Hijack log

Hmm, den er da godt nok snavset!

Download http://siri.urz.free.fr/Fix/SmitfraudFix.exe (by S!Ri)
Til skrivebordet

Genstart i fejlsikret tilstand, hvis du ikke ved hvordan så kig her:
http://www.ctrlaltdel.dk/forum/forum_posts.asp?TID=23&PN=1


Dobbeltklik på Smitfraud exe. Lad programmet gennemføre en rensning. Det vil også checke om systemfilen wininet.dll er inficeret. Hvis den er det, vil du blive bedt om tilladelse til at erstatte den med en anden. Her skal du vælge "Yes", ved at taste "y".

Programmet bliver muligvis nødt til at genstarte undervejs. Herefter vil der dukke en liste med resultaterne af rensningen op . Kopiér denne liste herind, sammen med en ny log fra HijackThis.

den kommer her

Logfile of HijackThis v1.99.1
Scan saved at 16:54:48, on 04-02-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Programmer\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Programmer\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmer\ewido\security suite\ewidoguard.exe
C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
C:\Programmer\Java\jre1.5.0_10\bin\jusched.exe
C:\Programmer\SPAMfighter\SFAgent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\Programmer\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmer\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programmer\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\msiexec.exe
C:\Programmer\Outlook Express\msimn.exe
C:\Documents and Settings\Hanne\Skrivebord\hijack\alternativ.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: (no name) - {6FF7F330-3954-4D32-D138-17F3AB5DAA77} - LOPTCON.dll (file missing)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmer\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [HP Software Update] C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] \"C:\Programmer\Java\jre1.5.0_10\bin\jusched.exe\"
O4 - HKLM\..\Run: [dmbvo.exe] C:\WINDOWS\system32\dmbvo.exe
O4 - HKLM\..\Run: [SPAMfighter Agent] \"C:\Programmer\SPAMfighter\SFAgent.exe\" update delay 60
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] \"C:\Programmer\MSN Messenger\MsnMsgr.Exe\" /background
O4 - HKCU\..\Run: [desktop] C:\WINDOWS\system32\idemlog.exe
O4 - HKCU\..\Run: [Uint32] Kargo.exe
O4 - HKCU\..\Run: [backd] Testimonials.exe
O4 - HKCU\..\Run: [SAPSTR] ___.exe
O4 - HKCU\..\Run: [updateMgr] \"C:\Programmer\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe\" AcRdB7_0_8 -reboot 1
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {FFFFFFFF-CAFE-BABE-BABE-10AA0055595A} - http://www.truesuite.com/truewallet/TrueWalletInstall.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{3D7CE8B1-35FD-4471-94B0-D464F78DAA53}: NameServer = 85.255.115.69,85.255.112.128
O17 - HKLM\System\CCS\Services\Tcpip\..\{4DBC7DE3-AD87-4B8B-8B3C-CA1885FFA2A4}: NameServer = 85.255.115.69,85.255.112.128
O17 - HKLM\System\CCS\Services\Tcpip\..\{C063DD8B-B23B-485C-A526-45DA628CB300}: NameServer = 85.255.115.69,85.255.112.128
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.69 85.255.112.128
O17 - HKLM\System\CS1\Services\Tcpip\..\{3D7CE8B1-35FD-4471-94B0-D464F78DAA53}: NameServer = 85.255.115.69,85.255.112.128
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.69 85.255.112.128
O17 - HKLM\System\CS2\Services\Tcpip\..\{3D7CE8B1-35FD-4471-94B0-D464F78DAA53}: NameServer = 85.255.115.69,85.255.112.128
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.69 85.255.112.128
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programmer\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programmer\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Programmer\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programmer\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe




SmitFraudFix v2.138

Scan done at 16:39:00,20, 04-02-2007
Run from C:\Documents and Settings\Hanne\Skrivebord\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
\"System\"=\"\"


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

Under dette fix vil computeren blive genstartet, og du bør derfor printe vejledningen ud, for at have den ved din side under hele fixet. Fixet skal bruge adgang til internettet, så det skal du sikre dig, at der er.

-- Hent FixWareout fra et af disse links:
http://downloads.subratam.org/Fixwareout.exe
http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe

-- Gem filen på dit Skrivebord og dobbeltklik på den. Klik Next -> Install og check, at der er et flueben i "Run fixit" - klik herefter på Finish. Fixet vil nu starte, og du skal blot følge instruktionerne. Du vil blive bedt om at genstarte din computer - gør venligst det. Genstarten vil tage lidt længere tid end normalt...

-- Når dit system genstarter skal du fortsat følge den vejledning, der gives på skærmen. Når fixet er færdigt vil der åbnes en log (report.txt), som du skal gemme og lægge herind i næste post.

-- Kør herefter HijackThis - klik på "Do a systemscan only", og sæt et flueben ud for følgende linier - luk øvrige programvinduer - klik "Fix checked":

O17 - HKLM\System\CCS\Services\Tcpip\..\{3D7CE8B1-35FD-4471-94B0-D464F78DAA53}: NameServer = 85.255.115.69,85.255.112.128
O17 - HKLM\System\CCS\Services\Tcpip\..\{4DBC7DE3-AD87-4B8B-8B3C-CA1885FFA2A4}: NameServer = 85.255.115.69,85.255.112.128
O17 - HKLM\System\CCS\Services\Tcpip\..\{C063DD8B-B23B-485C-A526-45DA628CB300}: NameServer = 85.255.115.69,85.255.112.128
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.69 85.255.112.128
O17 - HKLM\System\CS1\Services\Tcpip\..\{3D7CE8B1-35FD-4471-94B0-D464F78DAA53}: NameServer = 85.255.115.69,85.255.112.128
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.69 85.255.112.128
O17 - HKLM\System\CS2\Services\Tcpip\..\{3D7CE8B1-35FD-4471-94B0-D464F78DAA53}: NameServer = 85.255.115.69,85.255.112.128
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.69 85.255.112.128


-- Luk HJT. Genstart din computer, og kopier indholdet af C:\fixwareout\report.txt herind sammen med en frisk HijackThis log.

Logfile of HijackThis v1.99.1
Scan saved at 16:59:06, on 05-02-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Programmer\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Programmer\ewido\security suite\ewidoctrl.exe
C:\Programmer\ewido\security suite\ewidoguard.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
C:\Programmer\Java\jre1.5.0_10\bin\jusched.exe
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\Programmer\SPAMfighter\SFAgent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Norton AntiVirus\SAVScan.exe
C:\WINDOWS\system32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programmer\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe
C:\Programmer\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Hanne\Skrivebord\hijack\alternativ.exe
C:\Programmer\Symantec\LiveUpdate\AUpdate.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Programmer\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Programmer\Symantec\LiveUpdate\LuCallbackProxy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: (no name) - {6FF7F330-3954-4D32-D138-17F3AB5DAA77} - LOPTCON.dll (file missing)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmer\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [HP Software Update] C:\Programmer\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] \"C:\Programmer\Java\jre1.5.0_10\bin\jusched.exe\"
O4 - HKLM\..\Run: [SPAMfighter Agent] \"C:\Programmer\SPAMfighter\SFAgent.exe\" update delay 60
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] \"C:\Programmer\MSN Messenger\MsnMsgr.Exe\" /background
O4 - HKCU\..\Run: [Uint32] Kargo.exe
O4 - HKCU\..\Run: [backd] Testimonials.exe
O4 - HKCU\..\Run: [SAPSTR] ___.exe
O4 - HKCU\..\Run: [updateMgr] \"C:\Programmer\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe\" AcRdB7_0_8 -reboot 1
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmer\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Programmer\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {FFFFFFFF-CAFE-BABE-BABE-10AA0055595A} - http://www.truesuite.com/truewallet/TrueWalletInstall.exe
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programmer\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Programmer\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Programmer\Norton AntiVirus\navapsvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programmer\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe

Fixwareout
Last edited 1/30/2007
Post this report in the forums please
...
Prerun check
»»»»» HKLM run and Winlogon System values
C:\WINDOWS\System32\dmbvo.exe will be moved to C:\WINDOWS\temp\dmbvo.ren at reboot.

»»»»» System restarted
Reg Entries that were deleted
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins \"xedocne\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins \"repiwoh\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins \"23plhps\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins \"mgcppp\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins \"tesvaf\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins \"golmedi\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins \"32refaselif\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins \"ecxmd\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins \"}891C0161C001-F618-28B4-0CA1-725FEE1F{\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins \"}DEA37D678248-FCFA-11A4-4E13-4854F59E{\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ruins \"ovbmd\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls \"xedocne\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls \"gib_ogol\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls \"repiwoh\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls \"llun\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls \"23plhps\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls \"mgcppp\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls \"tesvaf\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls \"golmedi\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls \"32refaselif\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls \"putesprpgd\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls \"1trap\"
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Urls \"2trap\"
...
Random Runs removed from HKLM
\"dmbvo.exe\"=-
...
\"C:\Documents and Settings\All Users\Foretrukne\Download Free Spyware Remover.url\" Deleted
\"C:\Documents and Settings\All Users\Foretrukne\NEW VIAGRA at Half Price!.url\" Deleted
\"C:\Documents and Settings\All Users\Foretrukne\Online Chat With Nude Girls.url\" Deleted
\"C:\Documents and Settings\All Users\Foretrukne\PC protection in under 2 minutes!.url\" Deleted
\"C:\Documents and Settings\All Users\Foretrukne\Stop PopUps On Your Computer.url\" Deleted
C:\WINDOWS\RDT.INI Deleted
C:\WINDOWS\System32\close.bmp Deleted
C:\WINDOWS\System32\dating.bmp Deleted
C:\WINDOWS\System32\drivers\zpmodemnt.sys Deleted
C:\WINDOWS\System32\gambling.bmp Deleted
C:\WINDOWS\System32\idesk.conf Deleted
C:\WINDOWS\System32\insurance.bmp Deleted
C:\WINDOWS\System32\pharmacy.bmp Deleted
C:\WINDOWS\System32\spyware.bmp Deleted
C:\WINDOWS\System32\xxx.bmp Deleted
C:\Documents and Settings\All Users\Foretrukne\Spyware Uninstall Deleted

»»»»» Misc files.

»»»»» Checking for older varients.

»»»»» Postrun check
»»»»» HKLM run
»»»»» Winlogon System value
\"System\"=\"\"
»»»»»

PLEASE NOTE, There CAN be LEGITIMATE FILES LISTED IN THIS SECTION.

This WILL/CAN also list Legit Files, Submit them at Virustotal
Search five digit cs, dm kd and jb files.
»»»»»
»»»»» Current runs

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
\"BluetoothAuthenticationAgent\"=\"rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent\"
\"HP Software Update\"=\"C:\\Programmer\\HP\\HP Software Update\\HPWuSchd2.exe\"
\"SunJavaUpdateSched\"=\"\\"C:\\Programmer\\Java\\jre1.5.0_10\\bin\\jusched.exe\\"\"
\"SPAMfighter Agent\"=\"\\"C:\\Programmer\\SPAMfighter\\SFAgent.exe\\" update delay 60\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
\"Installed\"=\"1\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
\"Installed\"=\"1\"
\"NoChange\"=\"1\"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
\"Installed\"=\"1\"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
\"CTFMON.EXE\"=\"C:\\WINDOWS\\system32\\ctfmon.exe\"
\"MsnMsgr\"=\"\\"C:\\Programmer\\MSN Messenger\\MsnMsgr.Exe\\" /background\"
\"Uint32\"=\"Kargo.exe\"
\"backd\"=\"Testimonials.exe\"
\"SAPSTR\"=\"___.exe\"
\"updateMgr\"=\"\\"C:\\Programmer\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\\" AcRdB7_0_8 -reboot 1\"

Hosts file was reset, If you use a custom hosts file please replace it

Slet disse med hijackthis

R3 - URLSearchHook: (no name) - {6FF7F330-3954-4D32-D138-17F3AB5DAA77} - LOPTCON.dll (file missing)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Programmer\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll (file missing)
O4 - HKCU\..\Run: [Uint32] Kargo.exe
O4 - HKCU\..\Run: [backd] Testimonials.exe
O4 - HKCU\..\Run: [SAPSTR] ___.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

Denne her er jeg i tvivl om, hvis du selv kender den så lad den være ellers synes jeg du skal fixe den også.
O16 - DPF: {FFFFFFFF-CAFE-BABE-BABE-10AA0055595A} - http://www.truesuite.com/truewallet/TrueWalletInstall.exe

Kom med en ny log fra hijackthis.

lukker igen

tak for hjælpen kommer du med et svar?

Jeps .-)