Hijackthis log

øjeblik, så ser jeg på det.

adwaren hedder i øvrigt adware.look2me, og det er en dl fil i system32 mappen der tilsyneladende er roden til alt ondt.

O20 - Winlogon Notify: IPConfTSP - C:\WINDOWS\system32\jtn0075me.dll

da det er den fil som adaware ikke kan fjerne, og jeg ikke får lov at fjerne manuelt.

jeps, er klar over det.

<dstruct>: Bare det at se disse "programmer" i din opstart
O4 - HKLM\..\Run: [defender] c:\\defender23.exe
O4 - HKLM\..\Run: [keyboard] c:\\keyboard23.exe
O4 - HKLM\..\Run: [newname] c:\\newname23.exe
samt
O4 - HKCU\..\Run: [Meor] "C:\WINDOWS\ICROSO~1\msdtc.exe" -vt yazr
O4 - HKCU\..\Run: [Yor] C:\WINDOWS\?racle\d?dplay.exe
får lamperne til at blinke RØDT ... (Se placering/navn) ...er jo ikke helt normalt...

<levich> skal nok komme med en fin procedure/vejledning...

Læs alle punkterne inden du gør noget.

(1)
Deaktiver systemgendannelse, ved at Højreklikke på "Denne Computer" på skrivebordet -> egenskaber -> Systemgendannelse -> sæt flueben i "Deaktiver systemgendannelse" -> Klik OK.

(2)
Hent scannereren http://www.spywareinfo.dk/download/mwav.exe.

Hent Look2Me-Destroyer: http://www.atribune.org/ccount/click.php?id=7

(3)
Genstart computeren i fejlsikret tilstand (tryk F8 når Windows starter op), og fix følgende linjer med HijackThis:
R3 - URLSearchHook: (no name) - {CD5C4BEC-F52B-818A-037A-F93AF52F70B5} - C:\WINDOWS\system32\ueedk.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
O4 - HKLM\..\Run: [defender] c:\\defender23.exe
O4 - HKLM\..\Run: [keyboard] c:\\keyboard23.exe
O4 - HKLM\..\Run: [newname] c:\\newname23.exe
O4 - HKCU\..\Run: [Yor] C:\WINDOWS\?racle\d?dplay.exe
O20 - Winlogon Notify: IPConfTSP - C:\WINDOWS\system32\jtn0075me.dll

(4)
Åbn en tilfældig mappe, i menuen skal du klikke på Funktioner -> Mappeindstillinger -> Vis.
Fjern flueben ved "Skjul beskyttede operativsystemfiler" og ved "Skjul filtypenavne for kendte filtyper".
Sæt prik i "Vis skjulte filer og mapper".

søg efter og slet følgende fil(er):
C:\WINDOWS\system32\ueedk.dll
c:\defender23.exe
c:\keyboard23.exe
c:\newname23.exe
C:\WINDOWS\?racle\d?dplay.exe
C:\WINDOWS\system32\jtn0075me.dll

(5)
Start -> kør -> skriv "cleanmgr" -> Slet Temporary internet files, papirkurv og midlertidige filer. Gentag for alle dine drev.

(6)
Kør scanneren mwav.exe, og sæt flueben i følgende: Memory, Startup folders, drive, Registry, System folders og Services.
Sæt prik i følgende: All local drives og Scan all files. Tryk på Scan Clean.
Scanningen kan godt tage nogen tid.

(7)
Genstart computeren normalt.

(8)
Luk alle åbne programvinduer - inklusiv Internet Explorer.

Dobbeltklik på Look2Me-Destroyer, sæt et flueben i "Run this program as a task". Du får en meddelelse om, at Look2Me-Destroyer vil lukke og åbne efter 10 sekunder - klik på OK.

Når Look2Me-Destroyer genåbner - klik på "Scan for L2M" - dine ikoner forsvinder - klik "Remove L2M". Klik OK når du får meddelelsen "Done scanning".

Nu får du meddelelsen "Done removing infected files!. Programmet vil lukke din computer - klik OK. Nu skal du finde filen Look2Me-Destroyer.txt og kopiere indholdet herind, sammen med en frisk HijackThis log.

Hvis din firewall vil blokere Look2Me-Destroyers adgang til nettet, så skal du lade programmet få adgang.

Hvis du får en runtime error 339, så skal du hente MSWINSCK.OCX her:
http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX
...og placere den i mappen C:\Windows\System32 .

(9)
Når vi er helt færdige, så husk at aktiver systemgendannelse igen.

Så er jeg tilbage, det var jo en ordentlig omgang :)

her er look2me loggen:

Look2Me-Destroyer V1.0.12

Scanning for infected files.....
Scan started at 28-05-2006 17:10:06

Infected! C:\WINDOWS\system32\e8202ifmg82a2.dll
Infected! C:\WINDOWS\system32\chcfg32.dll
Infected! C:\WINDOWS\system32\d40mled11h0.dll
Infected! C:\WINDOWS\system32\iSsrecst.dll

Attempting to delete infected files...

Attempting to delete: C:\WINDOWS\system32\e8202ifmg82a2.dll
C:\WINDOWS\system32\e8202ifmg82a2.dll could not be deleted!

Attempting to delete: C:\WINDOWS\system32\chcfg32.dll
C:\WINDOWS\system32\chcfg32.dll could not be deleted!

Attempting to delete: C:\WINDOWS\system32\d40mled11h0.dll
C:\WINDOWS\system32\d40mled11h0.dll could not be deleted!

Attempting to delete: C:\WINDOWS\system32\iSsrecst.dll
C:\WINDOWS\system32\iSsrecst.dll could not be deleted!

Making registry repairs.

Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\MS-DOS Emulation

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{98FF682B-3F60-4901-B443-754D3F2C9A07}"
HKCR\Clsid\{98FF682B-3F60-4901-B443-754D3F2C9A07}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{722A27EE-0E4D-4061-A0B1-055290543334}"
HKCR\Clsid\{722A27EE-0E4D-4061-A0B1-055290543334}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{8598ED42-EB33-4252-95B1-317F241DAB05}"
HKCR\Clsid\{8598ED42-EB33-4252-95B1-317F241DAB05}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{0440A3FB-C3DF-4DA6-A52D-B0364878B324}"
HKCR\Clsid\{0440A3FB-C3DF-4DA6-A52D-B0364878B324}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{D87960A6-3B36-414B-A239-7F6370544FD3}"
HKCR\Clsid\{D87960A6-3B36-414B-A239-7F6370544FD3}

Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{1E8F6A5F-9FD5-485B-8287-CA9DE4411410}"
HKCR\Clsid\{1E8F6A5F-9FD5-485B-8287-CA9DE4411410}

Restoring Windows certificates.

Replaced hosts file with default windows hosts file


Restoring SeDebugPrivilege for Administratorer - Succeeded


og her er den nye hijackthis fil:
Logfile of HijackThis v1.99.1
Scan saved at 17:15:28, on 28-05-2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Trend Micro\Internet Security\pccguide.exe
C:\Programmer\Trend Micro\Internet Security\PCClient.exe
C:\Programmer\Trend Micro\Internet Security\TMOAgent.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Programmer\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Programmer\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmer\DAEMON Tools\daemon.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\QuickTime\qttask.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Programmer\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programmer\Trend Micro\Internet Security\Tmntsrv.exe
C:\Programmer\Trend Micro\Internet Security\tmproxy.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Programmer\Trend Micro\Internet Security\PccPfw.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Programmer\Firefox\firefox.exe
C:\Documents and Settings\dstruc t\Skrivebord\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O4 - HKLM\..\Run: [pccguide.exe] "C:\Programmer\Trend Micro\Internet Security\pccguide.exe"
O4 - HKLM\..\Run: [PCClient.exe] "C:\Programmer\Trend Micro\Internet Security\PCClient.exe"
O4 - HKLM\..\Run: [TM Outbreak Agent] "C:\Programmer\Trend Micro\Internet Security\TMOAgent.exe" /run
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTSysVol] C:\Programmer\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [CTDVDDet] C:\Programmer\Creative\SBAudigy2\DVDAudio\CTDVDDet.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AsioReg] REGSVR32.EXE /S CTASIO.DLL
O4 - HKLM\..\Run: [SBDrvDet] C:\Programmer\Creative\SB Drive Det\SBDrvDet.exe /r
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Programmer\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [iTunesHelper] "D:\Programmer\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "d:\programmer\steam\steam.exe" -silent
O8 - Extra context menu item: &Clean Traces - D:\Programmer\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - D:\Programmer\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - D:\Programmer\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Absolute Poker - {EFFF8D47-D060-4108-B761-E8EC86622E56} - C:\Documents and Settings\All Users\Menuen Start\Programmer\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker - {EFFF8D47-D060-4108-B761-E8EC86622E56} - C:\Documents and Settings\All Users\Menuen Start\Programmer\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmer\Fælles filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - D:\Programmer\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Trend Micro Personal Firewall (PccPfw) - Trend Micro Incorporated. - C:\Programmer\Trend Micro\Internet Security\PccPfw.exe
O23 - Service: Trend NT Realtime Service (Tmntsrv) - Trend Micro Incorporated. - C:\Programmer\Trend Micro\Internet Security\Tmntsrv.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Incorporated. - C:\Programmer\Trend Micro\Internet Security\tmproxy.exe

Umiddelbart virker det som om det havde en god effekt :)

Det ser ud som det skal.

dstruct-> Tjek lige at disse filer er væk:

Attempting to delete: C:\WINDOWS\system32\e8202ifmg82a2.dll
C:\WINDOWS\system32\e8202ifmg82a2.dll could not be deleted!

Attempting to delete: C:\WINDOWS\system32\chcfg32.dll
C:\WINDOWS\system32\chcfg32.dll could not be deleted!

Attempting to delete: C:\WINDOWS\system32\d40mled11h0.dll
C:\WINDOWS\system32\d40mled11h0.dll could not be deleted!

Attempting to delete: C:\WINDOWS\system32\iSsrecst.dll
C:\WINDOWS\system32\iSsrecst.dll could not be deleted!

Thnx Levich, du har reddet mig fra timevis af bøvl :)

og de filer var væk på trods af programmets kommentarer.