netfanden Nybegynder

02. august 2008 - 01:38 Der er 10 kommentarer

Spøgelser Log filer ønskes tjekket

Hej forleden døde min pc. og jeg fik beskeden virus alert ved siden af mit ur. jeg har fulgt en anvisning jeg fandt her og nu er det væk igen men tror stadig der er noget der spøger....
Her er mine logfiler PLZ tjek disse.....AVG siger at alt skulle være ok.....

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 07/30/2008 at 05:07 AM

Application Version : 4.0.1154

Core Rules Database Version : 3521
Trace Rules Database Version: 1511

Scan type : Complete Scan
Total Scan Time : 00:18:20

Memory items scanned : 427
Memory threats detected : 0
Registry items scanned : 3619
Registry threats detected : 0
File items scanned : 11656
File threats detected : 11

Adware.Tracking Cookie
C:\Documents and Settings\NetFanden\Cookies\netfanden@adtech[1].txt

Trojan.Net-MSV/VPS-Variant
C:\SYSTEM VOLUME INFORMATION\_RESTORE{702D6687-DF40-4E74-9979-AE0D929952C4}\RP57\A0020520.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{702D6687-DF40-4E74-9979-AE0D929952C4}\RP57\A0020521.DLL

Trojan.Dropper/Gen-Zero
C:\SYSTEM VOLUME INFORMATION\_RESTORE{702D6687-DF40-4E74-9979-AE0D929952C4}\RP57\A0020522.EXE

Adware.Vundo/Variant-Gen6
C:\SYSTEM VOLUME INFORMATION\_RESTORE{702D6687-DF40-4E74-9979-AE0D929952C4}\RP57\A0020530.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{702D6687-DF40-4E74-9979-AE0D929952C4}\RP57\A0020538.DLL

Trojan.Dropper/Gen
C:\SYSTEM VOLUME INFORMATION\_RESTORE{702D6687-DF40-4E74-9979-AE0D929952C4}\RP57\A0020531.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{702D6687-DF40-4E74-9979-AE0D929952C4}\RP57\A0020532.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{702D6687-DF40-4E74-9979-AE0D929952C4}\RP57\A0020533.EXE

Adware.Vundo-Variant/J
C:\SYSTEM VOLUME INFORMATION\_RESTORE{702D6687-DF40-4E74-9979-AE0D929952C4}\RP57\A0020534.DLL

NotHarmful.Sysinternals Bluescreen Screen Saver
C:\SYSTEM VOLUME INFORMATION\_RESTORE{702D6687-DF40-4E74-9979-AE0D929952C4}\RP58\A0020551.SCR

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:20: VIRUS ALERT!, on 30-07-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Programmer\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\AVG\AVG8\aAvgApi.exe
C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\NetFanden\Skrivebord\Downloads\HiJackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://signon.stofanet.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmer\AVG\AVG8\avgssie.dll
O2 - BHO: {93013df3-5f33-97a8-24a4-13597e3993f3} - {3f3993e7-9531-4a42-8a79-33f53fd31039} - (no file)
O2 - BHO: (no name) - {76086C05-4D0A-4B92-9219-2E3FE8C553F9} - (no file)
O2 - BHO: Hjælp til tilmelding til Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {94AC017A-1686-447E-80F8-91568B3001FA} - (no file)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Programmer\AVG\AVG8\avgtoolbar.dll
O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Programmer\Save Flash\SaveFlash.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Programmer\AVG\AVG8\avgtoolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programmer\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [antispy] C:\Programmer\IEAntiVirus\ANTIVIR.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Delta Force-Black Hawk Down Team Sabre Registration.lnk = C:\Documents and Settings\NetFanden\Lokale indstillinger\Temp\{97118F2C-9F2C-45FA-9BCE-D223E7CFD71D}\{6164D2E7-986B-42F5-B3A6-64D5E53FB889}\NOVG.EXE
O4 - Startup: PowerReg Scheduler.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1207013653140
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1207093422796
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmer\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: cbXRIBqN - cbXRIBqN.dll (file missing)
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmer\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 5998 bytes

ComboFix 08-07-29.1 - NetFanden 2008-07-30 3:22:45.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1030.18.686 [GMT 2:00]
Running from: C:\Documents and Settings\NetFanden\Skrivebord\Downloads\ComboFix.exe
* Created a new restore point
* Resident AV is active

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\Application Data\rhc708j0etb1
C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL
C:\Documents and Settings\All Users\Application Data\SecuriSoft SARL\WinSpywareProtect\LOG\20080729012013765.log
C:\Documents and Settings\NetFanden\Application Data\rhc708j0etb1
C:\Documents and Settings\NetFanden\Foretrukne\Error Cleaner.url
C:\Documents and Settings\NetFanden\Foretrukne\Privacy Protector.url
C:\Documents and Settings\NetFanden\Foretrukne\Spyware&Malware Protection.url
C:\Documents and Settings\NetFanden\Menuen Start\Programmer\Antivirus 2008 PRO
C:\Documents and Settings\NetFanden\Menuen Start\Programmer\Antivirus 2008 PRO\antivirus-2008pro.lnk
C:\Documents and Settings\NetFanden\Skrivebord\Error Cleaner.url
C:\Documents and Settings\NetFanden\Skrivebord\Privacy Protector.url
C:\Documents and Settings\NetFanden\Skrivebord\Spyware&Malware Protection.url
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\BcdKRqss.ini
C:\WINDOWS\system32\BcdKRqss.ini2
C:\WINDOWS\system32\blphc308j0etb1.scr
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\psCfOXyb.ini
C:\WINDOWS\system32\psCfOXyb.ini2
C:\WINDOWS\system32\slloulvs.ini
C:\WINDOWS\system32\tfufruaj.ini
C:\WINDOWS\system32\vav.cpl
C:\WINDOWS\wnslvxtf.dll

.
((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-30 )))))))))))))))))))))))))))))))
.

2008-07-30 02:47 . 2008-07-30 02:47 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-07-30 02:42 . 2008-07-30 02:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-07-30 02:41 . 2008-07-30 02:41 <DIR> d-------- C:\Programmer\SUPERAntiSpyware
2008-07-30 02:41 . <DIR> C:\Programmer\Fælles filer\Wise Installation Wizard
2008-07-30 02:41 . 2008-07-30 02:41 <DIR> d-------- C:\Documents and Settings\NetFanden\Application Data\SUPERAntiSpyware.com
2008-07-30 02:36 . 2008-07-30 02:36 <DIR> d-------- C:\Programmer\CCleaner
2008-07-30 02:12 . 2008-07-30 02:12 3,867 --a------ C:\WINDOWS\system32\djeyukqn.dll
2008-07-30 02:09 . 2008-07-30 02:09 3,867 --a------ C:\WINDOWS\system32\vbsclaiy.dll
2008-07-29 02:56 . 2008-07-30 03:22 <DIR> d--h----- C:\$AVG8.VAULT$
2008-07-29 02:47 . 2008-07-29 03:48 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-07-29 02:47 . 2008-07-29 02:47 <DIR> d-------- C:\Programmer\AVG
2008-07-29 02:47 . 2008-07-29 03:50 <DIR> d-------- C:\Documents and Settings\NetFanden\Application Data\AVGTOOLBAR
2008-07-29 02:47 . 2008-07-29 02:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-07-29 02:47 . 2008-07-29 02:47 97,928 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-29 02:47 . 2008-07-29 02:47 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-07-29 02:47 . 2008-07-29 02:47 12,936 --a------ C:\WINDOWS\system32\drivers\avgrkx86.sys
2008-07-29 02:47 . 2008-07-29 02:47 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-07-29 01:14 . 2008-07-29 01:14 <DIR> d-------- C:\Programmer\Panda Security
2008-07-29 01:14 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-07-29 01:06 . 2008-07-29 02:18 <DIR> d-------- C:\Documents and Settings\Administrator\Skrivebord
2008-07-29 01:06 . 2008-03-31 00:41 <DIR> d--h----- C:\Documents and Settings\Administrator\Skabeloner
2008-07-29 01:06 . 2008-03-31 01:30 <DIR> d--h----- C:\Documents and Settings\Administrator\Printere
2008-07-29 01:06 . 2008-03-31 01:30 <DIR> dr------- C:\Documents and Settings\Administrator\Menuen Start
2008-07-29 01:06 . 2008-03-31 01:30 <DIR> d--h----- C:\Documents and Settings\Administrator\Lokale indstillinger
2008-07-29 01:06 . 2008-03-31 01:30 <DIR> d-------- C:\Documents and Settings\Administrator\Foretrukne
2008-07-29 01:06 . 2008-07-29 02:21 <DIR> d-------- C:\Documents and Settings\Administrator\Dokumenter
2008-07-29 01:06 . 2008-03-31 01:30 <DIR> d--h----- C:\Documents and Settings\Administrator\Andre computere
2008-07-29 01:06 . 2008-07-29 02:56 <DIR> d-------- C:\Documents and Settings\Administrator
2008-07-29 00:42 . 2008-07-29 01:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-07-28 17:34 . 2008-07-28 17:34 <DIR> d-------- C:\TABU Rec'z
2008-07-28 17:29 . 2008-07-28 17:29 <DIR> d-------- C:\Undergrunden
2008-07-28 17:15 . 2008-07-28 17:15 <DIR> d-------- C:\X-Files-Season1-HQ-DVDRIP-624x464
2008-07-28 17:14 . 2008-07-29 03:45 <DIR> d-------- C:\Ny mappe
2008-07-28 00:02 . 2008-07-29 00:02 <DIR> d-------- C:\Documents and Settings\NetFanden\Application Data\.ABC
2008-07-28 00:00 . 2008-07-28 23:59 <DIR> d-------- C:\Programmer\ABC
2008-07-18 03:19 . 2008-07-18 03:19 <DIR> d-------- C:\WINDOWS\Sun
2008-07-18 03:19 . 2008-07-18 03:34 <DIR> d-------- C:\Documents and Settings\NetFanden\Application Data\LimeWire
2008-07-15 02:42 . 2008-07-15 02:42 3,580 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-07-13 20:46 . 2008-07-13 20:46 <DIR> d-------- C:\Programmer\NovaLogic
2008-07-13 20:24 . 2008-07-13 20:24 <DIR> d-------- C:\Documents and Settings\NetFanden\Application Data\Leadertech
2008-06-17 02:07 . 2008-06-17 02:07 <DIR> d-------- C:\Documents and Settings\NetFanden\Application Data\Nokia Multimedia Player
2008-06-17 02:05 . 2008-06-17 02:05 <DIR> d-------- C:\Documents and Settings\NetFanden\Phone Browser
2008-06-17 02:00 . 2008-06-17 02:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite
2008-06-17 01:58 . 2008-06-17 02:05 <DIR> d-------- C:\Documents and Settings\NetFanden\Application Data\Nokia
2008-06-17 01:57 . 2008-06-17 01:57 <DIR> d-------- C:\Programmer\PC Connectivity Solution
2008-06-17 01:57 . <DIR> C:\Programmer\Fælles filer\PCSuite
2008-06-17 01:57 . <DIR> C:\Programmer\Fælles filer\Nokia
2008-06-17 01:57 . 2008-06-17 02:00 <DIR> d-------- C:\Documents and Settings\NetFanden\Application Data\PC Suite
2008-06-17 01:56 . 2008-06-17 01:57 <DIR> d-------- C:\Programmer\Nokia
2008-06-17 01:56 . 2007-02-22 11:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys
2008-06-17 01:56 . 2007-02-22 11:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-06-17 01:56 . 2007-02-22 11:15 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-06-17 01:56 . 2007-02-22 11:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
2008-06-17 01:56 . 2007-02-22 11:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys
2008-06-17 01:56 . 2007-02-22 11:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys
2008-06-17 01:54 . 2008-06-17 01:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Installations
2008-06-12 23:49 . 2008-06-14 20:00 272,256 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-11 00:42 . 2008-07-26 12:48 244 --ah----- C:\sqmnoopt19.sqm
2008-06-11 00:42 . 2008-07-26 12:48 232 --ah----- C:\sqmdata19.sqm
2008-06-10 03:04 . 2008-07-22 03:30 244 --ah----- C:\sqmnoopt18.sqm
2008-06-10 03:04 . 2008-07-22 03:30 232 --ah----- C:\sqmdata18.sqm
2008-06-04 02:39 . 2008-07-22 03:29 244 --ah----- C:\sqmnoopt17.sqm
2008-06-04 02:39 . 2008-07-22 03:29 232 --ah----- C:\sqmdata17.sqm
2008-06-03 05:26 . 2008-07-18 01:06 244 --ah----- C:\sqmnoopt16.sqm
2008-06-03 05:26 . 2008-07-18 01:06 232 --ah----- C:\sqmdata16.sqm
2008-06-03 04:21 . 2008-07-16 02:18 244 --ah----- C:\sqmnoopt15.sqm
2008-06-03 04:21 . 2008-07-16 02:18 232 --ah----- C:\sqmdata15.sqm
2008-06-03 02:52 . 2008-07-12 00:46 244 --ah----- C:\sqmnoopt14.sqm
2008-06-03 02:52 . 2008-07-12 00:46 232 --ah----- C:\sqmdata14.sqm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-28 22:20 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-13 18:46 --------- d--h--w C:\Programmer\InstallShield Installation Information
2008-07-13 18:45 --------- d-----w C:\Programmer\Fælles filer\InstallShield
2008-06-14 18:00 272,256 ------w C:\WINDOWS\system32\drivers\bthport.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-27 02:53 15360]
"SUPERAntiSpyware"="C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\ATI-CPanel\atiptaxx.exe" [2003-06-05 12:35 335872]
"Adobe Reader Speed Launcher"="C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"PCSuiteTrayApplication"="C:\Programmer\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-29 02:47 1235736]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 16:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
"SoundMan"="SOUNDMAN.EXE" [2003-06-10 19:12 55296 C:\WINDOWS\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-27 02:53 15360]
"Nokia.PCSync"="C:\Programmer\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Programmer\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 12:41 294912 C:\Programmer\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programmer\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Programmer\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Programmer\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Programmer\\ABC\\abc.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.321\\English\\setup.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\english\\setup.exe"=
"C:\\Programmer\\AVG\\AVG8\\avgemc.exe"=
"C:\\Programmer\\AVG\\AVG8\\avgupd.exe"=
"C:\\Programmer\\AVG\\AVG8\\avgnsx.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"119:TCP"= 119:TCP:usenext
"443:TCP"= 443:TCP:usenext

R0 AvgRkx86;avgrkx86.sys;C:\WINDOWS\system32\Drivers\avgrkx86.sys [2008-07-29 02:47]
R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-29 02:47]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-07-29 02:47]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-29 02:47]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-29 02:47]
.
- - - - ORPHANS REMOVED - - - -

Notify-cbXRIBqN - cbXRIBqN.dll

.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://signon.stofanet.dk/

O16 -: DirectAnimation Java Classes - file://C:\WINDOWS\Java\classes\dajava.cab
C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd

O16 -: {029FDBA6-3547-11D7-AA4C-0050BF051A00} - hxxp://downol.dr.dk/download/netradio/Rawflow.cab
C:\WINDOWS\Downloaded Program Files\Rawflow.ocx

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-30 03:26:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Programmer\PC Connectivity Solution\ServiceLayer.exe
C:\Programmer\AVG\AVG8\avgrsx.exe
C:\Programmer\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-07-30 3:30:13 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-30 01:29:58

Pre-Run: 10,306,129,920 byte ledig
Post-Run: 10,711,609,344 byte ledig

195 --- E O F --- 2008-07-18 01:15:45

Synes godt om

Computer Hjælp (Gratis) Mester

02. august 2008 - 06:44 #1

Nej - den er _ikke_ iorden; der er >10 uønskede elementer endnu..

Hent og instalér CCleaner http://www.ccleaner.com/ + http://www.spywarefri.dk/manualer/ccleaner-manual.htm
Under installationen får du tilbudt [Yahoo Toolbar]. Du kan sige ja eller *NEJ* til den.
Lad programmer foretage en oprydning...

--------

Hent Malwarebytes Anti-Malware herfra:
http://www.besttechie.net/tools/mbam-setup.exe
Eller herfra ->
http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html

Installer programmet - når det er gjort skal du lade programmet opdatere sig. Herefter åbner et vindue, hvor du skal flytte prikken til "Kør et fuldstændigt systemscan" - klik på Skan Knappen - lad programmet arbejde. Når det er færdig (det tager lidt tid afhængig af hvor meget du har på computeren).
Derefter - Tryk på "Vis resultater" knappen efter scanningen - og herefter tryk på "Fjern det valgte" - nu åbnes log'en og du skal gemme den et sted, hvor du kan finde den igen.
Kopier indholdet herind sammen med en frisk log fra HiJackThis...

Synes godt om

levich Nybegynder

02. august 2008 - 11:23 #2

Umiddelbart ser det ud til at programmerne er kørt i denne rækkefølge:
Hijackthis -> Combofix -> superantispyware
Det er derfor efter min mening svært at vide om der er uønskede elementer tilbage, da de meget vel allerede kan være fjernet på nuværende tidspunkt.

Jeg foreslår at du laver en ny hijackthis log og sender den herind.

Synes godt om

Computer Hjælp (Gratis) Mester

02. august 2008 - 20:40 #3

Hørt!

Synes godt om

netfanden Nybegynder

05. august 2008 - 03:01 #4

Hej jeg kørte også CCleaner forleden

Nu kører jeg dem i denne rækkefølge:

1. CCleaner
2. Anti-malware
3. Hijackthis

Her er logfiler:

Malwarebytes' Anti-Malware 1.24
Database version: 1026
Windows 5.1.2600 Service Pack 2

02:53:28 05-08-2008
mbam-log-8-5-2008 (02-53-28).txt

Skan type: Fuldstændig skanning (C:\|D:\|)
Objekter skannet: 60517
Tid tilbagelagt: 25 minute(s), 52 second(s)

Inficerede Hukommelses Processer: 0
Inficerede Hukommelses Moduler: 0
Inficerede Registeringsdatabase Nøgler: 6
Inficerede Registeringsdatabase Værdier: 2
Inficerede Registeringsdatabase Filer: 0
Inficerede Mapper: 0
Inficerede Filer: 17

Inficerede Hukommelses Processer:
(Ingen mistænkelige filer fundet)

Inficerede Hukommelses Moduler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Nøgler:
HKEY_LOCAL_MACHINE\SOFTWARE\rhc708j0etb1 (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\VAV (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\fdkowvbp.bmlb (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\fdkowvbp.bwav (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\fdkowvbp.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Inficerede Registeringsdatabase Værdier:
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Inficerede Registeringsdatabase Filer:
(Ingen mistænkelige filer fundet)

Inficerede Mapper:
(Ingen mistænkelige filer fundet)

Inficerede Filer:
C:\combofix filer\Quarantine\C\WINDOWS\system32\vav.cpl.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019441.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019442.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019443.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019444.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019445.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019446.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019448.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019451.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019452.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019453.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019454.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019455.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019457.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019449.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP58\A0020548.cpl (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP58\A0020577.cpl (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:55, on 05-08-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\AVG\AVG8\aAvgApi.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Programmer\Windows Media Player\wmplayer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\NetFanden\Skrivebord\Downloads\Antivirus\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://signon.stofanet.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmer\AVG\AVG8\avgssie.dll
O2 - BHO: Hjælp til tilmelding til Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Programmer\AVG\AVG8\avgtoolbar.dll
O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Programmer\Save Flash\SaveFlash.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Programmer\AVG\AVG8\avgtoolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programmer\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Delta Force-Black Hawk Down Team Sabre Registration.lnk = C:\Documents and Settings\NetFanden\Lokale indstillinger\Temp\{97118F2C-9F2C-45FA-9BCE-D223E7CFD71D}\{6164D2E7-986B-42F5-B3A6-64D5E53FB889}\NOVG.EXE
O4 - Startup: PowerReg Scheduler.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1207013653140
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1207093422796
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmer\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll,wbsys.dll,
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmer\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 5150 bytes

Synes godt om

netfanden Nybegynder

05. august 2008 - 03:04 #5

Hej jeg kørte også CCleaner forleden

Nu kører jeg dem i denne rækkefølge:

1. CCleaner
2. Anti-malware
3. Hijackthis

Her er logfiler:

Malwarebytes' Anti-Malware 1.24
Database version: 1026
Windows 5.1.2600 Service Pack 2

02:53:28 05-08-2008
mbam-log-8-5-2008 (02-53-28).txt

Skan type: Fuldstændig skanning (C:\|D:\|)
Objekter skannet: 60517
Tid tilbagelagt: 25 minute(s), 52 second(s)

Inficerede Hukommelses Processer: 0
Inficerede Hukommelses Moduler: 0
Inficerede Registeringsdatabase Nøgler: 6
Inficerede Registeringsdatabase Værdier: 2
Inficerede Registeringsdatabase Filer: 0
Inficerede Mapper: 0
Inficerede Filer: 17

Inficerede Hukommelses Processer:
(Ingen mistænkelige filer fundet)

Inficerede Hukommelses Moduler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Nøgler:
HKEY_LOCAL_MACHINE\SOFTWARE\rhc708j0etb1 (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\VAV (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\fdkowvbp.bmlb (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\fdkowvbp.bwav (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\fdkowvbp.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Inficerede Registeringsdatabase Værdier:
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Inficerede Registeringsdatabase Filer:
(Ingen mistænkelige filer fundet)

Inficerede Mapper:
(Ingen mistænkelige filer fundet)

Inficerede Filer:
C:\combofix filer\Quarantine\C\WINDOWS\system32\vav.cpl.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019441.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019442.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019443.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019444.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019445.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019446.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019448.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019451.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019452.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019453.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019454.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019455.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019457.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP56\A0019449.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP58\A0020548.cpl (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{702D6687-DF40-4E74-9979-AE0D929952C4}\RP58\A0020577.cpl (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:55, on 05-08-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\ATI-CPanel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\AVG\AVG8\aAvgApi.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Programmer\Windows Media Player\wmplayer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\NetFanden\Skrivebord\Downloads\Antivirus\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://signon.stofanet.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Programmer\AVG\AVG8\avgssie.dll
O2 - BHO: Hjælp til tilmelding til Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programmer\Fælles filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Programmer\AVG\AVG8\avgtoolbar.dll
O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Programmer\Save Flash\SaveFlash.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Programmer\AVG\AVG8\avgtoolbar.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\ATI-CPanel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Programmer\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Delta Force-Black Hawk Down Team Sabre Registration.lnk = C:\Documents and Settings\NetFanden\Lokale indstillinger\Temp\{97118F2C-9F2C-45FA-9BCE-D223E7CFD71D}\{6164D2E7-986B-42F5-B3A6-64D5E53FB889}\NOVG.EXE
O4 - Startup: PowerReg Scheduler.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1207013653140
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1207093422796
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmer\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll,wbsys.dll,
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmer\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 5150 bytes

Synes godt om

Computer Hjælp (Gratis) Mester

05. august 2008 - 06:46 #6

Lidt generel oprydning ->

Kør en scanning med Hijackthis,
Du får herunder nogle filer, som du skal fixe. Det, du skal gøre, er at sætte et flueben ud for disse filer. Når du har gjort det, så lukker du alle andre vinduer ned. Det er meget vigtigt at det eneste vindue, som er åbent er HijackThis vinduet. Husk også at lukke dette vindue, når du har markeret filerne. Nu må du fixe. Klik på Fix checked.

Det er disse, som skal fixes:

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programmer\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - Startup: Delta Force-Black Hawk Down Team Sabre Registration.lnk = C:\Documents and Settings\NetFanden\Lokale indstillinger\Temp\{97118F2C-9F2C-45FA-9BCE-D223E7CFD71D}\{6164D2E7-986B-42F5-B3A6-64D5E53FB889}\NOVG.EXE

Genstart normalt...

------------------------------------------------------------------------

Hvordan kører PC'en så nu ?

Husk M$ ServicePack3 til XP -> http://www.microsoft.com/downloads/details.aspx?FamilyID=5b33b5a8-5e76-401f-be08-1e1555d4f3d4&displaylang=da

Synes godt om

netfanden Nybegynder

06. august 2008 - 02:48 #7

Pc'en køre egentlig ok, uden at have gjort noget af det du skrev, jeg oplever ikke nogle problemer...
Men vil lige fixe de filer og hente servicepack3
Vender tilbage efter det er gjort og vedlægger ny log fra HIJ....
MVH. THomas

Synes godt om

Computer Hjælp (Gratis) Mester

06. august 2008 - 06:49 #8

... gør også [05/08-2008 06:46:25] !!!

Synes godt om

levich Nybegynder

06. august 2008 - 14:00 #9

Umiddelbart opfatter jeg følge linje som hørende til en eller form for registrering af computerspillet Delta force black hawn down:
O4 - Startup: Delta Force-Black Hawk Down Team Sabre Registration.lnk = C:\Documents and Settings\NetFanden\Lokale indstillinger\Temp\{97118F2C-9F2C-45FA-9BCE-D223E7CFD71D}\{6164D2E7-986B-42F5-B3A6-64D5E53FB889}\NOVG.EXE

... hvad siger du, netfanden, er det noget som du vil kendes ved. I så fald skal du naturligvis ikke fixe linje med hijackthis.

Synes godt om

Computer Hjælp (Gratis) Mester

06. august 2008 - 19:36 #10

Når den ligger under
..\Lokale indstillinger\Temp\
så må det da være noget 'midlertidig' ...

http://www.bleepingcomputer.com/startups/NOVG.EXE-13162.html

Synes godt om

Titel	Indlæg	Oprettet	Seneste aktivitet
Vil skrifte antivirusprogram. Af ErikHg i Virus	22	26/11/202510:42	23/12/202514:29
Er gratis Bitdefender værd at installere ? Af Ikke-ekspert i Virus	8	31/08/202519:08	01/09/202514:18
Ukendte filer på min Pc Af jonpet i Virus	10	03/02/202514:20	04/02/202511:05
mulig ukendt virus Af jackie18 i Virus	3	18/01/202514:07	18/01/202516:39
virus popper op med jævne mellemrum Af Malm i Virus	13	18/01/202511:40	20/01/202517:53

I dag 09:15	What is Block Blast? Af makmalon Elon i 3D-software
27/1222:02	Låse brugt iPad op Af drstein i iOS, iPhone & iPad
27/1219:21	Hvor finder jeg en oversigt over mine spørgsmål Af KurtG i Hjælp og fejl
27/1211:31	TP-Link Wifi extender opsat som accesspoint giver 50% up- og download, Af Uvanga i Wifi
26/1213:05	Hvorfor bliver tiff-filer større ved konvertering til samme format Af KurtG i Billedbehandling

Notifikationer

Spøgelser Log filer ønskes tjekket

Log ind eller opret profil

Hov!