HJT Log

Jeg kigger lige på den ..

Tak

1. Hent Ewido herfra (14 dages version af plus-versionen - herefter bliver den "neddroslet" til gratis-versionen):

http://shop.element5.com/product.html?productid=531168&affiliateid=200010704 (klik på demo download)

Installer og kør Ewido - opdater programmet (men lad være med at scanne).

2. Hent Cleanup herfra:

http://www.stevengould.org/downloads/cleanup/CleanUp40.exe

Dobbeltklik på Cleanup40.exe og installer programmet (følg instruktionen undervejs). Programmet skal IKKE køres endnu.

3. Hent herefter denne lille fil (du skal ikke køre programmet endnu):

http://www.spywareedge.net/nf/nailfix.exe
http://www.noidea.us/easyfile/file.php?download=20050711214630636 (alternativ)

4. Genstart herefter i Fejlsikret tilstand.

5. Dobbeltklik på nailfix.exe, som du hentede før. Klik "Next" (der skal være flueben i "Run Nailfix") - og klik "Finish".

6. Kør en fuld scanning med Ewido. Programmet laver en lille log, som du skal kopiere herind i dit næste svar.

7. Kør HijackThis, scan og sæt et flueben ud for følgende linier - luk øvrige programvinduer - klik "Fix checked":

F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O4 - HKLM\..\Run: [qkvdaot] c:\windows\system32\vmqueyj.exe r
O4 - HKCU\..\Run: [WeatherWatcher] C:\Programmer\Weather Watcher\ww.exe
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O23 - Service: System Startup Service  (SvcProc) - Unknown owner - c:\windows\SvcProc.exe

8. Kør programmet CleanUp40. Klik på knappen "Options" og fjern fluebenet i "Cookies". Klik herefter på "CleanUp". Luk programmet når det er færdigt.

9. Åbn en stifinder og slet denne mappe:
C:\Programmer\Weather Watcher

samt disse filer, hvis de stadig er der:
c:\windows\system32\vmqueyj.exe
c:\windows\SvcProc.exe

10. Genstart i Normal tilstand og læg en frisk HijackThis log herind sammen med log'en fra Ewido.

Venom86>

Du har helt glemt at opdatere din pc...
Kan se på dine tidligere spørgsmål at SP2 har været inde før???

Ja, jeg er ikke så flittig til at updatere windows og sådan.
Her er reslutatet forresten:



---------------------------------------------------------
ewido security suite - Scan report
---------------------------------------------------------

+ Created on:            21:22:49, 09-08-2005
+ Report-Checksum:        393BED5F

+ Scan result:

    HKLM\SOFTWARE\Classes\CLSID\{3684B1D1-C737-AA3A-00B8-83FE7FF3C058} -> Spyware.CoolWebSearch : Cleaned with backup
    HKLM\SOFTWARE\Classes\CLSID\{3BA763E9-3208-0CD2-31BD-37026D1B8537} -> Spyware.CoolWebSearch : Cleaned with backup
    HKLM\SOFTWARE\Classes\CLSID\{99B1E639-DCA2-2C21-013F-DEF4B5729CA9} -> Spyware.CoolWebSearch : Cleaned with backup
    [860] c:\windows\system32\qnpiau.exe -> Adware.BetterInternet : Cleaned with backup
    C:\Documents and Settings\PC\Cookies\pc@abetterinternet[1].txt -> Spyware.Cookie.Abetterinternet : Cleaned with backup
    C:\Documents and Settings\PC\Cookies\pc@ad.yieldmanager[2].txt -> Spyware.Cookie.Yieldmanager : Cleaned with backup
    C:\Documents and Settings\PC\Cookies\pc@ads.pointroll[1].txt -> Spyware.Cookie.Pointroll : Cleaned with backup
    C:\Documents and Settings\PC\Cookies\pc@burstnet[1].txt -> Spyware.Cookie.Burstnet : Cleaned with backup
    C:\Documents and Settings\PC\Cookies\pc@image.masterstats[1].txt -> Spyware.Cookie.Masterstats : Cleaned with backup
    C:\Documents and Settings\PC\Cookies\pc@serving-sys[2].txt -> Spyware.Cookie.Serving-sys : Cleaned with backup
    C:\WINDOWS\AuroraHandler.dll_tobedeleted -> Adware.BetterInternet : Cleaned with backup
    C:\WINDOWS\KB837001.log:jgaxem -> Trojan.Agent.bi : Cleaned with backup
    C:\WINDOWS\KB840987.log:tgtkgp -> Spyware.Ipyn : Cleaned with backup
    C:\WINDOWS\ocgen.log:lldon -> TrojanDownloader.Agent.lz : Cleaned with backup
    C:\WINDOWS\ovysaglsnoe.exe -> Adware.BetterInternet : Cleaned with backup
    C:\WINDOWS\ptyjahv.exe -> Adware.BetterInternet : Cleaned with backup
    C:\WINDOWS\pxrws.dat:zvucvc -> TrojanDownloader.Agent.bc : Cleaned with backup
    C:\WINDOWS\På fisketur.bmp:dqzvia -> TrojanDownloader.Agent.bc : Cleaned with backup
    C:\WINDOWS\Q309521.log:weghjx -> TrojanDownloader.Agent.lz : Cleaned with backup
    C:\WINDOWS\Q313450.log:gfzmli -> Trojan.Agent.bi : Cleaned with backup
    C:\WINDOWS\Q329834.log:qkjlz -> TrojanDownloader.Agent.bc : Cleaned with backup
    C:\WINDOWS\Q329834.log:qkjlzs -> TrojanDownloader.Agent.bc : Cleaned with backup
    C:\WINDOWS\Q817606.log:ikcqtc -> Trojan.Agent.bi : Cleaned with backup
    C:\WINDOWS\REGLOCS.OLD:fcjnvn -> Trojan.Agent.bi : Cleaned with backup
    C:\WINDOWS\Rhododendron.bmp:ydctpx -> Spyware.Ipyn : Cleaned with backup
    C:\WINDOWS\ST6UNST.000:mfiwh -> Spyware.Ipyn : Cleaned with backup
    C:\WINDOWS\ST6UNST.000:npenlc -> TrojanDownloader.Agent.bq : Cleaned with backup
    C:\WINDOWS\Sti_Trace.log:hueex -> TrojanDownloader.Agent.lz : Cleaned with backup
    C:\WINDOWS\Sti_Trace.log:hueext -> TrojanDownloader.Agent.lz : Cleaned with backup
    C:\WINDOWS\SYMEVENT.LOG:egajkh -> Spyware.SearchPage : Cleaned with backup
    C:\WINDOWS\system.ini:rgdfil -> Trojan.Agent.bi : Cleaned with backup
    C:\WINDOWS\system32:soaa.dll -> TrojanDownloader.Small.azk : Cleaned with backup
    C:\WINDOWS\system32\qnpiau.exe -> Adware.BetterInternet : Cleaned with backup
    C:\WINDOWS\system32\shell32.exe -> Spyware.WinAD : Cleaned with backup
    C:\WINDOWS\trqbe.txt:swhxt -> Spyware.Ipyn : Cleaned with backup
    C:\WINDOWS\trqbe.txt:swhxtf -> Trojan.Agent.bi : Cleaned with backup
    C:\WINDOWS\tsc.ini:jynskv -> TrojanDownloader.Agent.oq : Cleaned with backup
    C:\WINDOWS\tsc.ini:linwpr -> Spyware.SearchPage : Cleaned with backup
    C:\WINDOWS\wiaservc.log:vkavv -> TrojanDownloader.Agent.oq : Cleaned with backup
    C:\WINDOWS\wininit.ini:vhfkwl -> Spyware.SearchPage : Cleaned with backup
    C:\WINDOWS\winnt.bmp:xcubxf -> Spyware.SearchPage : Cleaned with backup
    C:\WINDOWS\Zapotec.bmp:ctkden -> Trojan.Agent.bi : Cleaned with backup
    C:\WINDOWS\_default.pif:ezqzvr -> Spyware.SearchPage : Cleaned with backup
    C:\WINDOWS\_default.pif:iqbzmh -> Spyware.SearchPage : Cleaned with backup
    C:\WINDOWS\_default.pif:jmwxnl -> TrojanDownloader.Agent.bq : Cleaned with backup
    C:\WINDOWS\_default.pif:jwfkmg -> TrojanDownloader.Agent.bq : Cleaned with backup
    C:\WINDOWS\_default.pif:ppugzv -> Spyware.SearchPage : Cleaned with backup
    C:\WINDOWS\_default.pif:uuvizx -> Spyware.Ipyn : Cleaned with backup


::Report End






OG Ny log:


Logfile of HijackThis v1.99.1
Scan saved at 23:08:49, on 09-08-2005
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
C:\Programmer\Fælles filer\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\CyberLink\PowerDVD\PDVDServ.exe
C:\Programmer\Lavasoft\Ad-aware 6\Ad-watch.exe
C:\Programmer\Java\jre1.5.0_01\bin\jusched.exe
C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe
C:\Programmer\Fælles filer\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe
C:\Programmer\Sony Ericsson\Mobile\audevicemgr.exe
C:\Programmer\Microsoft Office\Office\1030\OLFSNT40.EXE
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CONNMN~1.EXE
C:\Programmer\Intuwave\Shared\mRouterRunTime\mRouterRuntime.exe
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\CapMan.exe
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\ElogErr.exe
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\BROADC~1.EXE
C:\PROGRA~1\SONYER~1\Mobile\CONNEC~1\SCRFS.exe
C:\PROGRA~1\SONYER~1\Mobile\MOBILE~1\EPMWOR~1.EXE
C:\WINDOWS\System32\ZoneLabs\isafe.exe
C:\Programmer\ewido\security suite\ewidoctrl.exe
C:\Programmer\ewido\security suite\ewidoguard.exe
C:\Programmer\Norton AntiVirus\navapsvc.exe
C:\Programmer\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
C:\Programmer\Fælles filer\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\PC\Dokumenter\Emil\Programs\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmer\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Programmer\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programmer\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [Ad-watch] "C:\Programmer\Lavasoft\Ad-aware 6\Ad-watch.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_01\bin\jusched.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programmer\Fælles filer\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Programmer\Fælles filer\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Zone Labs Client] C:\Programmer\Zone Labs\ZoneAlarm\zlclient.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Phone Connection Monitor.lnk = ?
O4 - Global Startup: Symantec WinFax Starter Port.lnk = C:\Programmer\Microsoft Office\Office\1030\OLFSNT40.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_01\bin\npjpi150_01.dll
O12 - Plugin for .spop: C:\Programmer\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1122215802780
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cab
O23 - Service: CA ISafe (CAISafe) - Computer Associates International, Inc. - C:\WINDOWS\System32\ZoneLabs\isafe.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\ccSetMgr.exe
O23 - Service: ewido security suite control - ewido networks - C:\Programmer\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Programmer\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Programmer\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Programmer\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Programmer\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FLLESF~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programmer\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programmer\Fælles filer\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Jamen dog. Ren i første forsøg. Der plejer ellers at skulle et par rensninger til før de infektioner forsvinder.

Efter sådan en tur er det altid en god ide og rydde op i systemgendannelses filerne. Deaktiver systemgendannelse  - genstart din computer - aktiver systemgendannelse.
(klik start | indstillinger | kontrolpanel | system, fanebladet systemgendannelse)

Og som John gør opmærksom på er maskinen ikke opdateret. Nu vil være et fint tidspunkt at lægge Servicepack 2 på.

Ja okay. takker

Velbekomme og takker for point :)