Trojansk Hest

Hvad siger programmet? hvad hedder er navnet på virussen?

YFFER PYFFER !!!!

Der er >50 Uønskede elementer - foreløbig - ifølge din Log!!!

Hvad har du haft gang i ???

I første omgang ->
Så gennemfør proceduren herfra -> http://www.eksperten.dk/artikler/1123

Hvad anvender du af sikkerheds programmer?

(Jeg ka' tihvertifald ikke se nogle ? *S*) Ikke engang 'snusfornuft' ...

Hej Eksperter

Jeg har kørt en en skanning som anvist http://www.eksperten.dk/artikler/1123.

Jeg kan dog ikke få combofix til at starte og jeg kan ikke finde det sted hvor man kan få log ud fra superantispyware.

Men her er min Hijacklog

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:19:22, on 13-06-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\inf\svchostc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programmer\Generic\USB Card Reader Driver v2.0\Disk_Monitor.exe
C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe
C:\Programmer\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Winamp\winampa.exe
C:\WINDOWS\system32\BoBoTurbo\BoBoTurbo.exe
C:\WINDOWS\soni.exe
C:\WINDOWS\system32\usmsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MSNMES~1\msnmsgr.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\RavNT.exe
C:\WINDOWS\System32\360up.exe
C:\WINDOWS\qqshel.exe
C:\Programmer\QvodPlayer\QvodTerminal.exe
C:\WINDOWS\usnsvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\iexplore.exe
C:\WINDOWS\system32\explorer.exe
C:\WINDOWS\system32\HBmhly.exe
C:\Programmer\Internet Explorer\iexplore.exe
C:\Documents and Settings\Pandaball\Skrivebord\Hijack\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.dk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: apzhbtde.dll - {2D698451-2015-6358-9871-2015987452D2} - C:\WINDOWS\system32\apzhbtde.dll
O2 - BHO: yxcschlp.dll - {35671234-7890-ABCD-CDEF-567801237653} - C:\WINDOWS\system32\yxcschlp.dll
O2 - BHO: Info cache - {385AB8C6-FB22-4D17-8834-064E2BA0A6F0} - [SASInprocServer32] (file missing)
O2 - BHO: (no name) - {398C9B84-4EF7-47B5-9862-DE29543B3C42} - C:\Program Files\Internet Explorer\PLUGINS\Nt_Sys32.Sys (file missing)
O2 - BHO: mpmydapi.dll - {4629FF4F-ACDB-5C90-A098-FACB3456A264} - C:\WINDOWS\system32\mpmydapi.dll
O2 - BHO: zycbdime.dll - {4A698102-5904-AFD0-20DF-CD1A65829CA4} - C:\WINDOWS\system32\zycbdime.dll
O2 - BHO: tysqakol.dll - {4D098345-6785-1098-5413-678067AE03D4} - C:\WINDOWS\system32\tysqakol.dll
O2 - BHO: zptlcsys.dll - {50940F85-F015-14F1-A05F-F69858AC6D05} - C:\WINDOWS\system32\zptlcsys.dll
O2 - BHO: mpwdeapi.dll - {55694105-5108-9405-3695-954187462155} - C:\WINDOWS\system32\mpwdeapi.dll
O2 - BHO: oohxdbyt.dll - {5B1AEF69-DDAE-FDAD-DCAB-698F026ABDB5} - C:\WINDOWS\system32\oohxdbyt.dll
O2 - BHO: fgfsakuy.dll - {5E091341-6715-2098-51F0-178367AE53E5} - C:\WINDOWS\system32\fgfsakuy.dll
O2 - BHO: apsgejba.dll - {5FD45A54-9875-698F-E56E-65102358FDF5} - C:\WINDOWS\system32\apsgejba.dll
O2 - BHO: Usmsho - {6014EABC-B61A-4F07-A32B-440EAE835DF9} - C:\WINDOWS\System32\usmsho.dll
O2 - BHO: pqzfajke.dll - {60A345CD-ABCD-EFAB-CDEF-ABCD01020306} - C:\WINDOWS\system32\pqzfajke.dll
O2 - BHO: zxmscwin.dll - {6A041F13-A111-12A3-B0CF-F99818AA68A6} - C:\WINDOWS\system32\zxmscwin.dll
O2 - BHO: ypcqfhlp.dll - {70AF1289-F140-A140-D012-C1458759FC07} - C:\WINDOWS\system32\ypcqfhlp.dll
O2 - BHO: yzztimsn.dll - {9490415F-65F8-B5C5-D8BA-9405FB120549} - C:\WINDOWS\system32\yzztimsn.dll
O2 - BHO: zyzxjime.dll - {AA59145F-315D-BC23-AC1F-145DF81A34AA} - C:\WINDOWS\system32\zyzxjime.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Disk Monitor] C:\Programmer\Generic\USB Card Reader Driver v2.0\Disk_Monitor.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Programmer\Fælles filer\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [VirtualCloneDrive] "C:\Programmer\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmer\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Programmer\Winamp\winampa.exe
O4 - HKLM\..\Run: [ytewcxzsw] C:\WINDOWS\ytewcxzsw.exe
O4 - HKLM\..\Run: [qvrqvigm] C:\WINDOWS\vqimjrvb.exe
O4 - HKLM\..\Run: [juejwcx] C:\WINDOWS\juejwcx.exe
O4 - HKLM\..\Run: [rewkljlpw] C:\WINDOWS\rewkljlpw.exe
O4 - HKLM\..\Run: [nmhgtce] C:\WINDOWS\nmhgtce.exe
O4 - HKLM\..\Run: [isndctio] C:\WINDOWS\isndctio.exe
O4 - HKLM\..\Run: [isscs32] C:\WINDOWS\isscs32.exe
O4 - HKLM\..\Run: [fmcbbqi] C:\WINDOWS\fmcbbqi.exe
O4 - HKLM\..\Run: [fewqickd] C:\WINDOWS\fewqickd.exe
O4 - HKLM\..\Run: [RavMonS] C:\WINDOWS\soni.exe
O4 - HKLM\..\Run: [360] C:\WINDOWS\360safe.exe
O4 - HKLM\..\Run: [usmsvc] C:\WINDOWS\system32\usmsvc.exe
O4 - HKLM\..\Run: [WinSysW] C:\WINDOWS\608769L.exe
O4 - HKLM\..\Run: [HBmhly] "C:\WINDOWS\system32\HBmhly.exe" -r
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKLM\..\Policies\Explorer\Run: [MSDEG32] LYLoader.exe
O4 - HKLM\..\Policies\Explorer\Run: [MSDWG32] LYLoadbr.exe
O4 - HKLM\..\Policies\Explorer\Run: [MSDCG32    ] LYLeador.exe
O4 - HKLM\..\Policies\Explorer\Run: [MSDOG32] LYLoador.exe
O4 - HKLM\..\Policies\Explorer\Run: [MSDSG32] LYLoadar.exe
O4 - HKLM\..\Policies\Explorer\Run: [MSDMG32] LYLoadmr.exe
O4 - HKLM\..\Policies\Explorer\Run: [MSDHG32] LYLoadhr.exe
O4 - HKLM\..\Policies\Explorer\Run: [MSDQG32] LYLoadqr.exe
O4 - HKLM\..\Policies\Explorer\Run: [kcomc] kcomc32.exe
O4 - HKLM\..\Policies\Explorer\Run: [nyuserinit] C:\WINDOWS\system32\inf\svchostc.exe C:\WINDOWS\twftadfia16_080608.dll tanlt88
O4 - HKCU\..\Policies\Explorer\Run: [mscheck] rundll32.exe "C:\WINDOWS\system32\wicheck080502.dll" myjkl
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: ֪ʶ¿â - {06926B30-424E-4f1c-8EE3-543CD96573DC} - http://blank.la/?h (file missing)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmer\Messenger\msmsgs.exe
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {EC0978ED-24E3-403C-AB7A-060E388553E6} (BoBoControl Class) - http://www.17bobo.com/Software/BoBo_ActiveX_V3.ocx
O20 - AppInit_DLLs: gfcfg.dll,drthte.dll,yjrfe.dll,fnhwe.dll,fydfgk.dll,fyrgtr.dll,fghdghu.dll,jmkcgt.dll,hfther.dll,segtrgh.dll,frntrn.dll,qrhhb.dll,drghszd.dll,fngn.dll,gnfctt.dll,xgnfn.dll,xfgnhcgfm.dll,serger.dll,bnxnb.dll,fxgnfx.dll,jzijj.dll,xfgnfx.dll,serghjm.dll,thsddh.dll,xbcvxb.dll,zfdzb.dll,xdndn.dll,xdfntt.dll,hgfhk.dll,dnteh.dll,xfng.dll,njritc.dll,chmfcmh.dll,jwlah.dll,gmnait.dll,hfjg.dll,thurh.dll,mgmgmm.dll,oqrthc.dll,rhdhj.dll,jyjlt.dll,ijatnaw.dll,sehhter.dll,fhjfg.dll,zdbdb.dll,ydgn.dll,dbfb.dll,fjnbv.dll,thrtgth.dll,setrhes.dll,cdxbfxdb.dll,xfgnxfn.dll,gjkhj.dll,xdhdg.dll,rhs.dll,mrjhtjd.dll,zdbfbd.dll,fjyjy.dll,fxnfnh.dll,bjrvm.dll,ektvm.dll,rdthr.dll,rgfjj.dll,dscef.dll,crugd.dll,lariytrz.dll,hjaiq.dll,kduy.dll,hkfgh.dll,awef.dll,dfhsh.dll,ethsh.dll,stehs.dll,sthth.dll,wfhyt.dll,rgghjj.dll,ghjkdr.dll,hujfgt.dll,,yzztimsn.dll,ytewcxzsw.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Programmer\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: BoBoTurbo - ???????????? - C:\WINDOWS\system32\BoBoTurbo\BoBoTurbo.exe
O23 - Service: ÍøÂç·þÎñ (Network Services) - Unknown owner - C:\WINDOWS\MayaBaby\MayaBabyMain.exe
O23 - Service: Qvod Terminal - Shenzhen QVOD Technology Co.,Ltd - C:\Programmer\QvodPlayer\QvodTerminal.exe
O23 - Service: Remote Procedure Call Locator (RpcUsnsvc) - Unknown owner - C:\WINDOWS\usnsvc.exe
O23 - Service: Windows Accounts Driver (windows_0) - Unknown owner - C:\WINDOWS\system32\TempAB.exe (file missing)

--
End of file - 8828 bytes

Jeg vil sige/skrive -> DET ER EN OMMER !!!

Med SÅ meget 'snaks' på er det tvivlsomt om PC'en overhovedet kommer til at køre ordentligt igen!!!

Der er kun ~FEM af linierne i Loggen som er LEGALE (=ikke 'snavs' !)

En XP uden så meget som et antivirusprogram, det er spild af både din og vores tid at prøve at rense, guderne må vide hvad der ligger af keyloggere, trojanere og rootkits, som vi ikke kan se, og derfor ikke kan hjælpe med at fjerne.
Du har sansynligvis heller ikke install de >100 efterfølgende opdateringer fra WindowsUpdate EFTER M$ ServicePack2 (som PC'en nok er 'født' med...)

---------

http://www.eksperten.dk/artikler/1104

Du har/havde heller ikke nogle sikkerhedsprogrammer ifølge loggen - SUK!!!
http://www.spywareinfo.dk/manualer/sikkerhedspakke.htm