CIO Tech Eksperten IT-JOB IT-Kurser Events Podcast Søg

Log ind eller opret profil

Du kan også logge ind via nedenstående tjenester

acement Nybegynder

09. april 2009 - 17:30 Der er 6 kommentarer og
1 løsning

Norton Internet Worm protection fanger Isass.exe

Hej

Jeg har problemer med Norton antivirus 2005, worm protection fanger Isass.exe og kommer med en pop-up som beder om tilladelse eller blokering. lige meget hvad jeg gør bliver den ved med at poppe up konstant. jeg har tjekket protokolen hvori undtagelser står og der er den representeret. I advarslen står der:

Sti: c:\windows\system32\Isass.exe
Filnavn: LSA Shell (export version)
Retning: Indgående
Lokal Adresse: alle lokale netværkskort
lokal port: 500
Fjernadresse: 71.139.190.190
fjernport: 500
Protokol: UDP

På forhånd tak

Synes godt om

f-arn Guru

09. april 2009 - 17:49 #1

Hvis det er med i har den ganske ret. Hvis du har copy/pasted fra en log bør den fjernes.

Men prøv lige det her:
Hent "Malwarebytes' Anti-Malware" her: http://www.malwarebytes.org/mbam.php
Installer og start programmet, opdater, lav "fuld systemskanning" under fanebladet "skanner".
Bagefter klik på "vis resultater", tryk på "Fjern det valgte" og send loggen herind sammen med en log fra Hijackthis som du finder her:

http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe
Kør HijackThis, klik på "Do a systemscan scan and save a logfile" kopier loggens tekst og send den herind.

Bemærk Hijackthis skal gemmes på computeren og ikke køres fra nettet

Mht.: Vista - Højreklik på *.exe filen - Kør som Administrator.

Synes godt om

acement Nybegynder

09. april 2009 - 20:22 #2

Hey
Malwarebytes gav ikke noget.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:58:38, on 09-04-2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Intel\Wireless\Bin\EvtEng.exe
C:\Programmer\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
C:\Programmer\Fælles filer\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\Programmer\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programmer\Fælles filer\Autodesk Shared\Service\AdskScSrv.exe
C:\Programmer\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Programmer\IBM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
C:\Programmer\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\Programmer\Intel\Wireless\Bin\RegSrvc.exe
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\TPHDEXLG.EXE
C:\WINDOWS\system32\TpKmpSVC.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmer\Synaptics\SynTP\SynTPLpr.exe
C:\Programmer\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\TpShocks.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\Programmer\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Programmer\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Programmer\IBM\Messages By IBM\ibmmessages.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\Programmer\ThinkPad\ConnectUtilities\QCTRAY.EXE
C:\Programmer\ThinkPad\ConnectUtilities\QCWLICON.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Programmer\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Programmer\Analog Devices\SoundMAX\Smax4.exe
C:\Programmer\Winamp\winampa.exe
C:\Programmer\iTunes\iTunesHelper.exe
C:\Programmer\Microsoft Office\Office12\GrooveMonitor.exe
C:\Programmer\Skype\Phone\Skype.exe
C:\Programmer\Windows Live\Messenger\MsnMsgr.Exe
C:\Programmer\DAEMON Tools\daemon.exe
C:\Programmer\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Programmer\IBM\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Programmer\Microsoft Office\Office12\ONENOTEM.EXE
C:\PROGRA~1\IBM\BLUETO~1\BTSTAC~1.EXE
C:\Programmer\OpenOffice.org 2.4\program\soffice.exe
C:\Programmer\OpenOffice.org 2.4\program\soffice.BIN
C:\Programmer\iPod\bin\iPodService.exe
C:\Programmer\PC Connectivity Solution\ServiceLayer.exe
C:\Programmer\Skype\Plugin Manager\skypePM.exe
C:\Programmer\Windows Live\Messenger\usnsvc.exe
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\PROGRA~1\MICROS~2\Office12\OUTLOOK.EXE
C:\Programmer\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Programmer\PC Connectivity Solution\Transports\NclIrSrv.exe
C:\Programmer\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Programmer\PC Connectivity Solution\Transports\NclBCBTSrv.exe
C:\Programmer\Microsoft Office\Office12\WINWORD.EXE
C:\Programmer\Winamp\winamp.exe
C:\Programmer\Windows Media Player\WMPNSCFG.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Documents and Settings\Mads\Dokumenter\Små programmer\HiJackThis.exe

Jeg ved ikke rigtig om jeg har forklaret mit problem rigtigt, det er helt fint at norton finder fejlen, problemet er bare at selvom jeg har sat den til at blokere alt mht Isass.exe automatisk, bliver den ved med at spørge om den kan få lov eller om den skal blokere. Så problemet ligger måske mest af alt i mit virus program. Du må undskylde hvis det er lidt forvirende:-)

Synes godt om

fromsej Praktikant

09. april 2009 - 20:31 #3

Det er fordi lsass.exe er en af de absolut vigtigste filer.
Jeg kunne godt tænke mig en Combofixlog, den kan muligvis vise om du har legale filer der er inficerede.

Hent Combofix, og gem den på dit skrivebord:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

-- Kør så combofix.exe, og følg anvisningerne.
Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Når combofix er færdig, og efter det har genstartet, skulle der gerne åbnes en logfil: combofix.txt
Indholdet af denne fil må du gerne lægge herind.

Synes godt om

acement Nybegynder

09. april 2009 - 21:32 #4

ComboFix 09-04-04.01 - Mads 2009-04-09 21:10:46.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1030.18.1534.945 [GMT 2:00]
Kører fra: c:\documents and settings\Mads\Dokumenter\Små programmer\ComboFix.exe

advarsel -DENNE MASKINE HAR IKKE GENOPRETTELSESKONSOL INSTALLERET !!
.

((((((((((((((((((((((((((((((((((((((( Andet, der er slettet )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\303350.exe
c:\windows\system32\prsgrc.dll
c:\windows\system32\ssprs.dll
c:\windows\system32\uniq.tll
c:\windows\system32\win32hlp.cnf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Tjenester )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_seneka

((((((((((((((((((((((((((((( Filer skabt fra 2009-03-09 til 2009-04-09 )))))))))))))))))))))))))))))))))))
.

2009-04-06 17:29 . 2009-04-06 17:29 <DIR> d-------- c:\programmer\Windows Media Connect 2
2009-04-06 17:27 . 2009-04-06 17:27 <DIR> d-------- c:\windows\system32\LogFiles
2009-04-06 17:27 . 2009-04-06 17:28 <DIR> d-------- c:\windows\system32\drivers\UMDF
2009-04-06 17:23 . 2009-04-06 17:23 <DIR> d-------- c:\programmer\Microsoft Silverlight
2009-03-31 21:53 . 2009-03-31 21:53 <DIR> d-------- c:\windows\system32\KB905474
2009-03-31 21:53 . 2009-03-10 22:26 1,434,496 --a------ c:\windows\system32\KB905474\wganotifypackageinner.exe
2009-03-31 21:53 . 2009-03-10 22:18 454,016 --a------ c:\windows\system32\KB905474\wgasetup.exe
2009-03-31 21:53 . 2009-02-09 18:51 13,150 --a------ c:\windows\system32\KB905474\wga_eula.txt
2009-03-27 15:51 . 2008-03-21 14:57 14,640 --------- c:\windows\system32\spmsgXP_2k3.dll
2009-03-27 15:51 . 2009-03-27 15:51 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-03-27 15:51 . 2009-03-27 15:51 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-03-27 15:50 . 2009-03-27 15:52 <DIR> d-------- c:\documents and settings\Mads\Application Data\PC Suite
2009-03-27 15:50 . 2009-03-31 17:38 <DIR> d-------- c:\documents and settings\Mads\Application Data\Nokia
2009-03-27 15:50 . 2009-03-27 15:50 <DIR> d-------- c:\documents and settings\All Users\Application Data\PC Suite
2009-03-27 15:47 . 2009-03-27 15:48 <DIR> d-------- c:\programmer\Fælles filer\PCSuite
2009-03-27 15:47 . 2009-03-27 15:47 <DIR> d-------- c:\programmer\Fælles filer\Nokia
2009-03-27 15:46 . 2009-03-27 15:46 <DIR> d-------- c:\programmer\DIFX
2009-03-27 15:46 . 2008-08-26 10:26 18,816 --a------ c:\windows\system32\drivers\pccsmcfd.sys
2009-03-27 15:45 . 2009-03-27 15:45 <DIR> d-------- c:\programmer\PC Connectivity Solution
2009-03-27 15:45 . 2009-03-27 15:47 <DIR> d-------- c:\programmer\Nokia
2009-03-27 15:45 . 2008-09-15 08:29 1,112,288 --a------ c:\windows\system32\wdfcoinstaller01007.dll
2009-03-27 15:45 . 2008-09-15 08:56 659,968 --a------ c:\windows\system32\nmwcdcocls.dll
2009-03-27 15:45 . 2008-09-15 08:56 91,136 --a------ c:\windows\system32\nmwcdcls.dll
2009-03-27 15:45 . 2008-09-15 08:56 22,016 --a------ c:\windows\system32\drivers\ccdcmbo.sys
2009-03-27 15:45 . 2008-09-15 08:56 17,664 --a------ c:\windows\system32\drivers\ccdcmb.sys
2009-03-27 15:45 . 2008-09-15 08:56 8,064 --a------ c:\windows\system32\drivers\usbser_lowerfltj.sys
2009-03-27 15:45 . 2008-09-15 08:56 8,064 --a------ c:\windows\system32\drivers\usbser_lowerflt.sys
2009-03-27 15:42 . 2009-03-27 15:42 <DIR> d-------- c:\documents and settings\All Users\Application Data\Installations
2009-03-25 20:45 . 2009-04-03 11:40 <DIR> d-------- c:\documents and settings\Mads\Application Data\CoreFTP
2009-03-25 20:44 . 2009-03-25 20:44 <DIR> d-------- c:\programmer\CoreFTP
2009-03-24 23:50 . 2009-03-24 23:50 <DIR> d-------- c:\programmer\GPLGS
2009-03-24 23:45 . 2009-03-24 23:45 <DIR> d-------- c:\programmer\Acro Software
2009-03-24 23:45 . 2007-07-12 23:33 87,552 --a------ c:\windows\system32\cpwmon2k.dll
2009-03-22 13:00 . 2009-03-22 13:02 <DIR> d-------- c:\windows\system32\NtmsData
2009-03-18 13:50 . 2009-03-30 11:56 3,420 --a------ c:\windows\system32\PerfStringBackup.TMP
2009-03-18 13:44 . 2004-09-09 16:33 <DIR> d-------- c:\documents and settings\Mads.ACEMENT\Skrivebord
2009-03-18 13:44 . 2004-09-09 16:33 <DIR> d--h----- c:\documents and settings\Mads.ACEMENT\Skabeloner
2009-03-18 13:44 . 2004-09-09 16:33 <DIR> d--h----- c:\documents and settings\Mads.ACEMENT\Printere
2009-03-18 13:44 . 2004-09-09 16:33 <DIR> dr------- c:\documents and settings\Mads.ACEMENT\Menuen Start
2009-03-18 13:44 . 2004-09-09 16:33 <DIR> d--h----- c:\documents and settings\Mads.ACEMENT\Lokale indstillinger
2009-03-18 13:44 . 2004-09-09 16:50 <DIR> dr------- c:\documents and settings\Mads.ACEMENT\Foretrukne
2009-03-18 13:44 . 2004-09-09 16:50 <DIR> dr------- c:\documents and settings\Mads.ACEMENT\Dokumenter
2009-03-18 13:44 . 2008-07-06 13:10 <DIR> d-------- c:\documents and settings\Mads.ACEMENT\Bluetooth Software
2009-03-18 13:44 . 2008-07-06 13:24 <DIR> d-------- c:\documents and settings\Mads.ACEMENT\Application Data\Symantec
2009-03-18 13:44 . 2008-07-06 13:22 <DIR> d-------- c:\documents and settings\Mads.ACEMENT\Application Data\Sonic
2009-03-18 13:44 . 2008-07-06 13:21 <DIR> d-------- c:\documents and settings\Mads.ACEMENT\Application Data\IBM
2009-03-18 13:44 . 2004-09-09 16:33 <DIR> d--h----- c:\documents and settings\Mads.ACEMENT\Andre computere
2009-03-18 13:44 . 2009-03-18 13:44 <DIR> d-------- c:\documents and settings\Mads.ACEMENT
2009-03-18 13:43 . 2009-03-18 13:43 <DIR> d--h----- c:\documents and settings\NetworkService.NT AUTHORITY\Lokale indstillinger
2009-03-18 13:43 . 2009-03-18 13:43 <DIR> d--hs---- c:\documents and settings\NetworkService.NT AUTHORITY
2009-03-15 18:24 . 2009-03-15 18:24 118 --a------ c:\windows\system32\MRT.INI

.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-09 19:19 --------- d-----w c:\documents and settings\Mads\Application Data\Skype
2009-04-09 19:18 --------- d-----w c:\documents and settings\Mads\Application Data\OpenOffice.org2
2009-04-09 18:57 --------- d-----w c:\documents and settings\Mads\Application Data\skypePM
2009-04-09 18:52 --------- d-----w c:\programmer\Fælles filer\Symantec Shared
2009-04-09 18:49 --------- d-----w c:\documents and settings\Mads\Application Data\uTorrent
2009-04-06 15:26 --------- d-----w c:\programmer\Windows Media Connect
2009-03-30 20:00 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-18 15:40 --------- d-----w c:\documents and settings\Mads\Application Data\Apple Computer
2009-02-28 14:53 --------- d-----w c:\programmer\staad.pro
2009-02-28 14:53 --------- d-----w c:\programmer\Fælles filer\RAM Common
2009-02-28 14:50 --------- d-----w c:\programmer\VectorDraw
2009-02-28 14:49 --------- d-----w c:\programmer\Fælles filer\Bentley Shared
2009-02-28 13:55 --------- d-----w c:\programmer\MSBuild
2009-02-28 13:55 --------- d-----w c:\programmer\Microsoft Works
2009-02-28 13:52 --------- d-----w c:\programmer\Microsoft.NET
2009-02-28 13:49 --------- d-----w c:\programmer\Microsoft Visual Studio 8
2009-02-24 20:13 --------- d-----w c:\documents and settings\Mads\Application Data\IBM
2009-02-19 22:16 --------- d-----w c:\programmer\Microsoft Office Communicator
2009-02-19 22:04 --------- d-----w c:\documents and settings\Mads\Application Data\MathWorks
2009-02-19 21:34 --------- d-----w c:\documents and settings\All Users\Application Data\Applications
2009-02-19 20:25 --------- d-----w c:\programmer\Malwarebytes' Anti-Malware
2009-02-19 20:25 --------- d-----w c:\documents and settings\Mads\Application Data\Malwarebytes
2009-02-19 20:25 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-18 21:07 --------- d-----w c:\programmer\MagicISO
2009-02-11 09:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 09:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2008-05-30 23:44 37,375 ----a-w c:\programmer\openoffice.org-xsltfilter.cab
2008-05-30 23:44 2,560,826 ----a-w c:\programmer\openoffice.org-writer.cab
2008-05-30 23:43 962,109 ----a-w c:\programmer\openoffice.org-draw.cab
2008-05-30 23:43 86,906 ----a-w c:\programmer\openoffice.org-graphicfilter.cab
2008-05-30 23:43 3,991,337 ----a-w c:\programmer\openoffice.org-core07.cab
2008-05-30 23:43 297,174 ----a-w c:\programmer\openoffice.org-core08.cab
2008-05-30 23:43 28,900,574 ----a-w c:\programmer\openoffice.org-core06.cab
2008-05-30 23:43 207,072 ----a-w c:\programmer\openoffice.org-testtool.cab
2008-05-30 23:43 2,763 ----a-w c:\programmer\openoffice.org-emailmerge.cab
2008-05-30 23:43 2,503,457 ----a-w c:\programmer\openoffice.org-pyuno.cab
2008-05-30 23:43 2,025,606 ----a-w c:\programmer\openoffice.org-core09.cab
2008-05-30 23:43 118,874 ----a-w c:\programmer\openoffice.org-javafilter.cab
2008-05-30 23:43 1,301,843 ----a-w c:\programmer\openoffice.org-impress.cab
2008-05-30 23:43 1,126,062 ----a-w c:\programmer\openoffice.org-math.cab
2008-05-30 23:40 18,775,822 ----a-w c:\programmer\openoffice.org-core05.cab
2008-05-30 23:40 16,397,009 ----a-w c:\programmer\openoffice.org-core04.cab
2008-05-30 23:39 9,111,673 ----a-w c:\programmer\openoffice.org-core03.cab
2008-05-30 23:39 3,838,176 ----a-w c:\programmer\openoffice.org-core02.cab
2008-05-30 23:39 15,114,955 ----a-w c:\programmer\openoffice.org-core01.cab
2008-05-30 23:38 43,009 ----a-w c:\programmer\openoffice.org-activex.cab
2008-05-30 23:38 4,755,881 ----a-w c:\programmer\openoffice.org-calc.cab
2008-05-30 23:38 4,368,384 ----a-w c:\programmer\openofficeorg24.msi
2008-05-30 23:38 217 ----a-w c:\programmer\setup.ini
2008-05-30 23:38 1,837,822 ----a-w c:\programmer\openoffice.org-base.cab
2008-05-30 23:38 1,821,008 ----a-w c:\programmer\instmsiw.exe
2008-05-30 23:38 1,707,856 ----a-w c:\programmer\instmsia.exe
.

((((((((((((((((((((((((((((((((((( Start steder i reg.basen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Bemærk* tomme linier & lovlige standard linier vises ikke
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"ibmmessages"="c:\programmer\IBM\Messages By IBM\ibmmessages.exe" [2004-08-06 442368]
"Skype"="c:\programmer\Skype\Phone\Skype.exe" [2008-11-07 21633320]
"MsnMsgr"="c:\programmer\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"DAEMON Tools"="c:\programmer\DAEMON Tools\daemon.exe" [2007-08-29 171464]
"PC Suite Tray"="c:\programmer\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-12-03 1205760]
"WMPNSCFG"="c:\programmer\Windows Media Player\WMPNSCFG.exe" [2006-11-15 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="c:\programmer\Synaptics\SynTP\SynTPLpr.exe" [2004-11-08 110592]
"SynTPEnh"="c:\programmer\Synaptics\SynTP\SynTPEnh.exe" [2004-11-08 512000]
"TPKMAPHELPER"="c:\programmer\ThinkPad\Utilities\TpKmapAp.exe" [2004-02-04 897024]
"TPHOTKEY"="c:\progra~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe" [2005-03-03 94208]
"EZEJMNAP"="c:\progra~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2004-11-24 212992]
"ATIPTA"="c:\programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-12-11 344064]
"UC_Start"="c:\programmer\IBM\Updater\\ucstartup.exe" [2004-07-14 36864]
"UpdateManager"="c:\programmer\Fælles filer\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-09-02 127035]
"ibmmessages"="c:\programmer\IBM\Messages By IBM\\ibmmessages.exe" [2004-08-06 442368]
"ccApp"="c:\programmer\Fælles filer\Symantec Shared\ccApp.exe" [2007-02-21 58984]
"QCTRAY"="c:\programmer\ThinkPad\ConnectUtilities\QCTRAY.EXE" [2005-03-18 745472]
"QCWLICON"="c:\programmer\ThinkPad\ConnectUtilities\QCWLICON.EXE" [2005-03-18 86016]
"PWRMGRTR"="c:\progra~1\ThinkPad\UTILIT~1\PWRMGRTR.DLL" [2005-01-21 135168]
"Symantec NetDriver Monitor"="c:\progra~1\SYMNET~1\SNDMon.exe" [2008-07-06 100056]
"SoundMAXPnP"="c:\programmer\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"WinampAgent"="c:\programmer\Winamp\winampa.exe" [2008-07-09 36352]
"QuickTime Task"="c:\programmer\QuickTime\qttask.exe" [2008-11-05 413696]
"iTunesHelper"="c:\programmer\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"GrooveMonitor"="c:\programmer\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"TpShocks"="TpShocks.exe" [2005-01-24 c:\windows\system32\TpShocks.exe]
"TP4EX"="tp4ex.exe" [2004-11-12 c:\windows\system32\TP4EX.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\QConGina]
2005-03-18 03:07 262144 c:\windows\system32\QConGina.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2004-08-12 20:11 24576 c:\windows\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programmer\\IBM\\Updater\\jre\\bin\\java.exe"=
"c:\\Programmer\\IBM\\Updater\\jre\\bin\\javaw.exe"=
"c:\\Programmer\\IBM\\Updater\\ucsmb.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programmer\\Messenger\\msmsgs.exe"=
"c:\\Programmer\\uTorrent\\uTorrent.exe"=
"c:\\Programmer\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Programmer\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Programmer\\iTunes\\iTunes.exe"=
"c:\\Programmer\\Autodesk\\Backburner\\monitor.exe"=
"c:\\Programmer\\Autodesk\\Backburner\\manager.exe"=
"c:\\Programmer\\Autodesk\\Backburner\\server.exe"=
"c:\\Programmer\\Autodesk\\3ds Max 2008\\3dsmax.exe"=
"c:\\Programmer\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Programmer\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Programmer\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Programmer\\Skype\\Phone\\Skype.exe"=

R0 Shockprf;Shockprf;c:\windows\system32\drivers\shockprf.sys [2008-07-06 59776]
R0 TPDiskPM;TPDiskPM;c:\windows\system32\drivers\TPDiskPM.sys [2008-07-06 14208]
R1 ANC;ANC;c:\windows\system32\drivers\ANC.sys [2008-07-06 11520]
R1 IBMTPCHK;IBMTPCHK;c:\windows\system32\drivers\IBMBLDID.SYS [2008-07-06 2432]
R1 ShockMgr;ShockMgr;c:\windows\system32\drivers\ShockMgr.sys [2008-07-06 4608]
R1 TPPWRIF;TPPWRIF;c:\windows\system32\drivers\TPPWRIF.SYS [2008-07-06 4442]
R2 Automatisk LiveUpdate-planlægning;Automatisk LiveUpdate-planlægning;c:\programmer\Symantec\LiveUpdate\AluSchedulerSvc.exe [2008-07-06 100032]
R3 TPInput;TPInput;c:\windows\system32\drivers\TPInput.sys [2008-07-06 6016]
S3 QCNDISIF;QCNDISIF;c:\windows\system32\drivers\qcndisif.sys [2008-07-06 12288]
S3 USBAAPL;Apple Mobile USB Driver;c:\windows\system32\drivers\usbaapl.sys [2008-11-16 32000]

--- Andre Services/Drivers i Hukommelsen ---

*Deregistered* - S24EventMonitor
*Deregistered* - SamSs
*Deregistered* - SBService
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - ServiceLayer
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - SNDSrvc
*Deregistered* - SoundMAX Agent Service (default)
*Deregistered* - SPBBCSvc
*Deregistered* - Spooler
*Deregistered* - srservice
*Deregistered* - SSDPSRV
*Deregistered* - TapiSrv
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TPHDEXLGSVC
*Deregistered* - TpKmpSVC
*Deregistered* - TrkWks
*Deregistered* - upnphost
*Deregistered* - usnjsvc
*Deregistered* - W32Time
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - WMPNetworkSvc
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC
.
Indhold af mappen 'Planlagte Opgaver'

2009-04-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programmer\Apple Software Update\SoftwareUpdate.exe [2008-07-30 13:34]

2009-03-27 c:\windows\Tasks\Norton AntiVirus - Skan Denne computer - Mads.job
- c:\progra~1\NORTON~1\Navw32.exe [2005-07-19 08:39]

2009-04-09 c:\windows\Tasks\PMTask.job
- c:\progra~1\ThinkPad\UTILIT~1\PWMIDTSK.EXE [2005-01-21 01:00]

2009-04-09 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-03-10 22:18]
.
.
------- Yderligere scanning -------
.
uStart Page = about:blank
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Send til &Bluetooth - c:\programmer\IBM\Bluetooth Software\btsendto_ie_ctx.htm
Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\programmer\CoreFTP\pftpns.dll
DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} - hxxps://www.portalbank.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.30.cab
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-09 21:18:27
Windows 5.1.2600 Service Pack 3 NTFS

scanner skjulte processer ...

scanner skjulte autostarter ...

scanner skjulte filer ...

scanning gennemført med succes
skjulte filer: 0

**************************************************************************
.
--------------------- DLLs startet under kørende Processer ---------------------

- - - - - - - > 'winlogon.exe'(1064)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\tphklock.dll
.
------------------------ Andre kørende processer ------------------------
.
c:\windows\system32\ibmpmsvc.exe
c:\windows\system32\ati2evxx.exe
c:\programmer\Intel\Wireless\Bin\EvtEng.exe
c:\programmer\Intel\Wireless\Bin\S24EvMon.exe
c:\windows\system32\ati2evxx.exe
c:\programmer\Fælles filer\Symantec Shared\CCSETMGR.EXE
c:\programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
c:\programmer\Fælles filer\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\programmer\Fælles filer\Symantec Shared\CCEVTMGR.EXE
c:\programmer\Lavasoft\Ad-Aware\aawservice.exe
c:\programmer\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
c:\programmer\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
c:\progra~1\ThinkPad\CONNEC~1\QCTRAY.EXE
c:\windows\system32\rundll32.exe
c:\programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\programmer\Fælles filer\Autodesk Shared\Service\AdskScSrv.exe
c:\programmer\IBM\Bluetooth Software\bin\btwdins.exe
c:\programmer\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
c:\programmer\Norton AntiVirus\IWP\NPFMNTOR.EXE
c:\programmer\IBM\Bluetooth Software\BTTray.exe
c:\program files\Digital Line Detect\DLG.exe
c:\programmer\Microsoft Office\Office12\ONENOTEM.EXE
c:\progra~1\IBM\BLUETO~1\BTSTAC~1.EXE
c:\windows\system32\QCONSVC.EXE
c:\programmer\OpenOffice.org 2.4\program\soffice.exe
c:\programmer\Intel\Wireless\Bin\RegSrvc.exe
c:\programmer\OpenOffice.org 2.4\program\soffice.bin
c:\programmer\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\system32\TPHDEXLG.exe
c:\windows\system32\TpKmpSvc.exe
c:\programmer\Windows Media Player\wmpnetwk.exe
c:\programmer\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
c:\programmer\PC Connectivity Solution\ServiceLayer.exe
c:\programmer\Skype\Plugin Manager\skypePM.exe
c:\programmer\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\programmer\PC Connectivity Solution\Transports\NclIrSrv.exe
c:\programmer\PC Connectivity Solution\Transports\NclRSSrv.exe
c:\programmer\PC Connectivity Solution\Transports\NclBCBTSrv.exe
c:\programmer\Windows Live\Messenger\usnsvc.exe
c:\programmer\Messenger\msmsgs.exe
c:\programmer\Norton AntiVirus\NAVAPSVC.EXE
c:\programmer\Symantec\LiveUpdate\AUPDATE.EXE
c:\progra~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
c:\programmer\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\programmer\Symantec\LiveUpdate\LuCallbackProxy.exe
c:\programmer\Symantec\LiveUpdate\LuCallbackProxy.exe
.
**************************************************************************
.
Gennemført tid: 2009-04-09 21:23:27 - maskinen blev genstartet
ComboFix-quarantined-files.txt 2009-04-09 19:23:21

Pre-Kørsel: 9.844.158.464 byte ledig
Post-Kørsel: 10,699,886,592 byte ledig

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
331 --- E O F --- 2009-04-08 07:34:40

Synes godt om

fromsej Praktikant

10. april 2009 - 06:31 #5

Combofix fik da vist fjernet en del.

Afinstaller uTorrent i Tilføj/Fjern programmer.
Drop fildeling >> http://spywarefri.dk/forum/topic.asp?TOPIC_ID=40284

Er problemet løst?

Synes godt om

acement Nybegynder

10. april 2009 - 13:37 #6

Jeps problemet er løst. Takker. og god hjemmeside du har, har kigget lidt rundt og der er mange nyttige ting...

Synes godt om

fromsej Praktikant

10. april 2009 - 15:54 #7

Det lyder godt.
Nu er det nu ikke min side, jeg er "kun" co-admin på den, men tak for roserne alligevel. :-)

Synes godt om

Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Følg dette spørgsmål

Opret Preview

Flere spørgsmål fra Virus kategorien

Titel	Indlæg	Oprettet	Seneste aktivitet
trusler Af gerhardpet i Virus	4	26/01/202410:02	27/01/202408:32
Kan ikke fjerne virus Af mik28 i Virus	16	09/01/202416:37	10/01/202419:59
virusscanning Af JetteD i Virus	2	10/11/202312:55	10/11/202316:36
Google ser ud til at være malware, lyder advarsel på alle vore mobiler! Af vbr i Virus	9	30/10/202312:12	15/12/202310:17
Jeg får en fejl på Enhedssikkerhed Af pouls i Virus	8	04/06/202321:28	05/06/202316:28

Se alle spørgsmål i kategorien Opret spørgsmål

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester

Alle kategorier på Eksperten

Seneste artiklerRSS