Problemer med mulig vundo hijacker!!

(Jeg ser på den...)

Det er bare super

Sådan går det let når man leger med P2P programmer!!!
http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=40284

Der er også nogle (kendte!) "grimmerter" imellem...
Skal nok 'fixes' i et par omgange...

---------------------------------------

Afinstaller (hvis det er der?)
* BitTorrent
* WinAntiVirus Pro 2007
via
[Start][Indstilninger][Kontrolpanel][Tilføj/fjern programmer]

Genstart for at fuldføre afinstalationen...

---------------------------------------

Gennemfør hele proceduren herfra -> http://www.eksperten.dk/artikler/1123

hehe, det er nu ikke min computer, jeg er ude på et pædagogisk tilbud... så det er drengene der er igang...

jeps bittorrent skal jeg nok lige afinstallere, men det er lige præcis winanivirus pro 2007 der er problemet... Det er en slags spy eller mallware og kan ikke rigtigt afinstalleres.

Jeg ehar prøvet at søge efter om det er en Wundo med Wundo fix, men den finder ikke noget. mit spyware program finder et par tracking cookies, men ikke noget af betydning.

dog tror jeg problemet er dette... filen der heder Not-A-virus.hoax.win32.renos-hz

den popper op nogle gange i spyware killeren kan det være en trojan??

Kasper

"...Gennemfør hele proceduren herfra -> http://www.eksperten.dk/artikler/1123 ..." - så skal jeg nok følge op ...

Ang "winanivirus pro 2007" ->
http://www.spywarefri.dk/artikler.htm#WinFixer

nå så er jeg mødt på arbejdet og er vist kommet det hele igennem...

jeg poster lige mine logs, så kan du se om der er noget skidt på..

Kasper

Hijackthis:
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 11:39:50, on 15-09-2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Programmer\Java\jre1.5.0\bin\jusched.exe
C:\Programmer\Nokia\Nokia PC Suite 6\LaunchApplication.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Programmer\Java\jre1.5.0\bin\jucheck.exe
C:\Programmer\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Administrator\Skrivebord\Ny mappe\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmer\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Programmer\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0\bin\jusched.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programmer\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitTorrent] "C:\Programmer\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Programmer\WinZip\WZQKPICK.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Programmer\Yahoo!\Common\yinsthelper.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmer\PC Connectivity Solution\ServiceLayer.exe
O24 - Desktop Component 0: (no name) - http://www.ekkofilm.dk/__billeder__/nyheder/olsenbanden_200.jpg
O24 - Desktop Component 1: (no name) - http://www.biopix.dk/Temp/JCS%20Bos%20taurus%20(Limousine)%2024892.jpg

--
End of file - 5287 bytes


Rootlog:

********************************* ROOTCHK-(22-08-07)-LOG, by ejvindh
15-09-2007 11:40:22,45

The rootkits that are detected by this tool were not found.

********************************* ROOTCHK-LOG-end


catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-15 11:40:22
Windows 5.1.2600 Service Pack 2
scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

hidden processes: 0
hidden files: 0


Combofix:
ComboFix 07-09-14.2 - "Administrator" 2007-09-15 11:41:47.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1252.1.1030.18.149 [GMT 2:00]
.

(((((((((((((((((((((((((  Files Created from 2007-08-15 to 2007-09-15  )))))))))))))))))))))))))))))))
.

2007-09-15 09:32    51,200    --a------    C:\WINDOWS\NirCmd.exe
2007-09-15 09:28    <DIR>    d--------    C:\Programmer\SUPERAntiSpyware
2007-09-15 09:28    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-09-15 09:28    <DIR>    d--------    C:\DOCUME~1\ADMINI~1\APPLIC~1\SUPERAntiSpyware.com
2007-09-15 09:26    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
2007-09-15 09:24    <DIR>    d--------    C:\Programmer\Yahoo!
2007-09-15 09:24    <DIR>    d--------    C:\Programmer\CCleaner
2007-09-07 12:58    10,872    --a------    C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-09-07 12:30    <DIR>    d--------    C:\VundoFix Backups
2007-09-07 10:40    <DIR>    d--------    C:\Programmer\Lavasoft
2007-09-07 10:40    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-09-07 10:39    <DIR>    d--------    C:\Programmer\F‘lles filer\Wise Installation Wizard
2007-09-07 09:18    626,688    --a------    C:\WINDOWS\system32\msvcr80.dll
2007-09-04 13:33    <DIR>    d--------    C:\Programmer\Moon Valley Software
2007-08-28 15:48    <DIR>    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinZip
2007-08-16 16:01    303,616    --a------    C:\WINDOWS\IsUninst.exe
2007-08-16 16:01    <DIR>    d--------    C:\DOCUME~1\ADMINI~1\WINDOWS
2007-08-16 15:39    8,704    --a------    C:\WINDOWS\system32\SpOrder.dll
2007-08-16 15:39    24,064    --a------    C:\WINDOWS\system32\msxml3a.dll

.
((((((((((((((((((((((((((((((((((((((((  Find3M Report  ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-15 11:09    ---------    d--------    C:\Programmer\BitTorrent
2007-09-06 15:37    ---------    d--------    C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite
2007-09-05 19:50    ---------    d--------    C:\Programmer\World of Warcraft
2007-09-05 19:06    ---------    d--------    C:\Programmer\BitLord
2007-09-03 10:30    ---------    d--------    C:\DOCUME~1\ADMINI~1\APPLIC~1\BitTorrent
2007-08-14 18:36    ---------    d--------    C:\Programmer\Massive Assault Network 2
2007-08-09 08:52    ---------    d--------    C:\Programmer\Yahoo! Games
2007-08-09 08:52    ---------    d--------    C:\Programmer\TryMedia
2007-08-07 13:58    8320    --a------    C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-07 13:56    9344    --a------    C:\WINDOWS\system32\drivers\NSDriver.sys
2007-07-30 19:19    92504    --a------    C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19    549720    --a------    C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19    53080    --a------    C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19    43352    --a------    C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19    325976    --a------    C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19    203096    --a------    C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19    1712984    --a------    C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18    33624    --a------    C:\WINDOWS\system32\wups.dll
2007-07-28 10:22    ---------    d--------    C:\Programmer\MSN Messenger
2007-07-24 19:12    ---------    d--------    C:\Programmer\GameShadow
2007-07-24 18:40    98304    --a------    C:\WINDOWS\system32CmdLineExt.dll
2007-07-24 18:35    ---------    d--------    C:\Programmer\Eidos
2007-07-24 17:08    ---------    d--------    C:\Programmer\JoWooD
2007-06-26 08:10    1104896    --a------    C:\WINDOWS\system32\msxml3.dll
2007-06-19 15:32    282112    --a------    C:\WINDOWS\system32\gdi32.dll
    ---------        C:\Programmer\Fælles filer\Wise Installation Wizard
    ---------        C:\Programmer\Fælles filer\Blizzard Entertainment
    ---------        C:\Programmer\Fælles filer
.

(((((((((((((((((((((((((((((((((((((  Reg Loading Points  ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Programmer\Analog Devices\Core\smax4pnp.exe" [2004-10-14 14:42]
"igfxtray"="C:\WINDOWS\System32\igfxtray.exe" [2005-09-20 10:35]
"igfxhkcmd"="C:\WINDOWS\System32\hkcmd.exe" [2005-09-20 10:32]
"igfxpers"="C:\WINDOWS\System32\igfxpers.exe" [2005-09-20 10:36]
"SunJavaUpdateSched"="C:\Programmer\Java\jre1.5.0\bin\jusched.exe" [2007-05-30 18:51]
"PCSuiteTrayApplication"="C:\Programmer\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-03-23 13:20]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-09-13 16:32]
"!AVG Anti-Spyware"="C:\Programmer\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-27 02:53]
"MsnMsgr"="C:\Programmer\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55]
"BitTorrent"="C:\Programmer\BitTorrent\bittorrent.exe" []
"SUPERAntiSpyware"="C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-09-15 09:44]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Nokia.PCSync"=C:\Programmer\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

C:\DOCUME~1\ALLUSE~1\MENUEN~1\PROGRA~1\Start\
WinZip Quick Pick.lnk - C:\Programmer\WinZip\WZQKPICK.EXE [2007-08-03 11:10:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Programmer\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Programmer\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Programmer\SUPERAntiSpyware\SASWINLO.dll


.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-15 11:42:59
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\aawservice]
"ImagePath"="\"C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe\""
.
Completion time: 2007-09-15 11:43:35
C:\ComboFix-quarantined-files.txt ... 2007-09-15 11:43
C:\ComboFix2.txt ... 2007-09-15 09:42
.
    --- E O F ---

Superanitispyware!!

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/15/2007 at 11:33 AM

Application Version : 3.9.1008

Core Rules Database Version : 3307
Trace Rules Database Version: 1313

Scan type      : Complete Scan
Total Scan Time : 00:21:33

Memory items scanned      : 395
Memory threats detected  : 0
Registry items scanned    : 3854
Registry threats detected : 0
File items scanned        : 25740
File threats detected    : 0

Da jeg selv lige kiggede nogle af logs igennem fandt jeg at der var nogle folders som skulle væk, så som bitlord og bittorent og et par andre stykkker, så deres tomme folders er slettet...

så nu er der forhåbentllig ikke så meget mere tilbage, men ville være dejligt lige at være helt sikker...

kan være lidt svært at finde ud af hvad drengene installerer altid.

... det lyder jo ganske fornuftigt !!!


Registreringsdatabase oprydning kan anbefales ->
RegCleaner http://www.ccleaner.com/ + http://www.spywarefri.dk/manualer/ccleaner-manual.htm (Specielt punktet [Problemer]...)
Under installationen får du tilbudt [Yahoo Toolbar]. Du kan sige ja eller NEJ til den.