Browser breakdown efter trojan og smart security
Hej!Jeg har et problem efter min kone aktiverede et link på en eller anden slanke hjemmeside. I panik fik hun accepteret en installation af et program "smart security" som jo også straks proklamerede at PC´en var befængt med virus...
Efter en tur med AVG + malware bytes var det så væk igen, men browseren (explorer, safari, chrome er alle forsøgt)er offline. Uanset hvordan jeg forsøger at få forbindelse kommer den med samme meddelelse "der kan ikke skabes forbindelse til denne side... Ping kører, mail kan sendes hentes, netradio og netværksafspilning kører fint, så det er bare browseren der er f*cked.
Er der en venlig sjæl der vil kigge min HiJackThis log igennem og se om der er noget at gøre, eller om jeg skal geninstallere??
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:31:54, on 14-10-2010
Platform: Unknown Windows (WinNT 6.01.3504)
MSIE: Internet Explorer v8.00 (8.00.7600.16671)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskhost.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Software602\Print2PDF\Print2PDF.exe
C:\Program Files\Verbatim\MediaShare Desktop Applications\HipServAgent\HipServAgent.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\Birkim\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.birkim.dk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:25502
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: 98.142.243.64 google.com
O1 - Hosts: 98.142.243.64 google.com.au
O1 - Hosts: 98.142.243.64 www.google.com.au
O1 - Hosts: 98.142.243.64 google.be
O1 - Hosts: 98.142.243.64 www.google.be
O1 - Hosts: 98.142.243.64 google.com.br
O1 - Hosts: 98.142.243.64 www.google.com.br
O1 - Hosts: 98.142.243.64 google.ca
O1 - Hosts: 98.142.243.64 www.google.ca
O1 - Hosts: 98.142.243.64 google.ch
O1 - Hosts: 98.142.243.64 www.google.ch
O1 - Hosts: 98.142.243.64 google.de
O1 - Hosts: 98.142.243.64 www.google.de
O1 - Hosts: 98.142.243.64 google.dk
O1 - Hosts: 98.142.243.64 www.google.dk
O1 - Hosts: 98.142.243.64 google.fr
O1 - Hosts: 98.142.243.64 www.google.fr
O1 - Hosts: 98.142.243.64 google.ie
O1 - Hosts: 98.142.243.64 www.google.ie
O1 - Hosts: 98.142.243.64 google.it
O1 - Hosts: 98.142.243.64 www.google.it
O1 - Hosts: 98.142.243.64 google.co.jp
O1 - Hosts: 98.142.243.64 www.google.co.jp
O1 - Hosts: 98.142.243.64 google.nl
O1 - Hosts: 98.142.243.64 www.google.nl
O1 - Hosts: 98.142.243.64 google.no
O1 - Hosts: 98.142.243.64 www.google.no
O1 - Hosts: 98.142.243.64 google.co.nz
O1 - Hosts: 98.142.243.64 www.google.co.nz
O1 - Hosts: 98.142.243.64 google.pl
O1 - Hosts: 98.142.243.64 www.google.pl
O1 - Hosts: 98.142.243.64 google.se
O1 - Hosts: 98.142.243.64 www.google.se
O1 - Hosts: 98.142.243.64 google.co.uk
O1 - Hosts: 98.142.243.64 google.co.za
O1 - Hosts: 98.142.243.64 www.google.co.za
O1 - Hosts: 98.142.243.64 www.bing.com
O1 - Hosts: 98.142.243.64 search.yahoo.com
O1 - Hosts: 98.142.243.64 www.search.yahoo.com
O1 - Hosts: 98.142.243.64 uk.search.yahoo.com
O1 - Hosts: 98.142.243.64 ca.search.yahoo.com
O1 - Hosts: 98.142.243.64 de.search.yahoo.com
O1 - Hosts: 98.142.243.64 fr.search.yahoo.com
O1 - Hosts: 98.142.243.64 au.search.yahoo.com
O1 - Hosts: 98.142.243.64 www.youtube.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Print2PDF Print Monitor] "C:\Program Files\Software602\Print2PDF\Print2PDF.exe" /server
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HipServ Agent] C:\Program Files\Verbatim\MediaShare Desktop Applications\HipServAgent\HipServAgent.exe
O4 - HKLM\..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O4 - Startup: Dropbox.lnk = Birkim\AppData\Roaming\Dropbox\bin\Dropbox.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_89D8574934B26AC4.dll/cmsidewiki.html
O9 - Extra button: Print2PDF - {5B7027AD-AA6D-40df-8F56-9560F277D2A5} - C:\Program Files\Software602\Print2PDF\Print602.dll
O9 - Extra 'Tools' menuitem: Print2PDF - {5B7027AD-AA6D-40df-8F56-9560F277D2A5} - C:\Program Files\Software602\Print2PDF\Print602.dll
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O15 - Trusted Zone: http://*.danid.dk
O15 - Trusted Zone: http://*.danid.dk (HKLM)
O16 - DPF: {07D09E9E-C667-45DD-B035-217BC2A61A3B} (ActiveX sikkerhedssoftware Control) - https://www.portalbank.dk/package/sdc/external/activex/ActiveXSikkerhedssoftware-prod-1.30.cab
O16 - DPF: {11818680-FCF6-11D0-9808-0800092A4865} (Adobe Form Control) - https://www.herning.dk/codebase/FormCtl.cab
O16 - DPF: {32C3FEAE-0877-4767-8C20-62A5829A0945} (FBootloaderAX) - http://static.ak.facebook.com/fbplugin/win32/axfbootloader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG10\avgwdsvc.exe
O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
--
End of file - 8299 bytes
