Hijack this log

tjekker den nu

Ewido skal du downloade her: http://www.ewido.net/en/download/ ( Vi skal bruge den senere)
Klik på Download now. Installer og kør Ewido. Opdater straks efter installationen programmet.

-----------------------

Dr.Web skal du downloade her:ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

-----------------------


Du skal nu til at i gang med at fixe:

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, luk hijackthis igen.
Dobbelttjek, så alt kommer med.


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchcentral.cc/index.php?v=4&aff=4832
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file://C:\WINDOWS\blank.mht

O2 - BHO: WHttpHelper Class - {9896231A-C487-43A5-8369-6EC9B0A96CC0} - C:\WINDOWS\System32\WStart.dll
O2 - BHO: (no name) - {B75F75B8-93F3-429D-FF34-660B206D897A} - C:\WINDOWS\System32\zolker006.dll
O2 - BHO: (no name) - {CD0E1E69-A78A-AC5A-D178-82ADADBA28E0} - C:\WINDOWS\System32\jtmerbky.dll
O2 - BHO: ZToolbar Activator Class - {FFF5092F-7172-4018-827B-FA5868FB0478} - C:\WINDOWS\System32\ztoolb006.dll

O4 - HKLM\..\Run: [NTCommLib3] C:\WINDOWS\System32\NTCommLib3.exe(kender du denne, ellers skal den fixes)
O4 - HKLM\..\Run: [WindowsUpdate] C:\WINDOWS\System\svchost.exe /s
O4 - HKCU\..\Run: [aupd] C:\WINDOWS\System32\symcsvc.exe
O4 - HKCU\..\Run: [Windows installer] C:\winstall.exe
O4 - HKCU\..\Run: [SNInstall] C:\WINDOWS\System32\vxh8jkdq2.exe
O4 - HKCU\..\Run: [Adoe] C:\Programmer\odso\nert.exe
O4 - HKCU\..\Run: [Gge] C:\WINDOWS\System32\w?wexec.exe
O4 - HKCU\..\Run: [SpySheriff] C:\Program Files\SpySheriff\SpySheriff.exe

O15 - Trusted Zone: *.skoobidoo.com
O15 - Trusted Zone: *.slotchbar.com
O15 - Trusted Zone: *.windupdates.com
O15 - Trusted Zone: *.skoobidoo.com (HKLM)
O15 - Trusted Zone: *.slotchbar.com (HKLM)
O15 - Trusted Zone: *.windupdates.com (HKLM)
O15 - Trusted IP range: 67.19.178.84

O16 - DPF: {14A3221B-1678-1982-A355-7263B1281987} - ms-its:mhtml:file://C:\foo.mht!http://82.179.170.82/e9xr2.chm::/file.exe

O23 - Service: svchost.exe (moto) - Unknown owner - C:\WINDOWS\svchost.exe




--------------------------------------------------------------------

Åbn en tilfældig mappe, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

------------------------------

Hent denne bats fil og kør den :
http://www.spywareinfo.dk/download/cleantempxp2k.bat
den sletter alt i din temp mappe.

------------------------------

Genstart computeren i fejlsikret tilstand(Du skal klikke på f8 tasten under genstarten (ca. lige når der er talt ram), og så vælge fejlsikret tilstand. Er du i tvivl, så klik bare på f8 flere gange.)
Find og slet disse manuelt :

C:\WINDOWS\svchost.exe
C:\WINDOWS\System32\NTCommLib3.exe(kender du denne, ellers skal den slettes)
C:\winstall.exe
C:\WINDOWS\System32\vxh8jkdq2.exe
C:\Programmer\odso\nert.exe
C:\WINDOWS\System32\w?wexec.exe


-----------------------------

Stadig i fejlsikret:
Kør en fuld scanning med Dr.Web den starter med en hurtig hukommelsesscan, herefter når den er færdig, skal du markere dine drev, og så trykke på den lille grønne mand nede til højre.

Klik så på Start->Søg, find filen drweb32w.log kopier det nederste af teksten herind, startende med: Total session statistics

-------------------------------

Stadig i fejlsikret:
Kør nu en fuld scanning med Ewido. Når den er færdig trykker du save report og gemmer rapporten.

Så genstarter du computeren normalt og laver en ny hijackthis log, som du lægger herind sammen med reporten fra Ewido

Logfile of HijackThis v1.99.1
Scan saved at 18:23:25, on 03-08-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
e:\Programmer\ewido\security suite\ewidoctrl.exe
e:\Programmer\ewido\security suite\ewidoguard.exe
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Programmer\Java\jre1.5.0_01\bin\jusched.exe
C:\Programmer\Java\jre1.5.0_01\bin\jucheck.exe
C:\WINDOWS\System32\Service.exe
e:\Programmer\RealVNC\WinVNC4.exe
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\devldr32.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Microsoft ActiveSync\WCESCOMM.EXE
C:\Programmer\Messenger\msmsgs.exe
D:\PROGRA~1\FIREFOX\FIREFOX.EXE
C:\WINDOWS\System32\wpabaln.exe
C:\Documents and Settings\Bernd\Skrivebord\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [ATIPTA] "C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programmer\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra button: Opret Foretrukken på mobil enhed - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Opret Foretrukken på mobil enhed... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Programmer\Microsoft ActiveSync\inetrepl.dll
O15 - Trusted IP range: 67.19.178.84
O21 - SSODL: System - {B8AF3D03-5A26-4975-BBB2-435B00B26153} - vr_sys.dll (file missing)
O21 - SSODL: {18D10072035C4515918F7E37EAFAACFC} - {BB352339-C3AF-5647-B3E6-3C07B6E00A96} - d:\programmer\divx\widkkzi1.dll (file missing)
O21 - SSODL: IEFilter - {07B433B3-0BAF-453A-B480-D72809A64E1A} - C:\WINDOWS\system32\IEFilter.dll (file missing)
O21 - SSODL: SysTray.Excn - {1722ECFF-4356-4f5b-B534-E67294FE75E9} - C:\WINDOWS\System32\boiiagha.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ewido security suite control - ewido networks - e:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - e:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: svchost.exe (moto) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - e:\Programmer\RealVNC\WinVNC4.exe" -service (file missing)









---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on:            18:20:02, 03-08-2005
+ Report-Checksum:        4CF40338

+ Scan result:

    HKLM\SOFTWARE\Classes\TypeLib\{C5991634-0185-4B0D-B4F9-6C45597962B7} -> Spyware.CoolWebSearch : Cleaned with backup
    HKLM\SOFTWARE\Classes\ZToolbar.activator -> Spyware.Azsearch : Cleaned with backup
    HKLM\SOFTWARE\Classes\ZToolbar.activator\CLSID -> Spyware.Azsearch : Cleaned with backup
    HKLM\SOFTWARE\Classes\ZToolbar.activator\CurVer -> Spyware.Azsearch : Cleaned with backup
    HKLM\SOFTWARE\Classes\ZToolbar.ParamWr -> Spyware.Azsearch : Cleaned with backup
    HKLM\SOFTWARE\Classes\ZToolbar.ParamWr\CLSID -> Spyware.Azsearch : Cleaned with backup
    HKLM\SOFTWARE\Classes\ZToolbar.ParamWr\CurVer -> Spyware.Azsearch : Cleaned with backup
    HKLM\SOFTWARE\Classes\ZToolbar.StockBar -> Spyware.Azsearch : Cleaned with backup
    HKLM\SOFTWARE\Classes\ZToolbar.StockBar\CLSID -> Spyware.Azsearch : Cleaned with backup
    HKLM\SOFTWARE\Classes\ZToolbar.StockBar\CurVer -> Spyware.Azsearch : Cleaned with backup
    :mozilla.8:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
    :mozilla.10:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.11:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.14:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.26:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Xxxtoolbar : Cleaned with backup
    :mozilla.36:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
    :mozilla.48:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Goldenpalace : Cleaned with backup
    :mozilla.49:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Goldenpalace : Cleaned with backup
    :mozilla.50:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Goldenpalace : Cleaned with backup
    :mozilla.67:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.68:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.70:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.71:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.72:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.73:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.74:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.75:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.76:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.77:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.78:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.79:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.80:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.82:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.83:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.98:C:\Documents and Settings\Bernd\Application Data\Mozilla\Firefox\Profiles\e5xg692k.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
    C:\Documents and Settings\Bernd\Cookies\bernd@atdmt[2].txt -> Spyware.Cookie.Atdmt : Cleaned with backup
    C:\Documents and Settings\Bernd\Lokale indstillinger\Temporary Internet Files\Content.IE5\4M85FB6F\latest[1].exe -> Trojan.Crypt.c : Cleaned with backup
    C:\Documents and Settings\Bernd\Lokale indstillinger\Temporary Internet Files\Content.IE5\OR3GRO7K\MediaTicketsInstaller[1].cab/MediaTicketsInstaller.ocx -> Spyware.MediaTickets : Cleaned with backup
    C:\Documents and Settings\Bernd\Lokale indstillinger\Temporary Internet Files\Content.IE5\V1RT4OHI\latest[1].exe -> Trojan.Crypt.c : Cleaned with backup
    C:\WINDOWS\system32\latest.exe -> Trojan.Crypt.c : Cleaned with backup
    C:\WINDOWS\system32\~update.exe -> Trojan.Crypt.c : Cleaned with backup
    D:\Programmer\DivX\widkkzi1.dll -> TrojanDownloader.Murlo.ar : Cleaned with backup


::Report End








-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 31858
Infected objects found: 63
Objects with modifications found: 0
Suspicious objects found: 1
Objects cured: 0
Objects deleted: 63
Objects renamed: 1
Objects moved: 0
Scan speed: 2892 Kb/s
Scan time: 00:23:45
-----------------------------------------------------------------------------

=============================================================================
Total session statistics
=============================================================================
Objects scanned: 31958
Infected objects found: 68
Objects with modifications found: 0
Suspicious objects found: 1
Objects cured: 0
Objects deleted: 68
Objects renamed: 1
Objects moved: 0
Scan speed: 2895 Kb/s
Scan time: 00:23:54
=============================================================================

Gå i Start -> Kør og skriv Services.msc

Se om du kan finde svchost.exe ELLER (moto) service på listen. Hvis du finder den - Højreklik på den og vælg Egenskaber - klik på "Stop" og vælg Starttype "Deaktiveret" - klik Anvend og OK. Luk service vinduet.

derefter fix i hijackthis

O23 - Service: svchost.exe (moto) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)

Genstart og ny log

det er fint nok nu skal jeg bare hente et antivirus :) takker mange gange

http://www.arlet.dk/freewareantivirusprogrammer.htm