Hjelp til å Fjerne Trojan Vanquish .20

Kan noen være vennlig å fjerne mine innlegg fra Eksperten.dk.
Jegblir hacket og får ingen hjelp.Mine passord  er blitt forandret og jeg sliter veldig med pcen.
Da det ikke er hjelp å få her vil jeg gjerne at mine innlegg slettes og konto avsluttes.
Nå er det over en måned siden jeg fikk Trojan Vanquish 20 Og det eringen gjelp å finne om den og etter flere formateringer er det stadigt der.
Beklager så mye for rot med poeng og div.Men et svar synes jeg virkelig hadde vært på sin plass i det minste.

Det der undrer mig lidt er, hvorfor du bliver ved med at tro at der er CWS på din computer. Ingen af dine logs tyder på det. Snarere må der være et problem i opsætningen af din MSN-konto.

Det kan godt stemme.
Jeg la til en som skulle hjelpe meg med datarelaterte problemer.
Med en gang han ble lagt til startet problemene.
Msn brukte flere sek på  å registrere hva jeg skrev enten ved feil eller riktig passord.den sendte da data med 16,5kb/s i et lite sek før tekst av påloggingsnavn dukket opp igjen.
Derfor ble han blokkert og slettet.
Hva mener du jeg bør gjøre?
Og er dette et trojan Vanquish.20 virus?

Hvis ikke der er kommet mere på din computer siden du oprettede de 2 tråde som du henviser til foroven, så er der ikke virus på din computer. Hvis du er i tvivl, er du meget velkommen til at lægge en ny log fra Ewido og Hijackthis (du ved vist efterhånden hvordan man gør *S*).

Hei.Og tusen takk for svar.
Her følger logger fra Hijackthis Ewido Og dr.web. Dr web finner viruset i minne på maskinen min fortsatt,hver gang jeg starter programmet.Det står likevel Cure og Trojan Vanquish.20 eradicated.Samtidig kan jeg ikke bruke Ewido til ikke scanne minne og bare står og spinner hvis jeg forsøker.
Loggene er gjort i Safe mode og da finner ingen programmer  hva og hvor filene gjemmer seg.
Men her følger log:




Logfile of HijackThis v1.99.1
Scan saved at 20:52:20, on 22.01.2006
Platform: Windows 2003 SP1 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 SP1 (6.00.3790.1830)

Running processes:
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Administrator\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
F2 - REG:system.ini: UserInit=userinit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files (x86)\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [DU Meter] "C:\Program Files (x86)\DU Meter\DUMeter.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [THGuard] "C:\Program Files (x86)\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [EA Core] C:\Program Files (x86)\Electronic Arts\EA Downloader\Core.exe -silent
O4 - Startup: MemTurbo.lnk = C:\Program Files (x86)\MemTurbo30\MemTurbo.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1137373287489
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1137835153812
O16 - DPF: {94EB57FE-2720-496C-B33F-D9353C6E23F7} (F-Secure Online Scanner 2.1) - http://support.f-secure.com/ols/fscax.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~2\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\SYSTEM32\dimsntfy.dll
O20 - Winlogon Notify: EFS - C:\WINDOWS\SYSTEM32\sclgntfy.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2saag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing)
O23 - Service: Event Log (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files (x86)\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files (x86)\ewido anti-malware\ewidoguard.exe
O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe (file missing)
O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe (file missing)
O23 - Service: Net Logon (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NT LM Security Support Provider (NtLmSsp) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: IPSEC Services (PolicyAgent) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Protected Storage (ProtectedStorage) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe (file missing)
O23 - Service: Security Accounts Manager (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files (x86)\Sygate\SPF\smc.exe
O23 - Service: Virtual Disk Service (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe (file missing)
O23 - Service: WMI Performance Adapter (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe (file missing)


-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 100822
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 1157 Kb/s
Scan time: 00:25:57
-----------------------------------------------------------------------------

=============================================================================
Total session statistics
=============================================================================
Objects scanned: 100902
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 1163 Kb/s
Scan time: 00:26:12
=============================================================================

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on:            20:51:49, 22.01.2006
+ Report-Checksum:        F90933A

+ Scan result:

    :mozilla.8:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Tribalfusion : Cleaned with backup
    :mozilla.17:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.18:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.60:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
    :mozilla.62:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Tradedoubler : Cleaned with backup
    :mozilla.63:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Doubleclick : Cleaned with backup
    :mozilla.69:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.70:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.71:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.72:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Advertising : Cleaned with backup
    :mozilla.76:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
    :mozilla.86:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
    :mozilla.87:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Com : Cleaned with backup
    :mozilla.91:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Atdmt : Cleaned with backup
    :mozilla.95:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.96:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.97:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.98:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.99:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.100:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.2o7 : Cleaned with backup
    :mozilla.127:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
    :mozilla.139:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Revenue : Cleaned with backup
    :mozilla.168:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.169:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.170:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.171:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.172:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.173:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.174:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.176:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.177:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.178:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.179:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    :mozilla.183:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Fastclick : Cleaned with backup
    :mozilla.185:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
    :mozilla.186:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
    :mozilla.187:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
    :mozilla.188:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
    :mozilla.189:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Casalemedia : Cleaned with backup
    :mozilla.190:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Burstnet : Cleaned with backup
    :mozilla.198:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.247realmedia : Cleaned with backup
    :mozilla.220:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Googleadservices : Cleaned with backup
    :mozilla.255:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Statcounter : Cleaned with backup
    :mozilla.263:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup
    :mozilla.264:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Onestat : Cleaned with backup
    C:\Documents and Settings\Administrator\Cookies\administrator@microsofteup.112.2o7[1].txt -> Spyware.Cookie.2o7 : Cleaned with backup


::Report End

Ewido finder en masse spyware-cookies, men det er ikke i sig selv alarmerende, idet man altid får disse ind, når man surfer på nettet.

Det undrer mig, at du siger at det er DrWeb, der finder infektionen, for loggen fra DrWeb er pinligt ren. Den siger, at der intet inficeret findes på computeren. Og den scanner plejer normalt at være mest effektiv fra fejlsikret tilstand.

Du skriver at du har lavet logsene fra fejlsikret tilstand. Prøv at lave nye logs for alle 3 programmer fra normal tilstand. Så må vi se, om infektionen kan ses derfra.

Ny hijackthis log. Denne gang i vanlig Modus.
etterfulgy av  Drweb log og Ewido som denne gang kun finner 3 stk denne gang. mot vanlig 46 som skjer etter en liten stund.
Virker veldig som et browser hijack attempt,


Logfile of HijackThis v1.99.1
Scan saved at 23:48:59, on 22.01.2006
Platform: Windows 2003 SP1 (WinNT 5.02.3790)
MSIE: Internet Explorer v6.00 SP1 (6.00.3790.1830)

Running processes:
C:\Program Files (x86)\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files (x86)\MemTurbo30\MemTurbo.exe
C:\Program Files (x86)\DAEMON Tools\daemon.exe
C:\Program Files (x86)\DU Meter\DUMeter.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files (x86)\TrojanHunter 4.2\THGuard.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files (x86)\ewido anti-malware\ewidoctrl.exe
C:\Program Files (x86)\ewido anti-malware\ewidoguard.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\cli.exe
C:\Documents and Settings\Administrator\Desktop\drweb-cureit.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX1\drw_start.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX1\drweb32w.exe
C:\Program Files (x86)\ewido anti-malware\SecuritySuite.exe
C:\Documents and Settings\Administrator\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
F2 - REG:system.ini: UserInit=userinit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files (x86)\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [DU Meter] "C:\Program Files (x86)\DU Meter\DUMeter.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [THGuard] "C:\Program Files (x86)\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [EA Core] C:\Program Files (x86)\Electronic Arts\EA Downloader\Core.exe -silent
O4 - Startup: MemTurbo.lnk = C:\Program Files (x86)\MemTurbo30\MemTurbo.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1137373287489
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1137835153812
O16 - DPF: {94EB57FE-2720-496C-B33F-D9353C6E23F7} (F-Secure Online Scanner 2.1) - http://support.f-secure.com/ols/fscax.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~2\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: dimsntfy - C:\WINDOWS\SYSTEM32\dimsntfy.dll
O20 - Winlogon Notify: EFS - C:\WINDOWS\SYSTEM32\sclgntfy.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe (file missing)
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2saag.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing)
O23 - Service: Event Log (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: ewido security suite control - ewido networks - C:\Program Files (x86)\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files (x86)\ewido anti-malware\ewidoguard.exe
O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe (file missing)
O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe (file missing)
O23 - Service: Net Logon (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: NT LM Security Support Provider (NtLmSsp) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)
O23 - Service: IPSEC Services (PolicyAgent) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Protected Storage (ProtectedStorage) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe (file missing)
O23 - Service: Security Accounts Manager (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files (x86)\Sygate\SPF\smc.exe
O23 - Service: Virtual Disk Service (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)
O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe (file missing)
O23 - Service: WMI Performance Adapter (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe (file missing)




-----------------------------------------------------------------------------
Scan statistics
-----------------------------------------------------------------------------
Objects scanned: 102346
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 0
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 853 Kb/s
Scan time: 00:36:00


-----------------------------------------------------------------------------
Fremdeles ikke noe synlig i log. Men det er der.
Her står det  i det programmet loader inn og gjennomgår minne. finner det Trojan Vanquish.20.  og Cure Eradicated.
Dette kommer hver gang jeg starter maskinen.
Jeg har søkt på internett om dette viruset men alt jeg finner er på russisk ( http://virusinfo.info/showthread.php?t=1235 )


Ewido:

---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on:            00:29:14, 23.01.2006
+ Report-Checksum:        9A9A4592

+ Scan result:

    :mozilla.16:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Mediaplex : Cleaned with backup
    :mozilla.17:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup
    :mozilla.18:C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\9dn1vv93.default\cookies.txt -> Spyware.Cookie.Adtech : Cleaned with backup


::Report End

HJT-loggen er ren. DrWeb loggen er ren. Ewido finder 3 spyware-cookies. Det er der intet mærkeligt i. Det har noget at gøre med hvilke internetsider du besøger. Jeg mener fx at man får de der Adtech-cookies når man besøger Experten.

Du siger at det er DrWeb, der kommer med meldingen. Men DrWeb skal jo slet ikke køre ved opstart (og det ser heller ikke ud til, at du har sat den til det). Kan du forklare det lidt nærmere? DrWeb har iøvrigt nogle gange lidt en tendens til at finde falske positiver. Kunne du evt. skrive ned, hvilken fil det er, DrWeb angiver som værende en trojan?

Vi kan også prøve et sidste check. Jeg er ikke sikker på om det følgende program kan køre på Win2003, men du kan jo prøve:

Hent Blacklight her http://www.f-secure.com/blacklight/try.shtml Scroll ned på siden, og klik "iaccept". På næste side kan du downloade Blacklight til skrivebordet. Dobbeltklik filen, og klik scan. Når den er færdig laver den en log på skrivebordet. Kopier loggen her ind, hvis Blacklight finder noget. Du skal ikke lade Blacklight fjerne noget endnu.

Hei igjen.
Jeg får ikke installert blacklight  grunnet xp64 bit edition desverre.Så finnes det et alternativ.?
Dr web. startes fra skrivebordet . Etter man har trykket på  exe filen går den igjennom en express scan. Under denne scan finner programmet Trojan Vanquish i memturbo.exe og noen ganger i Mozilla.
Minnet kan da gå veldig seint og være svært belastet. I outlook,kommer ikke kontkaktene fra msn opp i  vinduet der det pleier. Samt at inne der man velger hva account man skal laste ned mail fra ,er det plutselig mange rare kontoer som nå er slettet.
Dette var der umiddelbart etter at jeg innstalrerte på nytt

Memturbo og Mozilla er begge legale programmer. Når jeg bad dig prøve blacklight så var det for at teste for usynlige rootkits, men ved nærmere eftertanke, så er det nok rimelig usandsynligt, at nogen har lavet rootkits til Win2003 endnu.

Selve det at infektionen eksisterer lige efter at du har geninstalleret, overbeviser mig om, at det er falsk alarm (som Dr. Web er lidt berygtet for). De problemer du har med Outlook og MSN behøver ikke tyde på virus. MSN fungerer i det hele taget vist lidt ustabilt i øjeblikket. Og outlooks konti er naturligvis slettet når du lige har geninstalleret hele dit styresystem. Det norske ord "minnet" forstår jeg desværre ikke, så den linie kan jeg ikke kommentere på *S*

Jeg tror derfor ikke rigtig jeg kan hjælpe dig videre med dit problem. Hvis du stadig ikke er overbevist, og hvis du lige har geninstalleret din computer, så vil mit bedste råd til dig næsten være, at gøre det igen, men hvor du først sletter din HD med Killdisk. Så er der helt sikkert ikke noget tilbage mere, og enhver melding om infektion vil være falsk alarm (i hvert fald indtil du har været på nettet). Vejledning til killdisk finder du her:
http://spywarefri.dk/forum/topic.asp?TOPIC_ID=18283

Hei igjen og takk for svar.
Minnet er det norske ordet for memory.Jeg frykter det kan være et virus i minnet på maskinen i og med at jeg formaterte og gjeninnstallerte styresystemet.Dr web  er det eneste program som har funnet noe på maskinen og på hijackthis  logene er det jo files missing. Blandt annet en som gjør at dvd brenneren min er forsvunnet fra nero sin liste,slik at jeg ikke kan brenne dvd annet enn med Image recorder.Det er med andre ord mange små softwareproblemer som gjør dataen ustabil.hvordan jeg skal få fikset disse vet jeg ikke.Lurer i tillegg på om det er noen eller om du har søkt etter eller vet om noe info om Trojan Vanquish.20
Har en egen  hd til styresystem og alt lagret fysisk på andre disker. Det skal ikke være infisert.

Takker for point :-)

Virus kan ikke gemme sig i hukommelsen på længere sigt -- eftersom hukommelsen slettes hver gang du slukker for computeren. "Files missing" er en bug i HJT-programmet, og man kan ikke altid stole på det. Hvis du ved, at én af dem er korrekte, så er den rigtige løsning at geninstallere Nero. Men inden du gør det, kan du lige checke om ikke programmet faktisk ligger på det angivne sted på Harddisken.

Jeg har søgt på Trojan Vanguish.20 og kun fundet et par få russiske sider, hvor der også diskuteres Dr.Web.