Hvordan stopper jeg winword.exe

Følg vejledningen her:
Gå ind her og hent Hijackthis.
http://www.spywarefri.dk/vaerktoj.htm
Kør Hijackthis, scan, save log og kopier logfilen herind, så kigger vi på den. Lad være med at slette noget selv med Hijackthis, det kan skade mere end det gavner.

Der findes en virus der har det navn. Det er selvfølgelig ikke den ægte Microsoft word fil, men en virus der skjuler sig et andet sted i filsystemet.

Her er en vejledning til sygate:http://www.spywarefri.dk/forum/topic.asp?TOPIC_ID=9706

Du har sat en blokering for winword.

men tonnybrandt har ret at det sikkert er den virus*S*

erhmmm Winword er da Microsoft Office Word.

Her er loggen.
Logfile of HijackThis v1.99.1
Scan saved at 14:53:42, on 03-03-2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Programmer\Sygate\SPF\smc.exe
F:\WINDOWS\Explorer.EXE
F:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
F:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
F:\WINDOWS\system32\brsvc01a.exe
F:\WINDOWS\system32\brss01a.exe
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\system32\Brmfrmps.exe
F:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
F:\Programmer\Norton AntiVirus\navapsvc.exe
F:\WINDOWS\SOUNDMAN.EXE
F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\ALCWZRD.EXE
F:\WINDOWS\ALCMTR.EXE
F:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
F:\Programmer\Microsoft IntelliType Pro\type32.exe
F:\Programmer\ScanSoft\PaperPort\pptd40nt.exe
F:\Programmer\Brother\ControlCenter2\brctrcen.exe
F:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
F:\WINDOWS\system32\svchost.exe
F:\Programmer\Java\j2re1.4.2_06\bin\jusched.exe
F:\Programmer\Messenger\msmsgs.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe
F:\Programmer\Adobe\Acrobat 6.0\Distillr\acrotray.exe
F:\Programmer\Brother\Brmfcmon\BrMfcWnd.exe
F:\Programmer\Norton AntiVirus\SAVScan.exe
F:\Programmer\Internet Explorer\iexplore.exe
F:\Documents and Settings\Per\Lokale indstillinger\Temporary Internet Files\Content.IE5\MFMB6TE3\hijackthis[1].exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.fjendsnet.dk/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Programmer\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Ipswitch.WsftpBrowserHelper - {601ED020-FB6C-11D3-87D8-0050DA59922B} - F:\Programmer\Ipswitch\WS_FTP Home\wsbho2k0.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - F:\Programmer\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - F:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - F:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - F:\Programmer\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Genvej til egenskabsside for High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ccApp] "F:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [type32] "F:\Programmer\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "F:\Programmer\Fælles filer\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [PaperPort PTD] F:\Programmer\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] F:\Programmer\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [ControlCenter2.0] F:\Programmer\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "F:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [SmcService] F:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [SunJavaUpdateSched] F:\Programmer\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] F:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [MSMSGS] "F:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SSS6_Suite] "F:\Programmer\Steganos Security Suite 6\sss.exe" /booting
O4 - HKCU\..\Run: [SSS6_SAFE] "F:\Programmer\Steganos Security Suite 6\safe.exe" /booting
O4 - HKCU\..\Run: [SSS6_SPM] "F:\Programmer\Steganos Security Suite 6\spm.exe" /booting
O4 - HKCU\..\Run: [NBJ] "F:\Programmer\Ahead\Nero BackItUp\NBJ.exe"
O4 - Global Startup: Acrobat Assistant.lnk = F:\Programmer\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Status Monitor.lnk = F:\Programmer\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://F:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Programmer\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Programmer\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: Opslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {402EE96E-2CE8-482D-ADA5-CECEEA07E16D} (TurnTool Scene) - http://www.turntool.com/ViewerInstall.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1104619898953
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - F:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - F:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - F:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - F:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - F:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: Norton AntiVirus Auto Protect (navapsvc) - Symantec Corporation - F:\Programmer\Norton AntiVirus\navapsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - F:\Programmer\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - F:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - F:\Programmer\Sygate\SPF\smc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - F:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - F:\Programmer\Fælles filer\Symantec Shared\Security Center\SymWSC.exe

Loggen er faktisk ren, så min mistanke holdt ikke stik.

Dog kan jeg da lige vise hvad jeg baserede den på:
http://forums.thatcomputerguy.us/lofiversion/index.php/t10717.html
I den ER der en virus der er navngivet winword.exe

perj -> Prøv at finde det sted i sygate, hvor de ting, som du har blokeret står. Der optræder winword helt sikkert også. Den fjerner du  og/eller giver fuld adgang til nettet, så skulle det virke

Arlet-> Der var sat en blokering for word !. Tak for vejledningen som jeg burde have set på www.spywarefri.dk som jeg ofte besøger.
tonnybrandt-> Tak for tippet og tjek af loggen. Hvis du vil dele point med arlet, må du lige acceptere.

Ellers tak. Men jeg skød "forbi", så jeg springer over point. Men tak for tilbuddet. *s*