Er NewDotNet farligt?

Følg procedure herfra ->
http://www.eksperten.dk/artikler/954
så skal jeg nok følge op ...

dr1, skal jeg fjerne det eller skal jeg ikke? - spybot har fjernet det, eller den kom frem og jeg trykkede "Afhjælp blabla"

- hov det er mig christianskou her. jeg har to brugere .. :)

sådan nu er jeg på den normale :)

FUCK JEG KOKSER! NU ER JEG PÅ DEN NORMALE !!!!!

DrWeb LOG:

mirc.exe;C:\Program Files\mIRC;Program.mIRC.617;Renamed.;
mirc.exe;C:\Program Files\mIRC\backup;Program.mIRC.617;Renamed.;
A0076865.dll;C:\System Volume Information\_restore{6909ED9B-FB93-4F49-A063-48C8E9A75D5F}\RP159;IRC.Flood;Deleted.;
A0096406.exe;C:\System Volume Information\_restore{6909ED9B-FB93-4F49-A063-48C8E9A75D5F}\RP215;Program.mIRC.617;Renamed.;
A0096407.exe;C:\System Volume Information\_restore{6909ED9B-FB93-4F49-A063-48C8E9A75D5F}\RP215;Program.mIRC.617;Renamed.;

(mirc er det jeg bruger til counter-strike, burde ikke give virus :S)

---------------------------------------------------------------------------------------------

SUPERAntiSpyware: Der kom ikke nogen LOG :s, men den her LOG er fra 28/11-2006:

SUPERAntiSpyware Scan Log
Generated 11/28/2006 at 09:44 PM

Application Version : 3.3.1020

Core Rules Database Version : 3137
Trace Rules Database Version: 1154

Scan type      : Complete Scan
Total Scan Time : 03:30:34

Memory items scanned      : 426
Memory threats detected  : 0
Registry items scanned    : 3868
Registry threats detected : 0
File items scanned        : 35100
File threats detected    : 3

Adware.Tracking Cookie
    C:\Documents and Settings\Christian.CHRILLE\Cookies\christian@track.adform[2].txt
    C:\Documents and Settings\Christian.CHRILLE\Cookies\christian@ilead.itrack[2].txt
    C:\Documents and Settings\Christian.CHRILLE\Cookies\christian@cgi-bin[1].txt
--------------------------------------------------------------------------------------

HJT:

Logfile of HijackThis v1.99.1
Scan saved at 20:42:49, on 03-12-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS.002\System32\smss.exe
C:\WINDOWS.002\system32\winlogon.exe
C:\WINDOWS.002\system32\services.exe
C:\WINDOWS.002\system32\lsass.exe
C:\WINDOWS.002\system32\svchost.exe
C:\WINDOWS.002\System32\svchost.exe
C:\Programmer\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS.002\system32\spoolsv.exe
C:\WINDOWS.002\ATKKBService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINDOWS.002\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS.002\system32\nvsvc32.exe
C:\WINDOWS.002\system32\svchost.exe
C:\WINDOWS.002\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS.002\vsnpstd3.exe
C:\Programmer\iTunes\iTunesHelper.exe
C:\Programmer\Messenger\msmsgs.exe
C:\programmer\valve\steam\steam.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\RALINK\RT2500 USB Wireless LAN Card\Installer\WINXP\RaConfig2500USB.exe
C:\Programmer\iPod\bin\iPodService.exe
C:\Programmer\SpywareGuard\sgmain.exe
C:\WINDOWS.002\system32\WgaTray.exe
C:\Programmer\SpywareGuard\sgbhp.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS.002\system32\wuauclt.exe
C:\Documents and Settings\Christian.CHRILLE\Skrivebord\hijackthis\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Programmer\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS.002\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS.002\vsnpstd3.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS.002\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS.002\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmer\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] "c:\programmer\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Adobe Gamma.lnk = ?
O4 - Startup: SpywareGuard.lnk = C:\Programmer\SpywareGuard\sgmain.exe
O4 - Global Startup: RaConfig2500USB.lnk = C:\Programmer\RALINK\RT2500 USB Wireless LAN Card\Installer\WINXP\RaConfig2500USB.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O15 - Trusted Zone: *.www.n.dk
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by118fd.bay118.hotmail.msn.com/resources/MsnPUpld.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS.002\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS.002\ATKKBService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS.002\system32\nvsvc32.exe
O23 - Service: StyleXPService - Unknown owner - C:\Programmer\TGTSoft\StyleXP\StyleXPService.exe

----------------------------------------------------------------------------------------

Håber du/i kunne bruge det :)

Det er IKKE tilladt at have flere bruger-navne samtidig på eksperten. Jeg synes du skal vælge hvilken du vil beholde ;)

Kommentar: chrp
03/12-2006 19:44:35 - hov det er mig christianskou her. jeg har to brugere .. :)

- jeg beholder den her :), du må gerne slette den anden :p

- men nva, er du ikke lige flink og se om du kan svare på mit spørgsmål :) ?

Prøv lige at geninstallere SpySweeper, genstart derefter og afinstaller det.

Der er ingen spor af Newdotnet i loggen.

Jeg har prøvet det SpySweeper, man kan ikke slette de filer den har fundet!!

Så har du ikke hentet den hos os.
Den her kan:
http://www.spywarefri.dk/downloads1/ssfsetup972_1874129086.exe

Hentet den fra et eller andet der starter med www.w og så kan jeg ikke huske mere webroot eller noget.

- hvad så nu, nu har jeg installeret det :-)?

Kør en fuld scan med det, helst i fejlsikret.
Lad det fjerne hvad det finder.

Ok, jeg scannede bare i normal, det den fandt kom i Quarentine, og så gik jeg ind der i "Quarentine" og trykkede "Delete selected items"

Har jeg så slettet dem helt hvis jeg har gjordt som jeg har skrevet deroppe ^

HJT LOG (hvis du skal bruge det):

Logfile of HijackThis v1.99.1
Scan saved at 18:42:45, on 04-12-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS.002\System32\smss.exe
C:\WINDOWS.002\system32\winlogon.exe
C:\WINDOWS.002\system32\services.exe
C:\WINDOWS.002\system32\lsass.exe
C:\WINDOWS.002\system32\svchost.exe
C:\WINDOWS.002\System32\svchost.exe
C:\Programmer\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS.002\system32\spoolsv.exe
C:\WINDOWS.002\ATKKBService.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS.002\system32\nvsvc32.exe
C:\WINDOWS.002\system32\svchost.exe
C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS.002\Explorer.EXE
C:\WINDOWS.002\system32\WgaTray.exe
C:\WINDOWS.002\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS.002\vsnpstd3.exe
C:\Programmer\iTunes\iTunesHelper.exe
C:\Programmer\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Programmer\Messenger\msmsgs.exe
C:\programmer\valve\steam\steam.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\RALINK\RT2500 USB Wireless LAN Card\Installer\WINXP\RaConfig2500USB.exe
C:\Programmer\SpywareGuard\sgmain.exe
C:\Programmer\iPod\bin\iPodService.exe
C:\Programmer\SpywareGuard\sgbhp.exe
C:\WINDOWS.002\system32\svchost.exe
C:\Programmer\Webroot\Spy Sweeper\SSU.EXE
C:\DOCUME~1\CHRIST~1.CHR\LOKALE~1\Temp\ir_ext_temp_10\AutoPlay\prgs\Ventrilo+ts2\Ventrilo 2.1.4.exe
c:\programmer\valve\steam\steamapps\christianskou\counter-strike\hl.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Documents and Settings\Christian.CHRILLE\Skrivebord\hijackthis\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Programmer\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AVG7_CC] "C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS.002\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS.002\vsnpstd3.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS.002\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS.002\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmer\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Programmer\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Steam] "c:\programmer\valve\steam\steam.exe" -silent
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: Adobe Gamma.lnk = ?
O4 - Startup: SpywareGuard.lnk = C:\Programmer\SpywareGuard\sgmain.exe
O4 - Global Startup: RaConfig2500USB.lnk = C:\Programmer\RALINK\RT2500 USB Wireless LAN Card\Installer\WINXP\RaConfig2500USB.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O15 - Trusted Zone: *.www.n.dk
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by118fd.bay118.hotmail.msn.com/resources/MsnPUpld.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS.002\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS.002\SYSTEM32\WRLogonNTF.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS.002\ATKKBService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS.002\system32\nvsvc32.exe
O23 - Service: StyleXPService - Unknown owner - C:\Programmer\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Programmer\Webroot\Spy Sweeper\SpySweeper.exe

Loggen er ren.

Du gjorde det helt korrekt med SpySweeper.

Ok :)

Tak for hjælpen :).

Velbekomme.*S*