Trojan og andet "godt"

Følg denne til punkt og prikke:
http://www.eksperten.dk/artikler/1021

Der er lige kommet en ny artikel om dette MSN Virus 'problem' ->
http://www.eksperten.dk/artikler/1021

(Så tar' vi den derfra ...)

Hovsa <john_stigers> du kom 'først' ...

Tak tak ... er i fuld gang... *S*

ER lidt i tvivl ... Skal jeg afinstallere Messenger inden jeg går i gang?

Jep

P.s. jeg er ved at de om jeg kan få fat i en der kan fjerne skidtet - dr1 hvis du har mod på det må du gerne overtage - jeg linkede kun til artikel og ville så finde en der kunne hjælpe færdigt :)

jeg er ved at de om = jeg er ved at se om

OK - tak for det... !

Jeg er koblet på, hvis Dr1 ikke tager den.*S*

Godt :)

Takker. Min computer gik lige ned under dr. Web scanning (den mente at den havde brug for støm ... ), så jeg er lige startet forfra med den.

OK, jeg håber at nå det i morgen tidlig, ellers er jeg ikke online før mandag igen, årsagen findes her:
http://www.spywarefri.dk/live2006.htm

Hej Igen...

Ser er mine logs klar:

SUPERAntiSpyware Scan Log
Generated 09/21/2006 at 10:43 PM

Core Rules Database Version : 3089
Trace Rules Database Version: 1118

Memory threats detected  : 0
Registry threats detected : 9
File threats detected    : 58
A
Adware.Tracking Cookie
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@atdmt[2].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@tracker.netklix[2].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@1071527028[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@bs.serving-sys[3].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@kanoodle[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@xiti[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@indextools[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@microsofteup.112.2o7[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@adserver.banneradministration[3].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@doubleclick[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@ads2.jubii[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@ads.as4x.tmcs[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@as1.falkag[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@tripod.jubii[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@ehg-nokiafin.hitbox[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@e2.emediate[2].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@adfair[3].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@stat.postdanmark[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@a[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@cgi-bin[4].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@cgi-bin[3].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@cgi-bin[5].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@ad1.emediate[2].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@ilead.itrack[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@statse.webtrendslive[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@112.2o7[2].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@track.adform[3].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@advertising[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@mediaplex[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@adtech[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@ads.arto[2].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@tradedoubler[2].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@statcounter[2].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@cgi-bin[2].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@sel.as-eu.falkag[2].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@ads.tripod.jubii[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@ad.ofir[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@www.webstat[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@bs.serving-sys[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@ads.arto[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@adfair[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@track.adform[2].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@adserver.banneradministration[2].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@indextools[2].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@ilead.itrack[2].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@ad1.emediate[1].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@m1.webstats4u[2].txt
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@track.adform[1].txt

Trojan.Unknown Origin
    HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{42F2C9BA-614F-47C0-B3E3-ECFD34EED658}
    HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{42F2C9BA-614F-47C0-B3E3-ECFD34EED658}#SystemComponent
    HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{42F2C9BA-614F-47C0-B3E3-ECFD34EED658}#Installer
    HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{42F2C9BA-614F-47C0-B3E3-ECFD34EED658}\Contains
    HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{42F2C9BA-614F-47C0-B3E3-ECFD34EED658}\DownloadInformation
    HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{42F2C9BA-614F-47C0-B3E3-ECFD34EED658}\DownloadInformation#CODEBASE
    HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{42F2C9BA-614F-47C0-B3E3-ECFD34EED658}\InstalledVersion
    HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{42F2C9BA-614F-47C0-B3E3-ECFD34EED658}\InstalledVersion#LastModified

Adware.Toolbar888
    C:\Programmer\Toolbar888\MyToolBa0.#ll
    C:\Programmer\Toolbar888\Uninst.exe
    C:\Programmer\Toolbar888
    HKU\S-1-5-21-27904631-2115134052-1860790179-1005\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CBCC61FA-0221-4CCC-B409-CEE865CACA3A}

Trojan.DollarRevenue
    C:\WINDOWS\Downloaded Program Files\313133352D2D2D.exe
    C:\WINDOWS\Prefetch\313133352D2D2D.EXE-0D157269.pf

Trojan.Freeprod
    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\WHY7G1IN\alfa[1].exe
    C:\Documents and Settings\Camilla Nordam\Skrivebord\alfa.exe
    C:\System Volume Information\_restore{00221F91-FF7C-4E3C-9A37-AB42F59E833C}\RP155\A0014200.exe
    C:\WINDOWS\Prefetch\ALFA.EXE-12E8DDA5.pf

Adware.Director
    C:\System Volume Information\_restore{00221F91-FF7C-4E3C-9A37-AB42F59E833C}\RP155\A0014229.exe


OG fra Dr. Web:


Xinstall.exe    C:\Documents and Settings\Camilla Nordam\Skrivebord    Probably DLOADER.Trojan   
speedtest2[1].#ll    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\OZ0TE3CJ    Adware.Matcash    Renamed.
CAK6GBN9.#xe    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\07KRABCJ    Adware.DollarRevenue    Renamed.
drsmartload1135a[1].#xe    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\05QZGLEJ    Adware.DollarRevenue    Renamed.
drsmartload1135a[1].#xe    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\OX4JK30J    Adware.DollarRevenue    Renamed.
drsmartload1135a[1].#xe    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\RKGCHLBQ    Adware.DollarRevenue    Renamed.
CAPWSNH1.#ll    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\AXHEZQ1S    Adware.Matcash    Renamed.
speedtest2[1].#ll    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\AXHEZQ1S    Adware.Matcash    Renamed.
speedtest2[1].#ll    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\1V37DX0E    Adware.Matcash    Renamed.
drsmartload1135a[1].#xe    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\1V37DX0E    Adware.DollarRevenue    Renamed.
drsmartload1135a[1].#xe    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\KVLJMQ7T    Adware.DollarRevenue    Renamed.
MyToolBar.#ll    C:\Programmer\ToolBar888    Adware.FastSearch    Renamed.
A0014209.#xe    C:\System Volume Information\_restore{00221F91-FF7C-4E3C-9A37-AB42F59E833C}\RP155    Adware.DollarRevenue    Renamed.


Og den sidste:

---------------------------------------------------------
ewido anti-malware - Scanningsrapport
---------------------------------------------------------

+ Oprettet den:            23:27:37, 21-09-2006
+ Rapport-Checksum:        55AE1120

+ Scanningsresultat:
    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\CHP77LFW\313133352D2D2D[1].exe -> Downloader.Adload.aj : Renset med backup
    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\OZ0TE3CJ\speedtest2[10.#ll -> Not-A-Virus.Downloader.Win32.InsTool.a : Renset med backup
    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\07KRABCJ\CAK6GBN0.#xe -> Downloader.Adload.fo : Renset med backup
    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\05QZGLEJ\drsmartload_js[1].htm -> Downloader.IstBar.j : Renset med backup
    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\05QZGLEJ\drsmartload1135a[10.#xe -> Downloader.Adload.fo : Renset med backup
    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\OX4JK30J\drsmartload1135a[10.#xe -> Downloader.Adload.fo : Renset med backup
    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\RKGCHLBQ\drsmartload1135a[10.#xe -> Downloader.Adload.fo : Renset med backup
    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\AXHEZQ1S\CAPWSNH0.#ll -> Not-A-Virus.Downloader.Win32.InsTool.a : Renset med backup
    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\AXHEZQ1S\speedtest2[10.#ll -> Not-A-Virus.Downloader.Win32.InsTool.a : Renset med backup
    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\1V37DX0E\speedtest2[10.#ll -> Not-A-Virus.Downloader.Win32.InsTool.a : Renset med backup
    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\1V37DX0E\drsmartload1135a[10.#xe -> Downloader.Adload.fo : Renset med backup
    C:\Documents and Settings\Camilla Nordam\Lokale indstillinger\Temporary Internet Files\Content.IE5\KVLJMQ7T\drsmartload1135a[10.#xe -> Downloader.Adload.fo : Renset med backup
    C:\Documents and Settings\Camilla Nordam\Skrivebord\Xinstall.exe -> Heuristic.Win32.Morphine-Crypted : Renset med backup
    C:\Documents and Settings\Camilla Nordam\Cookies\camilla nordam@ivwbox[1].txt -> TrackingCookie.Ivwbox : Renset med backup
    C:\System Volume Information\_restore{00221F91-FF7C-4E3C-9A37-AB42F59E833C}\RP155\A0014200.#xe -> Downloader.Adload.fo : Renset med backup
    C:\System Volume Information\_restore{00221F91-FF7C-4E3C-9A37-AB42F59E833C}\RP155\A0014230.exe -> Heuristic.Win32.Morphine-Crypted : Renset med backup
    C:\System Volume Information\_restore{00221F91-FF7C-4E3C-9A37-AB42F59E833C}\RP159\A0015280.#ll -> Adware.Softomate : Renset med backup


::Rapport slut


Her er så for Hijack this:

Logfile of HijackThis v1.99.1
Scan saved at 23:40:54, on 21-09-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\Programmer\BullGuard Software\BullGuard\BullGuardUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\ewido\security suite\ewidoctrl.exe
C:\Programmer\ewido\security suite\ewidoguard.exe
C:\WINDOWS\system32\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\1XConfig.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Programmer\ASUS\ASUS Live Update\ALU.exe
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\Programmer\ASUS\Power4 Gear\BatteryLife.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Programmer\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\BullGuard Software\BullGuard\bullguard.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\Fælles filer\Ahead\Lib\NMBgMonitor.exe
C:\Programmer\ASUS\Asus ChkMail\ChkMail.exe
C:\Programmer\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Camilla Nordam\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [ASUS Live Update] C:\Programmer\ASUS\ASUS Live Update\ALU.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Programmer\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [ZCfgSvc.exe] c:\WINDOWS\system32\ZCfgSvc.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] c:\Programmer\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmer\Fælles filer\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [explorer] C:\Documents and Settings\Camilla Nordam\Skrivebord\Xinstall.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BullGuard] "C:\Programmer\BullGuard Software\BullGuard\bullguard.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmer\Fælles filer\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: ASUS ChkMail.lnk = C:\Programmer\ASUS\Asus ChkMail\ChkMail.exe
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: Sebring - c:\WINDOWS\system32\LgNotify.dll
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: BullGuard LiveUpdate (BGLiveSvc) - BullGuard Software - C:\Programmer\BullGuard Software\BullGuard\BullGuardUpdate.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: NBService - Nero AG - C:\Programmer\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\WINDOWS\system32\S24EvMon.exe

Scannerne har taget det meste, og Bullguard har åbenbart holdt infektionen nede, så der er ikke meget at komme efter.

Kør Hijackthis, scan, sæt flueben ved linierne listet her, luk alle vinduer undtaget Hijackthis, klik på fix checked, genstart i fejlsikret (tryk på <F8> under opstarten), slet mapper og filer listet længere nede.

O4 - HKLM\..\Run: [explorer] C:\Documents and Settings\Camilla Nordam\Skrivebord\Xinstall.exe

---------------------------------------
Sletning af \mapper\ og filer:
Åbn Stifinder, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".
Brug af Start->Søg.
Klik på "Skift søgefunktioner for filer og mapper"
Sæt prik i "Avanceret" og klik OK.
Klik på "Alle filer og mapper"
Klik på "Flere avancerede indstillinger"
Sæt flueben i de tre øverste.
-------------------
Mapper:
Ingen

-------------------
Filer:
C:\Documents and Settings\Camilla Nordam\Skrivebord\Xinstall.exe

---------------------------------------
Genstart normalt og kom med en frisk Hijackthislog.

På forhånd undskyld at jeg bryder ind med noget helt andet.
Fromsej -> har du mulighed for at hjælpe her: http://www.eksperten.dk/spm/734038

Jeg har været der nu.*S*

<camilla_n>: Vender du pænt tilbage ?

Har været på ferie ... beklager ...

Hej igen,


Håber at du vil kigge lidt på denne, selvom der gik lidt lang tid:

Logfile of HijackThis v1.99.1
Scan saved at 21:14:56, on 12-10-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ATKKBService.exe
C:\Programmer\BullGuard Software\BullGuard\BullGuardUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\Programmer\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\RegSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\1XConfig.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Programmer\ASUS\ASUS Live Update\ALU.exe
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\Programmer\ASUS\Power4 Gear\BatteryLife.exe
C:\Programmer\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\BullGuard Software\BullGuard\bullguard.exe
C:\Programmer\Fælles filer\Ahead\Lib\NMBgMonitor.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\ASUS\Asus ChkMail\ChkMail.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Programmer\WIDCOMM\Bluetooth Software\BTTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Camilla Nordam\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.asus.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [ASUS Live Update] C:\Programmer\ASUS\ASUS Live Update\ALU.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Power_Gear] C:\Programmer\ASUS\Power4 Gear\BatteryLife.exe 1
O4 - HKLM\..\Run: [ZCfgSvc.exe] c:\WINDOWS\system32\ZCfgSvc.exe
O4 - HKLM\..\Run: [PRONoMgr.exe] c:\Programmer\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programmer\Fælles filer\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BullGuard] "C:\Programmer\BullGuard Software\BullGuard\bullguard.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programmer\Fælles filer\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: ASUS ChkMail.lnk = C:\Programmer\ASUS\Asus ChkMail\ChkMail.exe
O4 - Global Startup: Adobe Reader Hurtigstart.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: Sebring - c:\WINDOWS\system32\LgNotify.dll
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: BullGuard LiveUpdate (BGLiveSvc) - BullGuard Software - C:\Programmer\BullGuard Software\BullGuard\BullGuardUpdate.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: NBService - Nero AG - C:\Programmer\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation  - C:\WINDOWS\system32\S24EvMon.exe

Undskyld 'forsinkelsen' ...

Det ser lovende ud...

<Fromsej> ka' lige bekræfte for en go' ordens skyld ...

Ja, den er da fuldstændig smuttet for mig.

Så er din log ren, vi behøver ikke at se flere.
Du bør lige deaktivere systemgendannelse, genstarte og genaktivere samt sætte filvisning til normal.
http://spywarefri.dk/virusscannere.htm#alle - Systemgendannelse.
Åbn en mappe, klik på Funktioner >Mappeindstillinger >Vis.
Sæt flueben ved "Skjul beskyttede operativsystemfiler".
Sæt flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis ikke skjulte filer og mapper".

For at holde den ren kan du kigge på vores pakke til formålet.
http://www.spywarefri.dk/manualer/sikkerhedspakke.htm
Som minimum anbefaler jeg Spywareguard, Spywareblaster, IE-Spyad og IE Privacy Keeper.
Et par artikler om sikker surfing finder du her:
http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=14414
http://fromsej.dk/html/avoid.html
Mvh:
Fromsej/Team Spywarefri.