Underlig Ting

Download "Malwarebytes' Anti-Malware" her: http://www.malwarebytes.org/mbam.php
Installer programmet, start det, lav "fuld systemscanning" under fanebladet "skanner".
Bagefter klik på "vis resultater", tryk på "Fjern det valgte" og send loggen herind.

Hent http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis.
Kør HijackThis, klik på scan, kopier loggens tekst og smidt den herind.

Hej Levich
Nu har jeg kørt programmet Mailwarebytes
Den har fjernrt mappen svhoster tilbage er
så bare den der ligger i prefecht mappen der hedder
SVHOSTER.EXE-10C0AE54.pf
syntes du også jeg skal slette den ?
her er logfilen

Malwarebytes' Anti-Malware 1.27
Database version: 1132
Windows 5.1.2600 Service Pack 3

09-09-2008 20:33:57
mbam-log-2008-09-09 (20-33-57).txt

Skan type: Hurtig skanning
Objekter skannet: 47241
Tid tilbagelagt: 1 minute(s), 42 second(s)

Inficerede Hukommelses Processer: 1
Inficerede Hukommelses Moduler: 0
Inficerede Registeringsdatabase Nøgler: 0
Inficerede Registeringsdatabase Værdier: 10
Inficerede Registeringsdatabase Filer: 0
Inficerede Mapper: 0
Inficerede Filer: 5

Inficerede Hukommelses Processer:
C:\WINDOWS\svhoster.exe (Trojan.Agent) -> Failed to unload process.

Inficerede Hukommelses Moduler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Nøgler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Værdier:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\updatewin (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\updatewin (Trojan.FakeAlert.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\net64 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\UpdateWin (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\UpdateWin (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\netsv32 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\UpdateWin (Worm.Sdbot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\UpdateWin (Worm.Sdbot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OLE\UpdateWin (Worm.Sdbot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Control\Lsa\UpdateWin (Worm.Sdbot) -> Quarantined and deleted successfully.

Inficerede Registeringsdatabase Filer:
(Ingen mistænkelige filer fundet)

Inficerede Mapper:
(Ingen mistænkelige filer fundet)

Inficerede Filer:
C:\WINDOWS\system32\acctresx.exe (Trojan.FakeAlert.H) -> Delete on reboot.
C:\WINDOWS\WinLockDll.dll (Malware.Tool) -> Quarantined and deleted successfully.
C:\WINDOWS\svhoster.exe (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\sv.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\uid.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Lav venligst en log med hijackthis-programmet.

Hej Levich
Det gør jeg i morgen, skal tidligt op så tidligt
i seng.

(Har du sovet ud *G* ?)