Angribes med mellerum af samme trojanske heste

Start med at smide en: http://www.trendsecure.com/portal/en-US/threat_analytics/HiJackThis.exe log og afvent en af eksperterne (Jeg er ikke en af dem)

Og lad være med at oprette det samme spørgsmål flere gange:
http://www.eksperten.dk/spm/830138
http://www.eksperten.dk/spm/830137

Hej,
Her er Logfile:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:25:36, on 03-05-2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00

(7.00.6000.16643)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\brsvc01a.exe
C:\Windows\system32\brss01a.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common

Files\Maxtor\Schedule2\schedul2.exe
C:\Program Files\Adobe\Photoshop Elements

5.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Common Files\Apple\Mobile

Device

Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky

Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\crypserv.exe
C:\Acer\Empowering

Technology\eDataSecurity\eDSService.exe
C:\Esko\bg_prog_egsis_v010\bin_ix86

\egsissrv.exe
C:\Acer\Empowering

Technology\eLock\Service\eLockServ.exe
C:\Acer\Empowering Technology\eNet\eNet

Service.exe
C:\Program Files\Common

Files\LightScribe\LSSrvc.exe
C:\Acer\Mobility Center\MobilityService.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared

Files\RichVideo.exe
C:\Windows\system32\routing.exe
C:\Program Files\Enigma Software

Group\SpyHunter\SHService.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Common

Files\Acronis\Fomatik\TrueImageTryStartServi

ce.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Acer\Empowering

Technology\eRecovery\eRecoveryService.exe
C:\Windows\system32\WUDFHost.exe
C:\Acer\Empowering

Technology\eSettings\Service\capuserv.exe
C:\Acer\Empowering

Technology\ePower\ePowerSvc.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows

Defender\MSASCui.exe
C:\Acer\Empowering

Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Microsoft Office\Office12

\GrooveMonitor.exe
C:\Program

Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Windows\System32\rundll32.exe
C:\Windows\BR040286.exe
C:\Program Files\Java\jre1.6.0_05

\bin\jusched.exe
C:\Program

Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Kaspersky Lab\Kaspersky

Internet Security 7.0\avp.exe
C:\Program Files\Launch

Manager\LManager.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Media

Player\wmpnscfg.exe
C:\Program Files\WIDCOMM\Bluetooth

Software\BTTray.exe
C:\Program Files\Brother\ControlCenter3

\brccMCtl.exe
C:\Program

Files\TEXTware\HotKey\TWALINK.EXE
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Program

Files\Brother\Brmfcmon\BrMfimon.exe
C:\Program Files\Windows Media

Player\wmpnetwk.exe
C:\Acer\Empowering

Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering

Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering

Technology\ACER.EMPOWERING.FRAMEWORK.S

UPERVISOR.EXE
C:\Acer\Empowering

Technology\eRecovery\ERAGENT.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Skype\Plugin

Manager\skypePM.exe
C:\Windows\system32\afinding.exe
C:\Windows\system32\wserving.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Spyware Doctor\sdloader.exe
C:\Program Files\Spyware

Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Spyware

Doctor\pctsTray.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Adobe\Acrobat 7.0

\Acrobat\Acrobat.exe
C:\Users\Ove\AppData\Local\Temp\Adobelm_C

leanup.0001
C:\Program Files\Common Files\Adobe Systems

Shared\Service\Adobelmsvc.exe
C:\Users\Ove\AppData\Local\Temp\Adobelm_C

leanup.0001
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\perfs.exe
C:\Program Files\Trend

Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet

Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet

Explorer\Main,Start Page =

http://www.google.dk/
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Page_URL =

http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet

Explorer\Main,Start Page =

http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet

Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet

Explorer\Search,CustomizeSearch =
R1 -

HKCU\Software\Microsoft\Windows\CurrentVer

sion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet

Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-

4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}

- C:\Program Files\Adobe\Acrobat 7.0

\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) -

{22BF413B-C6D2-4d91-82A9-A0F997BA588C}

- C:\Program Files\Skype\Toolbars\Internet

Explorer\SkypeIEPlugin.dll
O2 - BHO: Groove GFS Browser Helper -

{72853161-30C5-4D22-B7F9-0BBC1D38A37E}

- C:\PROGRA~1\MICROS~2\Office12

\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-

D6F0-462C-B6EB-D4DAF1D92D43} -

C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: ShowBarObj Class - {83A2F9B1-

01A2-4AA5-87D1-45B6B8505E96} -

C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Adobe PDF Conversion Toolbar

Helper - {AE7CD045-E861-484f-8273-

0445EE161910} - C:\Program

Files\Adobe\Acrobat 7.0

\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Acer eDataSecurity

Management - {5CBE3B7C-1E47-477e-A7DD-

396DB0476E29} - C:\Windows\system32

\eDStoolbar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-

4125-9FA8-0819E2EAAC93} - C:\Program

Files\Adobe\Acrobat 7.0

\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-

11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %

ProgramFiles%\Windows

Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE

C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon]

RUNDLL32.EXE C:\Windows\system32

\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter]

RUNDLL32.EXE C:\Windows\system32

\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [eDataSecurity Loader]

C:\Acer\Empowering

Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [WarReg_PopUp]

C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [GrooveMonitor]

"C:\Program Files\Microsoft Office\Office12

\GrooveMonitor.exe"
O4 - HKLM\..\Run: [PaperPort PTD]

C:\Program

Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program

Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [BisonInst0402]

C:\Windows\BR040286.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched]

"C:\Program Files\Java\jre1.6.0_05

\bin\jusched.exe"
O4 - HKLM\..\Run: [BrMfcWnd] C:\Program

Files\Brother\Brmfcmon\BrMfcWnd.exe

/AUTORUN
O4 - HKLM\..\Run: [ControlCenter3]

C:\Program Files\Brother\ControlCenter3

\brctrcen.exe /autorun
O4 - HKLM\..\Run: [AVP] "C:\Program

Files\Kaspersky Lab\Kaspersky Internet

Security 7.0\avp.exe"
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1

\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [QuickTime Task]

"C:\Program Files\QuickTime\QTTask.exe" -

atboottime
O4 - HKLM\..\Run: [Acer Tour Reminder]

C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [Windows Mobile Device

Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program

Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program

Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program

Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe]

C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM Startup]

"C:\Program Files\Common

Files\InstallShield\UpdateService\ISUSPM.exe"

-startup
O4 - HKCU\..\Run: [Skype] "C:\Program

Files\Skype\Phone\Skype.exe" /nosplash

/minimized
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program

Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %

ProgramFiles%\Windows Sidebar\Sidebar.exe

/detectMem (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-19\..\Run:

[WindowsWelcomeCenter] rundll32.exe

oobefldr.dll,ShowWelcomeCenter (User 'LOKAL

TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %

ProgramFiles%\Windows Sidebar\Sidebar.exe

/detectMem (User 'NETVÆRKSTJENESTE')
O4 - Global Startup: Adobe Acrobat

Hurtigstart.lnk = ?
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Empowering Technology

Launcher.lnk = ?
O4 - Global Startup: HotKey.lnk = C:\Program

Files\TEXTware\HotKey\TWALINK.EXE
O9 - Extra button: (no name) - {08B0E5C0-

4FCB-11CF-AAA5-00401C608501} -

C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console

- {08B0E5C0-4FCB-11CF-AAA5-

00401C608501} - C:\Program

Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Web Anti-Virus-statistik -

{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}

- C:\Program Files\Kaspersky Lab\Kaspersky

Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Send til OneNote -

{2670000A-7350-4f3c-8081-5663EE0C6C49} -

C:\PROGRA~1\MICROS~2\Office12

\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end til

OneNote - {2670000A-7350-4f3c-8081-

5663EE0C6C49} - C:\PROGRA~1\MICROS~2

\Office12\ONBttnIE.dll
O9 - Extra button:

@C:\Windows\WindowsMobile\INetRepl.dll,-

222 - {2EAF5BB1-070F-11D3-9307-

00C04FAE2D4F} -

C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-

070F-11D3-9307-00C04FAE2D4F} -

C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem:

@C:\Windows\WindowsMobile\INetRepl.dll,-

223 - {2EAF5BB2-070F-11D3-9307-

00C04FAE2D4F} -

C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Skype - {77BF5300-1474-

4EC7-9980-D32B190E9B07} - C:\Program

Files\Skype\Toolbars\Internet

Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-

18CC-41C8-B9BE-3C9C571A8263} -

C:\PROGRA~1\MICROS~2\Office12

\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 -

{CCA281CA-C863-46ef-9331-5C8D4460577F}

- C:\Program Files\WIDCOMM\Bluetooth

Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650

- {CCA281CA-C863-46ef-9331-

5C8D4460577F} - C:\Program

Files\WIDCOMM\Bluetooth

Software\btsendto_ie.htm
O13 - Gopher Prefix:
O16 - DPF: {07D09E9E-C667-45DD-B035-

217BC2A61A3B} (ActiveX sikkerhedssoftware

Control) -

https://www.basisbank.dk/package/sdc/exter

nal/activex/ActiveXSikkerhedssoftware-prod-

1.20.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-

fa1d4f56a2ab} - C:\Program Files\Yahoo!

\Common\yinsthelper.dll
O16 - DPF: {74F5614A-8A8C-43B4-8CC2-

4B4EFAF4A6C5} (TSCCInstall Class) -

http://www.techsmith.com/codec/tsccinst.ca

b
O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-

44A219113CDD} (SABScanProcesses Class) -

http://www.superadblocker.com/activex/sabs

px.cab
O16 - DPF: {B7D07999-2ADB-4AEB-997E-

F61CB7B2E2CD} (TSEasyInstallX Control) -

http://www.trendsecure.com/easy_install/_ac

tivex/da/TSEasyInstallX.CAB
O16 - DPF: {D216644A-C6DB-49D9-BBCF-

D38FE7991BF2} (Util Class) -

https://udstedelse.certifikat.tdc.dk/csp/authe

nticode/tdccsp-0506.exe
O16 - DPF: {D8575CE3-3432-4540-88A9-

85A1325D3375} (e-Safekey) -

https://netbank.danskebank.dk/html/activex/e

-Safekey/DB/e-Safekey.cab
O18 - Protocol: grooveLocalGWS -

{88FED34C-F0CA-4636-A375-3CB6248B04CD}

- C:\PROGRA~1\MICROS~2\Office12

\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-

9B40-4DFF-9458-1830C7DD7F5D} -

C:\PROGRA~1\COMMON~1

\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1

\KASPER~2.0\r3hook.dll C:\PROGRA~1

\KASPER~1\KASPER~2.0\adialhk.dll

eNetHook.dll
O23 - Service: Acronis Scheduler2 Service

(AcrSch2Svc) - Acronis - C:\Program

Files\Common Files\Maxtor\Schedule2

\schedul2.exe
O23 - Service: Adobe LM Service - Adobe

Systems - C:\Program Files\Common

Files\Adobe Systems

Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor V5

(AdobeActiveFileMonitor5.0) - Unknown owner

- C:\Program Files\Adobe\Photoshop Elements

5.0\PhotoshopElementsFileAgent.exe
O23 - Service: AFinding Service (AFinding) -

Unknown owner - C:\Windows\system32

\afinding.exe
O23 - Service: Apple Mobile Device - Apple,

Inc. - C:\Program Files\Common

Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security

7.0 (AVP) - Kaspersky Lab - C:\Program

Files\Kaspersky Lab\Kaspersky Internet

Security 7.0\avp.exe
O23 - Service: Bonjour-tjeneste (Bonjour

Service) - Apple Inc. - C:\Program

Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl

Service) - brother Industries Ltd -

C:\Windows\system32\brsvc01a.exe
O23 - Service: Crypkey License - CrypKey

(Canada) Ltd. - C:\Windows\SYSTEM32

\crypserv.exe
O23 - Service: eDSService.exe (eDataSecurity

Service) - HiTRSUT - C:\Acer\Empowering

Technology\eDataSecurity\eDSService.exe
O23 - Service: EG Station Information Service

- Esko-Graphics -

C:\Esko\bg_prog_egsis_v010\bin_ix86

\egsissrv.exe
O23 - Service: eLock Service (eLockService) -

Acer Inc. - C:\Acer\Empowering

Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. -

C:\Acer\Empowering Technology\eNet\eNet

Service.exe
O23 - Service: eRecovery Service

(eRecoveryService) - Acer Inc. -

C:\Acer\Empowering

Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service

(eSettingsService) - Unknown owner -

C:\Acer\Empowering

Technology\eSettings\Service\capuserv.exe
O23 - Service: InstallDriver Table Manager

(IDriverT) - Macrovision Corporation -

C:\Program Files\Common

Files\InstallShield\Driver\11\Intel 32

\IDriverT.exe
O23 - Service: iPod-tjeneste (iPod Service) -

Apple Inc. - C:\Program

Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc

Labeling Service (LightScribeService) -

Hewlett-Packard Company - C:\Program

Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MobilityService - Unknown

owner - C:\Acer\Mobility

Center\MobilityService.exe
O23 - Service: perfmons Service (perfmons) -

Unknown owner - C:\Windows\system32

\perfs.exe
O23 - Service: Cyberlink RichVideo Service

(CRVS) (RichVideo) - Unknown owner -

C:\Program Files\CyberLink\Shared

Files\RichVideo.exe
O23 - Service: Routing Service (Routing) -

Unknown owner - C:\Windows\system32

\routing.exe
O23 - Service: PC Tools Auxiliary Service

(sdAuxService) - PC Tools - C:\Program

Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service

(sdCoreService) - PC Tools - C:\Program

Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SpyHunter3 Service - Enigma

Software Group, Inc. - C:\Program

Files\Enigma Software

Group\SpyHunter\SHService.exe
O23 - Service: Acronis Try And Decide Service

(TryAndDecideService) - Unknown owner -

C:\Program Files\Common

Files\Acronis\Fomatik\TrueImageTryStartServi

ce.exe
O23 - Service: @%SystemRoot%\System32

\TuneUpDefragService.exe,-1 (TuneUp.Defrag)

- TuneUp Software GmbH -

C:\Windows\System32

\TuneUpDefragService.exe
O23 - Service: ePower Service (WMIService) -

acer - C:\Acer\Empowering

Technology\ePower\ePowerSvc.exe
O23 - Service: WServing Service (WServing) -

Unknown owner - C:\Windows\system32

\wserving.exe
O23 - Service: XAudioService - Conexant

Systems, Inc. - C:\Windows\system32

\DRIVERS\xaudio.exe

--
End of file - 16200 bytes

Åben 1 spørgsmål af gangen ellers har folk svært ved at hjælpe.

Eller samme spørgsmål.

Hvordan lukker jeg et spørgsmål?

Ved at skrive noget og tsætte prik i svar og kende det som et svar.

(Jeg ser på den ved http://www.eksperten.dk/spm/830137 )

Denne tråd lukkes, da den fortsætter på: http://www.eksperten.dk/spm/830137

(Og så makér du lige dig selv i boxen til venstre og klasker [Accepter] ...)