Hijack this logg

Jeg kigger lige på den ..

Hent denne Kaspersky scanner, den skal du bruge senere.
http://www.spywareinfo.dk/download/mwav.exe - Virusscanner.

Så skal du genstarte pc'en i fejlsikret tilstand. Klik F8 under opstart.

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, slet mapper og filer listet nederst.
Dobbelttjek, så alt kommer med.

O4 - HKLM\..\Run: [Win32 USB2 Driver] updatemgr.exe
O4 - HKLM\..\Run: [Task manager] iexplorer.exe
O4 - HKLM\..\Run: [svrtime] svrtime32.exe
O4 - HKLM\..\Run: [Microsoft Security Management] winlogs.exe
O4 - HKLM\..\RunServices: [Windows AutoUpdate] mswauc.exe
O4 - HKLM\..\RunServices: [Win32 USB2 Driver] updatemgr.exe
O4 - HKLM\..\RunServices: [Scheduler Service] wsass.exe
O4 - HKLM\..\RunServices: [Task manager] iexplorer.exe
O4 - HKLM\..\RunServices: [svrtime] svrtime32.exe
O4 - HKLM\..\RunServices: [Microsoft Security Management] winlogs.exe
O4 - HKCU\..\Run: [Win32 USB2 Driver] updatemgr.exe
O4 - HKCU\..\Run: [Task manager] iexplorer.exe
O4 - HKCU\..\Run: [svrtime] svrtime32.exe
O23 - Service: DisplayController - Unknown owner - C:\WINNT\System32\inetsrv\daemon\services.exe
O23 - Service: EthernetController - Unknown owner - C:\WINNT\System32\inetsrv\daemon\services.exe

---------------------------------------
Sletning af filer og mapper:
Åbn en mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".
-------------------
Mapper:
C:\WINNT\System32\inetsrv\daemon

Filer:
C:\WINDOWS\system32\updatemgr.exe
C:\WINDOWS\system32\iexplorer.exe
C:\WINDOWS\system32\svrtime32.exe
C:\WINDOWS\system32\winlogs.exe
C:\WINDOWS\system32\mswauc.exe
C:\WINDOWS\system32\wsass.exe


---------------------------------------
Så kører du engangsskanneren fra Kaspersky - Aktiver det hele i opsætningen derinde, så den kan skanne alt igennem.
---------------------------------------

Klik start | kør, skriv regedit og tryk enter.
Find denne nøgle i registreringsdatabasen og udvid den så du kan se de underliggende objekter.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

Udvid den så du kan se de underliggende nøgler.
Højreklik disse nøgler og vælg slet:

DisplayController
EthernetController

Luk regedit

Genstart normalt og kom med en ny log til kontrol

hey... så er jeg færdig....

ny log file Hijack:

Logfile of HijackThis v1.99.1
Scan saved at 15:53:20, on 29-05-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmer\TOPCOM\Skyracer Wireless LAN USB\ZDConfig.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\mieritz\Skrivebord\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [mwavscan] "C:\Kaspersky\mwavscan.com" /s
O4 - HKCU\..\Run: [svrtime] svrtime32.exe
O4 - Global Startup: Skyracer USB.lnk = C:\Programmer\TOPCOM\Skyracer Wireless LAN USB\ZDConfig.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

log file fra escan:

File C:\WINDOWS\system32\itnalispy.exe infected by "Exploit.Win32.MS04-011" Virus. Action Taken: File Renamed.
File C:\Documents and Settings\mieritz\pro.exe tagged as not-a-virus:Porn-Dialer.Win32.Kotu.d. No Action Taken.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP39\A0008347.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP43\A0008534.exe tagged as not-a-virus:Porn-Dialer.Win32.Kotu.d. No Action Taken.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP44\A0008535.exe tagged as not-a-virus:Porn-Dialer.Win32.Kotu.d. No Action Taken.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP44\A0008543.exe tagged as not-a-virus:Porn-Dialer.Win32.Kotu.d. No Action Taken.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP47\A0009680.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP47\A0009681.exe infected by "Trojan-Proxy.Win32.Bobax.h" Virus. Action Taken: File Deleted.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP47\A0009682.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP47\A0009683.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP47\A0009684.exe infected by "Backdoor.Win32.Rbot.fa" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP47\A0009685.exe infected by "Backdoor.Win32.SdBot.gen" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP47\A0009686.exe infected by "Backdoor.Win32.SdBot.gen" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP47\A0009687.exe infected by "Backdoor.Win32.SdBot.gen" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP48\A0011255.exe tagged as not-a-virus:Porn-Dialer.Win32.Kotu.d. No Action Taken.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP48\A0011267.exe tagged as not-a-virus:Porn-Dialer.Win32.Kotu.d. No Action Taken.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP49\A0011268.exe tagged as not-a-virus:Porn-Dialer.Win32.Kotu.d. No Action Taken.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP60\A0018646.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP72\A0041707.exe tagged as not-a-virus:Porn-Dialer.Win32.Kotu.d. No Action Taken.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP72\A0041708.exe tagged as not-a-virus:Porn-Dialer.Win32.Kotu.d. No Action Taken.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP75\A0045651.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP77\A0047735.exe infected by "Backdoor.Win32.Iroffer.b" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP77\A0047736.exe tagged as not-a-virus:RiskWare.ftp.Serv-U.50011. No Action Taken.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP77\A0047737.exe tagged as not-a-virus:RiskWare.Tool.HideWindows. No Action Taken.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP77\A0047757.exe infected by "Backdoor.Win32.SdBot.gen" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP77\A0047758.exe infected by "Backdoor.Win32.Rbot.gen" Virus. Action Taken: File Renamed.
File C:\System Volume Information\_restore{F3E831F1-22FA-4001-8B1A-270ECB03505E}\RP77\A0047759.exe infected by "Exploit.Win32.MS04-011" Virus. Action Taken: File Renamed.
File C:\WINDOWS\system32\config\systemprofile\Lokale indstillinger\Temporary Internet Files\Content.IE5\WXYBK9UF\metalhead9bo[1].jpg tagged as not-a-virus:AdWare.WinAD.m. No Action Taken.
File D:\Ny mappe det hele\Ny mappe det hele\andet\Billeder\software\zca3001.exe tagged as not-a-virus:AdWare.NavExcel. No Action Taken.¨


jeg ved ikke om du skal bruge den sidste log file...

håber at jeg er helt fri for fejl nu....

Det er meget tæt på.

Fix disse 2 linier i HiJackThis:

O4 - HKLM\..\Run: [mwavscan] "C:\Kaspersky\mwavscan.com" /s
O4 - HKCU\..\Run: [svrtime] svrtime32.exe

Genstart i normal tilstand og kom med en ny log

Logfile of HijackThis v1.99.1
Scan saved at 17:17:15, on 29-05-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmer\TOPCOM\Skyracer Wireless LAN USB\ZDConfig.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\mieritz\Skrivebord\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - Global Startup: Skyracer USB.lnk = C:\Programmer\TOPCOM\Skyracer Wireless LAN USB\ZDConfig.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Så blev den ren.

Efter sådan en tur er det altid en god ide og rydde op i systemgendannelses filerne. Deaktiver systemgendannelse  - genstart din computer - aktiver systemgendannelse.
(klik start | indstillinger | kontrolpanel | system, fanebladet systemgendannelse)

Og så skal du også lige skjule dine filer og mapper igen, så du ikke ved en fejl kommer til at slette en vigtig fil. Det gør du samme sted, hvor du satte det til at vise alle filer, denne gang vælger du bare: Vis ikke skjulte filer og mapper.

Du kan evt installere nogle af programmerne i spywarefri pakken..de er alle små, konflikter ikke og er meget effektive mod snavs af den slags du lige har været angrebet af.

Specielt anbefaler vi Spybot,spywareblaster, IE-Spyad og spywareguard.
Se mere i "pakken" her
http://www.spywarefri.dk/pakken.htm

tak for hjælpen...

Velbekomme og takker for point :)