41:42 2005 => ERROR!!! ScanFile fails for C:\DOCUME~1\LOCALS~1\LOCALS~1\History\History.IE5\index.dat
Sun Jan 02 16:41:44 2005 => ERROR!!! ScanFile fails for C:\DOCUME~1\LOCALS~1\LOCALS~1\TEMPOR~1\Content.IE5\index.dat
Sun Jan 02 16:41:44 2005 => ERROR!!! ScanFile fails for C:\DOCUME~1\LOCALS~1\NTUSER.DAT
Sun Jan 02 16:41:44 2005 => ERROR!!! ScanFile fails for C:\DOCUME~1\LOCALS~1\NTUSER~1.LOG
Sun Jan 02 16:41:44 2005 => ERROR!!! ScanFile fails for C:\DOCUME~1\NETWOR~1\LOCALS~1\APPLIC~1\MICROS~1\Windows\UsrClass.dat
Sun Jan 02 16:41:44 2005 => ERROR!!! ScanFile fails for C:\DOCUME~1\NETWOR~1\LOCALS~1\APPLIC~1\MICROS~1\Windows\USRCLA~1.LOG
Sun Jan 02 16:41:44 2005 => ERROR!!! ScanFile fails for C:\DOCUME~1\NETWOR~1\NTUSER.DAT
Sun Jan 02 16:41:44 2005 => ERROR!!! ScanFile fails for C:\DOCUME~1\NETWOR~1\NTUSER~1.LOG
Sun Jan 02 16:41:45 2005 => ERROR!!! ScanFile fails for C:\DOCUME~1\tj\Cookies\index.dat
Sun Jan 02 16:41:46 2005 => ERROR!!! ScanFile fails for C:\DOCUME~1\tj\LOCALS~1\APPLIC~1\MICROS~1\Windows\UsrClass.dat
Sun Jan 02 16:41:46 2005 => ERROR!!! ScanFile fails for C:\DOCUME~1\tj\LOCALS~1\APPLIC~1\MICROS~1\Windows\USRCLA~1.LOG
Sun Jan 02 16:41:46 2005 => ERROR!!! ScanFile fails for C:\DOCUME~1\tj\LOCALS~1\History\History.IE5\index.dat
Sun Jan 02 16:41:47 2005 => ERROR!!! ScanFile fails for C:\DOCUME~1\tj\LOCALS~1\History\History.IE5\MSHIST~4\index.dat
Sun Jan 02 16:41:57 2005 => ERROR!!! ScanFile fails for C:\DOCUME~1\tj\LOCALS~1\TEMPOR~1\Content.IE5\index.dat
Sun Jan 02 16:44:06 2005 => Scanning File C:\Program Files\Zone Labs\ZoneAlarm\ErrorLog.txt
Sun Jan 02 16:44:56 2005 => ERROR!!! ScanFile fails for C:\SYSTEM~1\_RESTO~1\RP1\change.log
Sun Jan 02 16:51:52 2005 => ERROR!!! ScanFile fails for C:\WINDOWS\INTERN~1\fwdbglog.txt
Sun Jan 02 17:00:33 2005 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\AppEvent.Evt
Sun Jan 02 17:00:33 2005 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\default
Sun Jan 02 17:00:33 2005 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\default.LOG
Sun Jan 02 17:00:33 2005 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SAM
Sun Jan 02 17:00:33 2005 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SecEvent.Evt
Sun Jan 02 17:00:33 2005 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SECURITY
Sun Jan 02 17:00:33 2005 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SECURITY.LOG
Sun Jan 02 17:00:34 2005 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\SysEvent.Evt
Sun Jan 02 17:00:34 2005 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\config\system

Sun Jan 02 17:02:57 2005 => ERROR!!! ScanFile fails for C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR
Sun Jan 02 17:03:14 2005 => ERROR!!! FindFirstFile For D:\System Volume Information\*.* Failed!!! Reason is Access is denied. (0x5)
Sun Jan 02 17:03:14 2005 => ERROR!!! FindFirstFile For E:\System Volume Information\*.* Failed!!! Reason is Access is denied. (0x5)
Sun Jan 02 17:03:14 2005 => ERROR!!! FindFirstFile For F:\System Volume Information\*.* Failed!!! Reason is Access is denied. (0x5)
--------------------------
Ny HijackThis Log:

Logfile of HijackThis v1.99.0
Scan saved at 17:11:19, on 02-01-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\ZoneLabs\isafe.exe
C:\WINDOWS\System32\GEARSec.exe
C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\sstray.exe
C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HiJackThis\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [AWMON] "C:\Program Files\Lavasoft\Ad-Aware SE Professional\Ad-Watch.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [start uploading] smsss.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\RunServices: [start uploading] smsss.exe
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1104447908607
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O23 - Service: CA ISafe - Computer Associates International, Inc. - C:\WINDOWS\System32\ZoneLabs\isafe.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost\Agent\PQV2iSvc.exe
O23 - Service: NVIDIA Display Driver Service - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Hjæææælp
Min PC er sat til off-system-Restore
Jeg har lige startet den i fejlsikret tilstand.
Kørt adaware, hijackthis, rehance (slettet alle entryes med smsss), trends Sysclean.exe, Kasperskys mwavscan..
Antivirus finder intet.
Når jeg så genstartet PCen i normal mode, kommer der en meddelse fra Ad-aware :
Ad-Watch Logfile, exported on 02-01-2005
Total number of events:7
===============================================
02-01-2005 20:25:17 - Definitions file SE1R24 29.12.2004 loaded successfully.
Build:SE1R24 29.12.2004
Total Signatures :35117
Target Families :633
Target Categories :6
CSI data Size :41480

File Size :1313453

===============================================
02-01-2005 20:25:17 - User preferences file loaded.
Ad-Watch preference file loaded.
Applying user settings
C:\Documents and Settings\tj\Application Data\Lavasoft\Ad-Aware\awsettings.awc
Initialization complete.




===============================================
02-01-2005 20:25:18 - Sites file loaded.
Sites file loaded successfully.
C:\Program Files\Lavasoft\Ad-Aware SE Professional\sites.txt
Total entries : 3229





===============================================
02-01-2005 20:25:18 - Registry modification detected
Root:HKEY_CURRENT_USER
Key:Software\Microsoft\Windows\CurrentVersion\Run
Value:MSMSGS
Data:"C:\Program Files\Messenger\msmsgs.exe" /background
New Data:



===============================================
02-01-2005 20:25:18 - Registry modification detected
Root:HKEY_CURRENT_USER
Key:Software\Microsoft\Windows\CurrentVersion\RunServices
Value:start uploading
Data:smsss.exe
New Data:



===============================================
02-01-2005 20:25:18 - Registry modification detected
Root:HKEY_LOCAL_MACHINE
Key:Software\Microsoft\Windows\CurrentVersion\Run
Value:MSConfig
Data:
New Data:C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto



===============================================
02-01-2005 20:25:18 - Registry modification detected
Root:HKEY_CURRENT_USER
Key:Software\Microsoft\Windows\CurrentVersion\Run
Value:start uploading
Data:smsss.exe
New Data:



===============================================

Start op i fejlsikret og fix disse i hijackthis:
O4 - HKCU\..\Run: [start uploading] smsss.exe
O4 - HKCU\..\RunServices: [start uploading] smsss.exe

genstart og ny log

Jeg tror at problemet var, at jeg havde fået fat i en "giftig" pirat-udgave af Ad-aware pro.... Det var et af de første programmer jeg installere på PCén hver gang den var formatteret, og så inficerede den PCén.. Siden jeg stoppede med Ad-aware pro og bruger den gratis, har der ingen probemer været..
og SLET ingen efter jeg bruger Firefox...

Mvh
Tore