Avatar billede wimmer Nybegynder
03. april 2005 - 21:05 Der er 8 kommentarer og
1 løsning

Hijack This Log..igen..

Har lige taget en HJT log, da jeg er sikker på at jeg er inficeret.. Jeg har mistanke til Winzip.exe, USBhardware3 og msdn. De popper hele tiden op åp min firewall... Min com kører også til tider vanvittigt langsomt.. håber der er nogen der gider og kigge den igennem..

Logfile of HijackThis v1.99.1
Scan saved at 20:59:11, on 03-04-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Documents and Settings\Sebastian\Skrivebord\iclogin1.2.exe
C:\WINDOWS\System32\USBhardware326.exe
C:\WINDOWS\System32\winzip.exe
C:\WINDOWS\System32\msdn.exe
C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Valve\Steam\Steam.exe
C:\Programmer\Logitech\SetPoint\KEM.exe
C:\Programmer\Logitech\SetPoint\KHALMNPR.EXE
C:\Programmer\SpywareGuard\sgmain.exe
C:\Programmer\SpywareGuard\sgbhp.exe
c:\kds.exe
C:\DOCUME~1\SEBAST~1\LOKALE~1\Temp\IXP000.TMP\tib.exe
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\wpabaln.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Sebastian\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tweak.dk/forum
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Programmer\SpywareGuard\dlprotect.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IC Login] "C:\Documents and Settings\Sebastian\Skrivebord\iclogin1.2.exe"
O4 - HKLM\..\Run: [USB Hardware326 Monitoring] USBhardware326.exe
O4 - HKLM\..\Run: [winzip] winzip.exe
O4 - HKLM\..\Run: [msnmsgr] "C:\DOCUME~1\SEBAST~1\LOKALE~1\Temp\IXP000.TMP\tib.exe"
O4 - HKLM\..\Run: [Machine Debug Manager] msdn.exe
O4 - HKLM\..\RunServices: [USB Hardware326 Monitoring] USBhardware326.exe
O4 - HKLM\..\RunServices: [winzip] winzip.exe
O4 - HKLM\..\RunServices: [Machine Debug Manager] msdn.exe
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\System32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\SEBAST~1\LOKALE~1\Temp\IXP000.TMP\"
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] C:\Programmer\Valve\Steam\\Steam.exe -silent
O4 - HKCU\..\Run: [winzip] winzip.exe
O4 - HKCU\..\Run: [Machine Debug Manager] msdn.exe
O4 - HKCU\..\Run: [USB Hardware326 Monitoring] USBhardware326.exe
O4 - HKCU\..\Run: [Msn] "C:\DOCUME~1\SEBAST~1\LOKALE~1\Temp\IXP000.TMP\tib.exe"
O4 - Startup: SpywareGuard.lnk = C:\Programmer\SpywareGuard\sgmain.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programmer\Logitech\SetPoint\KEM.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: McAfee Firewall - Unknown owner - C:\Programmer\McAfee\McAfee Firewall\CPD.EXE" /SERVICE (file missing)
Avatar billede kalp Novice
03. april 2005 - 21:07 #1
ser på den
Avatar billede kalp Novice
03. april 2005 - 21:13 #2
Download og gem denne scanner på skrivebordet. (Vi skal bruge den senere)
http://www.spywareinfo.dk/download/mwav.exe

Genstart i Fejlsikret tilstand ved at taste F8 under opstart. Kør HijackThis, scan og sæt et flueben ud for disse linjer - luk øvrige programvinduer. Dobbelttjeck alt kom med!. Klik herefter "Fix checked" i hijackthis:

O3 - Toolbar: (no name) - {ACB1E670-3217-45C4-A021-6B829A8A27CB} - (no file)
O4 - HKLM\..\Run: [USB Hardware326 Monitoring] USBhardware326.exe
O4 - HKLM\..\Run: [winzip] winzip.exe
O4 - HKLM\..\Run: [msnmsgr] "C:\DOCUME~1\SEBAST~1\LOKALE~1\Temp\IXP000.TMP\tib.exe"
O4 - HKLM\..\Run: [Machine Debug Manager] msdn.exe
O4 - HKLM\..\RunServices: [USB Hardware326 Monitoring] USBhardware326.exe
O4 - HKLM\..\RunServices: [winzip] winzip.exe
O4 - HKLM\..\RunServices: [winzip] winzip.exe
O4 - HKLM\..\RunOnce: [wextract_cleanup0] rundll32.exe C:\WINDOWS\System32\advpack.dll,DelNodeRunDLL32 "C:\DOCUME~1\SEBAST~1\LOKALE~1\Temp\IXP000.TMP\"
O4 - HKCU\..\Run: [winzip] winzip.exe
O4 - HKCU\..\Run: [Machine Debug Manager] msdn.exe
O4 - HKCU\..\Run: [USB Hardware326 Monitoring] USBhardware326.exe
O4 - HKCU\..\Run: [Msn] "C:\DOCUME~1\SEBAST~1\LOKALE~1\Temp\IXP000.TMP\tib.exe"
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm

Hvis du ikke kender denne fil skal du fixe den.. ligner dog noget du selv har hentet
O4 - HKLM\..\Run: [IC Login] "C:\Documents and Settings\Sebastian\Skrivebord\iclogin1.2.exe"

Åbn Stifinder, klik på Funktioner=>Mappeindstillinger=>Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler".
Fjern flueben ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

Find og slet (Kig godt efter!!.. Det du ikke finder har hijackthis nok fjernet!)

Filerne

C:\WINDOWS\System32\USBhardware326.exe 90% på det er snavs
C:\WINDOWS\System32\winzip.exe 100% på det er snavs
C:\WINDOWS\System32\msdn.exe 100% på det er snavs
c:\kds.exe 99% på det er snavs
C:\DOCUME~1\SEBAST~1\LOKALE~1\Temp\IXP000.TMP\tib.exe 100%

Denne som du måske selv kender.. så skal den ikke slettes.
C:\Documents and Settings\Sebastian\Skrivebord\iclogin1.2.exe  0%

Gå herefter i Start -> Programmer -> Tilbehør -> Systemværktøjer -> Diskoprydning og slet temp-filer, temporary internet files og papirkurv.

Klik på mwav.exe som du hentede, programmet pakker sig selv ud og starter.
Sæt flueben i følgende:
Memory, Startup folders, drive, Registry, System folders og Services.
Sæt prik i følgende:
All local drives og Scan all files

Genstart normalt og kopir en ny log herind så jeg kan se om vi fik ramt på det hele eller om noget er blevet overset:)
Avatar billede wimmer Nybegynder
03. april 2005 - 23:02 #3
Ny HJT Log..

Logfile of HijackThis v1.99.1
Scan saved at 23:01:29, on 03-04-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Documents and Settings\Sebastian\Skrivebord\iclogin1.2.exe
C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Logitech\SetPoint\KEM.exe
C:\Programmer\Logitech\SetPoint\KHALMNPR.EXE
C:\Programmer\SpywareGuard\sgmain.exe
C:\Programmer\SpywareGuard\sgbhp.exe
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Documents and Settings\Sebastian\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tweak.dk/forum
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Programmer\SpywareGuard\dlprotect.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IC Login] "C:\Documents and Settings\Sebastian\Skrivebord\iclogin1.2.exe"
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] C:\Programmer\Valve\Steam\\Steam.exe -silent
O4 - HKCU\..\Run: [winzip] winzip.exe
O4 - HKCU\..\Run: [Machine Debug Manager] msdn.exe
O4 - HKCU\..\Run: [USB Hardware326 Monitoring] USBhardware326.exe
O4 - HKCU\..\Run: [Msn] "C:\DOCUME~1\SEBAST~1\LOKALE~1\Temp\IXP000.TMP\tib.exe"
O4 - Startup: SpywareGuard.lnk = C:\Programmer\SpywareGuard\sgmain.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programmer\Logitech\SetPoint\KEM.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: McAfee Firewall - Unknown owner - C:\Programmer\McAfee\McAfee Firewall\CPD.EXE" /SERVICE (file missing)
Avatar billede kalp Novice
03. april 2005 - 23:16 #4
Disse skal du fixe igen i fejlsikret tilstand

O4 - HKCU\..\Run: [winzip] winzip.exe
O4 - HKCU\..\Run: [Machine Debug Manager] msdn.exe
O4 - HKCU\..\Run: [USB Hardware326 Monitoring] USBhardware326.exe
O4 - HKCU\..\Run: [Msn] "C:\DOCUME~1\SEBAST~1\LOKALE~1\Temp\IXP000.TMP\tib.exe"

genstart normalt og ny log

den her kender du ?
C:\Documents and Settings\Sebastian\Skrivebord\iclogin1.2.exe
Avatar billede wimmer Nybegynder
03. april 2005 - 23:24 #5
Jep.. jeg kender iclogin
Avatar billede wimmer Nybegynder
03. april 2005 - 23:30 #6
NY log...

Logfile of HijackThis v1.99.1
Scan saved at 23:30:16, on 03-04-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe
C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Documents and Settings\Sebastian\Skrivebord\iclogin1.2.exe
C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe
C:\Programmer\MSN Messenger\MsnMsgr.Exe
C:\Programmer\Valve\Steam\Steam.exe
C:\Programmer\Logitech\SetPoint\KEM.exe
C:\Programmer\Logitech\SetPoint\KHALMNPR.EXE
C:\Programmer\SpywareGuard\sgmain.exe
C:\Programmer\SpywareGuard\sgbhp.exe
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Programmer\McAfee\McAfee Firewall\CPD.EXE
C:\Documents and Settings\Sebastian\Skrivebord\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.tweak.dk/forum
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Programmer\SpywareGuard\dlprotect.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [McAfee Guardian] "C:\Programmer\McAfee\McAfee Shared Components\Guardian\CMGrdian.exe" /SU
O4 - HKLM\..\Run: [ATIPTA] C:\Programmer\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IC Login] "C:\Documents and Settings\Sebastian\Skrivebord\iclogin1.2.exe"
O4 - HKCU\..\Run: [McAfee.InstantUpdate.Monitor] "C:\Programmer\McAfee\McAfee Shared Components\Instant Updater\RuLaunch.exe" /STARTMONITOR
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programmer\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] C:\Programmer\Valve\Steam\\Steam.exe -silent
O4 - Startup: SpywareGuard.lnk = C:\Programmer\SpywareGuard\sgmain.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Programmer\Logitech\SetPoint\KEM.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: McAfee Firewall - Unknown owner - C:\Programmer\McAfee\McAfee Firewall\CPD.EXE" /SERVICE (file missing)
Avatar billede kalp Novice
03. april 2005 - 23:59 #7
så er loggen ren:)
Avatar billede wimmer Nybegynder
04. april 2005 - 00:06 #8
lækkert.. takker for hjælpen
Avatar billede kalp Novice
04. april 2005 - 00:09 #9
selv tak:))
Avatar billede Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Loading billede Opret Preview
Kategori
IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester