Hjelp til å fjerne Trojan Vanquish20 spyware/virus

Gennemfør proceduren som her beskrevet: http://www.eksperten.dk/artikler/755

(Ikke nødvendigvis mig der følger op...)

takker for svar

ser ut til at jeg roter med poeng givingen her..beklager så mye

... hvor blev diverse LOG filer af ? - som beskrevet i http://www.eksperten.dk/artikler/755

Generelt -> http://expfaq.1go.dk/

Hei igjen og god jul
Har hatt det travelt de siste dager med masse besøk og det som medfølger i julen.
Nå er jeg igjen klar for å fjerne det trojan Vanquish20 cirus/malware jeg har fått slik at jeg forhåpetligvis får begynne det nye året virus fri :D

har nå kjørt igjennom  proseduren  i artikkel /755.

Ewido anti malware kjørte i 25 min og kom kun 9,7 % frem og 340 000 filer ble søkt.Da alt så ut som det sto i ro avbrøt jeg siden den ikke forandret seg fra 9,7%

Skal sette den på nå enda en gang  og la den kjøre og se om det samme skjer igjen.

Etter å ha installert disse progamene har jeg nå fått opp en feilmelding ved pålogging ved Windows. :Error loading driver 2 denne har jeg lukket ned uten å ta hensyn til den da jeg antar det er et virus.

Her følger mine logs.
hijack this ble downloadet og log legges ved:



-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 108563
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 1643 Kb/s
Scan time: 00:19:56
-----------------------------------------------------------------------------

=============================================================================
Total session statistics
=============================================================================
Objects scanned: 108645
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 1666 Kb/s
Scan time: 00:20:00
=============================================================================



---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on:            01:28:23, 28.12.2005
+ Report-Checksum:        721E746C

+ Scan result:

    No infected objects found.


::Rep















Logfile of HijackThis v1.99.1
Scan saved at 01:32:58, on 28.12.2005
Platform: Windows 2003 SP1 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 SP1 (6.00.3790.1830)

Running processes:
C:\Documents and Settings\Administrator\Desktop\hijackthis.exe

F2 - REG:system.ini: UserInit=userinit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [DU Meter] "C:\Program Files (x86)\DU Meter\DUMeter.exe"
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\PROGRA~2\Maxtor\OneTouch\Utils\OneTouch.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files (x86)\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files (x86)\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\SysWow64\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [EA Core] C:\Program Files (x86)\Electronic Arts\EA Downloader\Core.exe -silent
O4 - Startup: MemTurbo.lnk = C:\Program Files (x86)\MemTurbo30\MemTurbo.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files (x86)\PartyPoker\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files (x86)\PartyPoker\PartyPoker.exe
O9 - Extra button: NordicBet Poker - {E6073F93-9541-4be4-9800-109D378EB99B} - C:\Program Files (x86)\nordicbetMPP\MPPoker.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123880243479
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~2\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\SYSTEM32\dimsntfy.dll
O20 - Winlogon Notify: EFS - C:\WINDOWS\SYSTEM32\sclgntfy.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2saag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing)
O23 - Service: Event Log (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files (x86)\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files (x86)\ewido anti-malware\ewidoguard.exe
O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe (file missing)
O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe (file missing)
O23 - Service: Net Logon (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NT LM Security Support Provider (NtLmSsp) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: IPSEC Services (PolicyAgent) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Protected Storage (ProtectedStorage) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe (file missing)
O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe (file missing)
O23 - Service: Security Accounts Manager (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional 2005.SR2a\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional 2005.SR2a\RpcSandraSrv.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Unknown owner - C:\PROGRA~2\TRENDM~1\INTERN~1\Tmntsrv.exe (file missing)
O23 - Service: Virtual Disk Service (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe (file missing)
O23 - Service: WMI Performance Adapter (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe (file missing)


Håper dette hjelper videre

Har nå kjørt spybot scan og den fant mange filer
Advertising.com 3
Avenue A.inc    1
Double click    1
Fast click      5
Hitbot          3
MediaPlex      1
shnitFraud -C  3
Value click    1

Fjernet disse og restartet.Her er den nye hijack this log.
ogfile of HijackThis v1.99.1
Scan saved at 02:23:38, on 28.12.2005
Platform: Windows 2003 SP1 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 SP1 (6.00.3790.1830)

Running processes:
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files (x86)\ewido anti-malware\ewidoctrl.exe
C:\Program Files (x86)\ewido anti-malware\ewidoguard.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files (x86)\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\SysWOW64\ctfmon.exe
C:\Program Files (x86)\MemTurbo30\MemTurbo.exe
C:\Program Files (x86)\DU Meter\DUMeter.exe
C:\PROGRA~2\Maxtor\OneTouch\Utils\OneTouch.exe
C:\Program Files (x86)\DAEMON Tools\daemon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\cli.exe
C:\PROGRA~2\MOZILL~1\FIREFOX.EXE
C:\Program Files (x86)\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\Administrator\Desktop\hijackthis.exe

F2 - REG:system.ini: UserInit=userinit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [DU Meter] "C:\Program Files (x86)\DU Meter\DUMeter.exe"
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\PROGRA~2\Maxtor\OneTouch\Utils\OneTouch.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files (x86)\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files (x86)\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\SysWow64\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [EA Core] C:\Program Files (x86)\Electronic Arts\EA Downloader\Core.exe -silent
O4 - Startup: MemTurbo.lnk = C:\Program Files (x86)\MemTurbo30\MemTurbo.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files (x86)\PartyPoker\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files (x86)\PartyPoker\PartyPoker.exe
O9 - Extra button: NordicBet Poker - {E6073F93-9541-4be4-9800-109D378EB99B} - C:\Program Files (x86)\nordicbetMPP\MPPoker.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123880243479
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~2\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\SYSTEM32\dimsntfy.dll
O20 - Winlogon Notify: EFS - C:\WINDOWS\SYSTEM32\sclgntfy.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2saag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing)
O23 - Service: Event Log (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files (x86)\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files (x86)\ewido anti-malware\ewidoguard.exe
O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe (file missing)
O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe (file missing)
O23 - Service: Net Logon (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NT LM Security Support Provider (NtLmSsp) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: IPSEC Services (PolicyAgent) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Protected Storage (ProtectedStorage) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe (file missing)
O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe (file missing)
O23 - Service: Security Accounts Manager (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional 2005.SR2a\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional 2005.SR2a\RpcSandraSrv.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Unknown owner - C:\PROGRA~2\TRENDM~1\INTERN~1\Tmntsrv.exe (file missing)
O23 - Service: Virtual Disk Service (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe (file missing)
O23 - Service: WMI Performance Adapter (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe (file missing)

Har nå kjørt Ewido i 630 min. på complete scan.Den er fortsatt bare kommet 8% og for meg virker det som progrqrammet ikke virker eller kjører på "tomgang" 6302.525 filer er blitt scannet i løpet av denne tiden.
Er dette programmet kompatibelt med  xp64? kan det være årsaken til  at ewido ikke fungerer?

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

Jeg har nå laget en custom scan  der jeg deselected minne. Da fant Ewido 27 stk filer
Her er siste log jeg har





+ Created on:            20:20:44, 28.12.2005
+ Report-Checksum:        384833B1

+ Scan result:

    :mozilla.7:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
    :mozilla.8:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.9:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.23:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
    :mozilla.24:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
    :mozilla.25:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
    :mozilla.26:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
    :mozilla.27:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
    :mozilla.31:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Estat : Cleaned with backup
    :mozilla.50:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Overture : Cleaned with backup
    :mozilla.54:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.56:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
    :mozilla.57:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
    :mozilla.58:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
    :mozilla.59:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
    :mozilla.60:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.62:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Valueclick : Cleaned with backup
    :mozilla.64:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Myaffiliateprogram : Cleaned with backup
    :mozilla.78:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.79:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.80:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.81:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.82:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.126:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Smartadserver : Cleaned with backup
    C:\System Volume Information\_restore{E522A499-0735-4CCF-82B4-1C62CF98FAEB}\RP194\A0166659.exe -> Trojan.Small : Cleaned with backup
    C:\System Volume Information\_restore{E522A499-0735-4CCF-82B4-1C62CF98FAEB}\RP194\A0166660.exe -> Trojan.Small : Cleaned with backup
    C:\System Volume Information\_restore{E522A499-0735-4CCF-82B4-1C62CF98FAEB}\RP194\A0166661.exe -> Trojan.Small : Cleaned with backup


::Report End

(Jeg har lige 'prikket' til en Ekspert til det videre forløb...)

Så må vi senere 'snakke' om det med POINT som du 'kom til' at ta' selv [24/12-2005 00:09:15] ???

Jeg kan heller ikke se noget galt i loggen

<arlet>: Der er jo en del (file missing) linier ???
C:\WINDOWS\system32\lsass.exe (file missing)
???
Er det noget rod ?

Her er siste ewido log :
Men med Ewido får jeg ikke sjekket minne da det stopper på 912 og går om og om igjen. se log over.
Med spybot får jeg opp noen feil.Men finner ikke log  som jeg får postet.
Den fant følgende.
Advertising.com (3)
Avenue A.Inc (1)
Double click (1)
fast click  (5)
Hitbox      (3)
Mediaplex    (1)
shnitfraud-c (3)
Value disk  (1)

Dette er nå tilsynelatende redusert til 3 stk. Med dr web har jeg hatt  Trojan Vanquish20 i minne.

Når det kommer til poengene er jo dette verd vel 60 poeng. De jeg fikk selv. Må jo bare taes tilbake eller  noe sånt vel?

m.v.h.

alebi

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on:            22:19:21, 28.12.2005
+ Report-Checksum:        F16E0100

+ Scan result:

    :mozilla.8:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
    :mozilla.10:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.11:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.8:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
    :mozilla.10:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.11:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup


::Report End

Her er siste jeg tok etter å ha restartet igjen

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on:            23:45:10, 28.12.2005
+ Report-Checksum:        3DA5AEE2

+ Scan result:

    :mozilla.7:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
    :mozilla.8:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.9:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.7:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
    :mozilla.8:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.9:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.7:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
    :mozilla.8:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.9:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup


::Report End

dr1-> de (file missing) linjer i 23 linjerne skal ikke fixes, hvis filen er legal, så kan det være en fejl i hijackthis, derfor fixes de ikke

Men det var Hijavkthis du snakker mo der.Hva med alle feil som kommer listet i spybot og  Ewido?
Hvis jeg  prøver og søke i minne,står den og spinner på 912 om og om igjen.
Men har vi  ikke funnet ut hva det heter enda? Jeg har da skrevet ned alle de innslag jeg har funnet på min maskin.?!

Hei igjen.og godt nyttår.
Maskinen er stadig infisert og jeg har kommet frem med noen resultater som viser at det kan være et mulig BATCh.virus.
Jeg har søkt og lett etter forskjellige programmer til å fjerne det med men finner ingen.

Er det ingen som kan med denne typen virus som jeg har?
hvordan skal det løses med poengene. ?
Til den som finner ut løsning på dette gir jeg alle mine 200 poeng  da dette er et virkelig viktig for meg å ikke reformatere igjen.

siste log kjørt den 6 Januar:
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on:            02:59:13, 06.01.2006
+ Report-Checksum:        C735CC3B

+ Scan result:

    :mozilla.15:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.16:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.17:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Fuck-access : Cleaned with backup
    :mozilla.18:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.19:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.20:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.21:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.22:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.24:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.42:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
    :mozilla.43:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
    :mozilla.106:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup
    :mozilla.107:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup
    :mozilla.138:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.139:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Falkag : Cleaned with backup
    :mozilla.141:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Euroclick : Cleaned with backup
    :mozilla.142:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Euroclick : Cleaned with backup
    :mozilla.147:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
    :mozilla.148:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
    :mozilla.150:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.151:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.184:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Webtrendslive : Cleaned with backup
    :mozilla.185:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
    :mozilla.187:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Hitbox : Cleaned with backup
    :mozilla.188:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.189:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.192:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Realtracker : Cleaned with backup
    :mozilla.193:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Realtracker : Cleaned with backup
    :mozilla.196:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2nze8g3z.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup


::Report End

Og Hijack this log:

Logfile of HijackThis v1.99.1
Scan saved at 03:25:42, on 06.01.2006
Platform: Windows 2003 SP1 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 SP1 (6.00.3790.1830)

Running processes:
C:\Documents and Settings\Administrator\Desktop\hijackthis.exe

F2 - REG:system.ini: UserInit=userinit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [DU Meter] "C:\Program Files (x86)\DU Meter\DUMeter.exe"
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\PROGRA~2\Maxtor\OneTouch\Utils\OneTouch.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files (x86)\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files (x86)\MSN Messenger\msnmsgr.exe" /background
O4 - Startup: MemTurbo.lnk = C:\Program Files (x86)\MemTurbo30\MemTurbo.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files (x86)\PartyPoker\PartyPoker.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files (x86)\PartyPoker\PartyPoker.exe
O9 - Extra button: NordicBet Poker - {E6073F93-9541-4be4-9800-109D378EB99B} - C:\Program Files (x86)\nordicbetMPP\MPPoker.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1123880243479
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~2\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\SYSTEM32\dimsntfy.dll
O20 - Winlogon Notify: EFS - C:\WINDOWS\SYSTEM32\sclgntfy.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2saag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing)
O23 - Service: Event Log (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files (x86)\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files (x86)\ewido anti-malware\ewidoguard.exe
O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe (file missing)
O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe (file missing)
O23 - Service: Net Logon (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NT LM Security Support Provider (NtLmSsp) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: IPSEC Services (PolicyAgent) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Protected Storage (ProtectedStorage) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe (file missing)
O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe (file missing)
O23 - Service: Security Accounts Manager (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional 2005.SR2a\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional 2005.SR2a\RpcSandraSrv.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files (x86)\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Unknown owner - C:\PROGRA~2\TRENDM~1\INTERN~1\Tmntsrv.exe (file missing)
O23 - Service: Virtual Disk Service (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe (file missing)
O23 - Service: WMI Performance Adapter (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe (file missing)

Er denne tråden avsluttet eller venter vi på svar av noen sort?
Jeg lurer,da ingen har svart på log siden før nyttår.
Vennligst svar:D

Måske pga: "Så må vi senere 'snakke' om det med POINT som du 'kom til' at ta' selv [24/12-2005 00:09:15] ???"

Så kommer der ikke nødvendigvis automatisk E-mail til dem som er med på tråden her...

Ja det beklager jeg.gi meg en instruks  så skal jeg gjøre det som er riktig.Det var ikke med meningen å gi meg selv poeng.Og jeg vil gjerne få det ordnet. alle mine poeng utenom kan gå til den dom klarer å fjerne viruset.
Håper dette gjør bot på skaden og igjen,
Jeg beklager.
M.v.h
Alebi

Er det mulig at Admin kan logge seg på min konto og gjøre det som skal til.
dr1,hvis du vil kan jeg sende deg mitt passord.!
m.v.h
Alebi

Dr1 Jeg vet ikke hvor hardt jeg er rammet av dette eller om jeg blir hacket eller hva.? for jeg ser ikke hvordan man giver poenng selv etter å ha lest  http://expfaq.1go.dk/?id=86#saadan_goer_du  .Har overhodet ikke anelse hvor jeg ellers kan vende meg etter hjelp med dette.Nå har jeg også lagt meg flat og bedt om unnskyldning.I tillegg har jeg sagt at du kan fikse  i poengene mine akkurat så du vil hvis vi kan få kontakt.
Det er nå godt flere månder og jeg kan ikke se hvorfor det ikke blir svart på spørsmålene  mine?
Ett siste alternativ kan være å slette kontoen  får så å åpne en ny.
Håper dette ordner opp i saken og at vi kan få tatt fatt i trojan vanquish spywaren i minnet mitt

Med vennlig hilsen
Alebi

Beklager flere månder,det skal være  snart en måned.
Det bare føles så inderlig lenge med dette viruset:D

Forslag:

Genoprette dette spm.
Evt. henvise til denne tråd http://www.eksperten.dk/spm/674180

... og beklage at der gik kludder i det...