Win32/Cryptor

Du får lige 'talen' ->

Hent og instalér CCleaner http://www.ccleaner.com/ + http://www.spywarefri.dk/manualer/manual-for-installation-og-brug-af-ccleaner/
Under installationen får du tilbudt [Yahoo Toolbar]. Du kan sige ja eller *NEJ* til den.
Lad programmet foretage en oprydning...

--------

Hent Malwarebytes Anti-Malware herfra:
http://www.besttechie.net/tools/mbam-setup.exe
Eller herfra ->
http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html

Installer programmet - når det er gjort skal du lade programmet opdatere sig. Herefter åbner et vindue, hvor du skal flytte prikken til "Kør et fuldstændigt systemscan" - klik på Skan Knappen - lad programmet arbejde. Når det er færdig (det tager lidt tid afhængig af hvor meget du har på computeren).
Derefter - Tryk på "Vis resultater" knappen efter scanningen - og herefter tryk på "Fjern det valgte" - nu åbnes log'en og du skal gemme den et sted, hvor du kan finde den igen.
Kopier indholdet herind sammen med en frisk log fra HiJackThis...

...og her er omtalte HiJackThis ->
http://www.spywareinfo.dk/index.htm#/manualer/hijackthis.htm

Bemærk at HiJackThis.exe programmet skal gemmes i en dertil oprettet mappe og IKKE køres direkte fra nettet...

PS: Brug denne version af HJT -> http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe

Sidder på min bærbare nu, da det er min stationære der har fået virus...

Har brugt ccleaner og malware... men min avg finder stadig 82 infections med win32/cryptor... kan godt være jeg har brugt malware og ccleaner forkert...

er det sikekrt at gå på nettet på den stationære?

Jeg kan godt sende en log med hijack, men som sagt er jeg bange for at være på nettet.

Jeg SKAL se omtalte Logs fra Malwarebytes + HiJackThis... i nævnte rækkefølge...

(Skal ikke se log fra CCleaner...)

prøver at gøre det som du har skrevet...

PS: DU skal ikke lægge som [svar] - det er 'forbeholdt' den/dem der kommer med svaret/løsningen...

http://www.eksperten.dk/faq

ok tak :) er ny her!

Jeg er igang med at scanne med malware... har gjort som du har bekrevet med manualen til ccleaner.

Skal jeg lave en hijack log nu eller efter min scanning med malware?

(er på stationære, den med virus)

...Logs fra Malwarebytes + HiJackThis... i nævnte rækkefølge...

Hvordan ved jeg hvor logfilen fra malware ender? spørger den om hvor jeg vil gemme den?

Start Malwarebytes programmet - Fanen LOGs - læs højt fra skærmen *S* ...

Malwarebytes' Anti-Malware 1.39
Database version: 2519
Windows 5.1.2600 Service Pack 3

28-07-2009 18:03:21
mbam-log-2009-07-28 (18-03-21).txt

Skan type: Fuldstændig skanning (C:\|D:\|E:\|)
Objekter skannet: 183788
Tid tilbagelagt: 27 minute(s), 19 second(s)

Inficerede Hukommelses Processer: 0
Inficerede Hukommelses Moduler: 1
Inficerede Registeringsdatabase Nøgler: 5
Inficerede Registeringsdatabase Værdier: 0
Inficerede Registeringsdatabase Filer: 0
Inficerede Mapper: 0
Inficerede Filer: 2

Inficerede Hukommelses Processer:
(Ingen mistænkelige filer fundet)

Inficerede Hukommelses Moduler:
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll (Trojan.TDSS) -> Delete on reboot.

Inficerede Registeringsdatabase Nøgler:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\rbadza (Trojan.Goldun) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\rbadza (Trojan.Goldun) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\rbadza (Trojan.Goldun) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Minimal\rbadza.sys (Trojan.Goldun) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot\Network\rbadza.sys (Trojan.Goldun) -> Quarantined and deleted successfully.

Inficerede Registeringsdatabase Værdier:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Filer:
(Ingen mistænkelige filer fundet)

Inficerede Mapper:
(Ingen mistænkelige filer fundet)

Inficerede Filer:
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rbadza.sys (Trojan.Goldun) -> Quarantined and deleted successfully.

og her  hijacklog:
Logfile of HijackThis v1.99.1
Scan saved at 18:04:31, on 28-07-2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Creative\Shared Files\CTAudSvc.exe
C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Programmer\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Programmer\AVG\AVG8\avgcsrvx.exe
C:\Programmer\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Programmer\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
E:\Programmer\iTunes\iTunesHelper.exe
C:\Programmer\Microsoft IntelliPoint\ipoint.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\Creative\MediaSource5\MtdAcqu.exe
C:\Programmer\Microsoft IntelliPoint\dpupdchk.exe
C:\Programmer\iPod\bin\iPodService.exe
C:\Programmer\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://viasatondemand.com/Series/Paradise-Hotel/Season-5.list
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Programmer\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Programmer\Intel Audio Studio\IntelAudioStudio.exe" BOOT
O4 - HKLM\..\Run: [VolPanel] "C:\Programmer\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Programmer\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Programmer\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [iTunesHelper] "E:\Programmer\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Programmer\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Programmer\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Steam] "e:\programmer\steam\steam.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MtdAcqu] "C:\Programmer\Creative\MediaSource5\MtdAcqu.exe" /s
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O10 - Unknown file in Winsock LSP: c:\programmer\bonjour\mdnsnsp.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmer\AVG\AVG8\avgpp.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FLLESF~1\Skype\Skype4COM.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Programmer\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Programmer\Creative\Shared Files\CTAudSvc.exe
O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Remote Procedure Call (RPC) Locator RpcLocatorNetDDEdsdm (RpcLocatorNetDDEdsdm) - Unknown owner - C:\WINDOWS\system32\ahuih.exe

PS: Brug denne version af HJT -> http://www.trendsecure.com/portal/en-US/_download/HiJackThis.exe

(Ellers rigtigt nok...)

fra den nye hijack:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:15:50, on 28-07-2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programmer\Creative\Shared Files\CTAudSvc.exe
C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Programmer\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Programmer\AVG\AVG8\avgcsrvx.exe
C:\Programmer\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Programmer\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
E:\Programmer\iTunes\iTunesHelper.exe
C:\Programmer\Microsoft IntelliPoint\ipoint.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Programmer\MSN Messenger\msnmsgr.exe
C:\Programmer\Creative\MediaSource5\MtdAcqu.exe
C:\Programmer\Microsoft IntelliPoint\dpupdchk.exe
C:\Programmer\iPod\bin\iPodService.exe
C:\Programmer\Mozilla Firefox\firefox.exe
D:\Install\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://viasatondemand.com/Series/Paradise-Hotel/Season-5.list
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Programmer\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [IntelAudioStudio] "C:\Programmer\Intel Audio Studio\IntelAudioStudio.exe" BOOT
O4 - HKLM\..\Run: [VolPanel] "C:\Programmer\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Programmer\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Programmer\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [iTunesHelper] "E:\Programmer\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Programmer\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Programmer\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Steam] "e:\programmer\steam\steam.exe" -silent
O4 - HKCU\..\Run: [msnmsgr] "C:\Programmer\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MtdAcqu] "C:\Programmer\Creative\MediaSource5\MtdAcqu.exe" /s
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETVÆRKSTJENESTE')
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Programmer\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FLLESF~1\Skype\Skype4COM.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Programmer\Fælles filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour-tjeneste (Bonjour Service) - Apple Inc. - C:\Programmer\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Programmer\Creative\Shared Files\CTAudSvc.exe
O23 - Service: iPod-tjeneste (iPod Service) - Apple Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 5460 bytes

ser det slemt ud? kommer det til at tage lang tid, for skal snart spise, og ville foretrække at fortsætte efter? hvis muligt.

ved ikke om det er smart at genstarte

(Spis du bare - "Uden Mad Og Drikke..." ...)

kan godt komme jævnligt til pc'en. Men ville blive glad, hvis du skrev en rapport om hvordan stillingen er :)

Mest efterfølgende 'oprydning' ->

Afinstaller (Hvis de er der?)

* Google Software Updater
* Apple Mobile Device
* iPod-tjeneste (iPod Service)
* Bonjour-tjeneste (Bonjour Service)

via
[Start][Indstilninger][Kontrolpanel][Tilføj/fjern programmer]

Genstart for at fuldføre afinstalationen...

---------------------------------------

Klik på Start->Kør skriv Services.msc (C:\Windows\System32\services.msc) og klik OK.
Find Tjenesten (Hvis den er der)
* Service: nProtect GameGuard Service (npggsvc)
stop den hvis den kører, højreklik på den og vælg Starttype Deaktiveret.

------------------------------------------------------------------------

Kør en scanning med Hijackthis,
Du får herunder nogle filer, som du skal fixe. Det, du skal gøre, er at sætte et flueben ud for disse filer. Når du har gjort det, så lukker du alle andre vinduer ned. Det er meget vigtigt at det eneste vindue, som er åbent er HijackThis vinduet. Husk også at lukke dette vindue, når du har markeret filerne. Nu må du fixe. Klik på Fix checked.

Det er disse, som skal fixes:

R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Programmer\AVG\AVG8\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [iTunesHelper] "E:\Programmer\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)

Genstart normalt...

------------------------------------------------------------------------

Smut til WindowsUpdate -> http://update.microsoft.com/windowsupdate/v6/default.aspx?ln=da for opdateringer. Bla. IE8 (InternetExplorer 8.X)

------------------------------------------------------------------------

Ta' en oprydning med nævnte CCleaner...

------------------------------------------------------------------------

Hvordan kører PC'en så nu ?

er nået til windows update nu. kommer snart med en status

Google Software Updater * iPod-tjeneste (iPod Service) var der ikke. de 2 andre er blevet slettet.

nProtect var ikke startet, så lod den være.

kørte en fix checked på de bestemte filer.

windowsupdates stod stille i over 5 min. så annulerede den :S:S

tog en ccleaner.

og nu står jeg her.

min AVG finder stadig alt det her... og jeg stoppede den selv.. det her fandt den på kun 2 et ½ minut..

Scan "Scan whole computer" was finished.
Infections;"58";"0";"58"
Folders selected for scanning:;"Scan whole computer"
Scan started:;"28. juli 2009, 19:15:07"
Scan finished:;"28. juli 2009, 19:17:39 (2 minute(s) 32 second(s))"
Total object scanned:;"382"
User who launched the scan:;"Anders"

Infections
File;"Infection";"Result"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
C:\PROGRA~1\AVG\AVG8\avgnsx.exe (592);"Virus identified Win32/Cryptor";"Infected"
C:\Programmer\AVG\AVG8\avgrsx.exe (584);"Virus identified Win32/Cryptor";"Infected"
C:\Programmer\Creative\Shared Files\CTAudSvc.exe (1984);"Virus identified Win32/Cryptor";"Infected"
C:\Programmer\Fælles filer\Microsoft Shared\VS7DEBUG\MDM.EXE (688);"Virus identified Win32/Cryptor";"Infected"
C:\WINDOWS\system32\CTSVCCDA.EXE (384);"Virus identified Win32/Cryptor";"Infected"
C:\WINDOWS\system32\nvsvc32.exe (1688);"Virus identified Win32/Cryptor";"Infected"
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe (368);"Virus identified Win32/Cryptor";"Infected"
C:\Programmer\Creative\MediaSource5\MtdAcqu.exe (2460);"Virus identified Win32/Cryptor";"Infected"
C:\Programmer\Microsoft IntelliPoint\ipoint.exe (2424);"Virus identified Win32/Cryptor";"Infected"
C:\WINDOWS\explorer.exe (1724);"Virus identified Win32/Cryptor";"Infected"
C:\WINDOWS\system32\PnkBstrA.exe (1932);"Virus identified Win32/Cryptor";"Infected"
C:\WINDOWS\system32\rundll32.exe (2432);"Virus identified Win32/Cryptor";"Infected"
C:\WINDOWS\system32\spoolsv.exe (1884);"Virus identified Win32/Cryptor";"Infected"
\\?\globalroot\systemroot\system32\geyekrfobvamxg.dll;"Virus identified Win32/Cryptor";"Infected"
C:\PROGRA~1\AVG\AVG8\avgtray.exe (2416);"Virus identified Win32/Cryptor";"Infected"
C:\PROGRA~1\AVG\AVG8\avgemc.exe (1996);"Virus identified Win32/Cryptor";"Infected"
C:\Programmer\AVG\AVG8\avgcsrvx.exe (1120);"Virus identified Win32/Cryptor";"Infected"
C:\Programmer\Creative\Shared Files\Module Loader\DLLML.exe (2384);"Virus identified Win32/Cryptor";"Infected"
C:\Programmer\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe (2360);"Virus identified Win32/Cryptor";"Infected"
C:\WINDOWS\system32\CtHelper.exe (2400);"Virus identified Win32/Cryptor";"Infected"
C:\WINDOWS\system32\Ctxfihlp.exe (2408);"Virus identified Win32/Cryptor";"Infected"
C:\WINDOWS\system32\lsass.exe (872);"Virus identified Win32/Cryptor";"Infected"
C:\WINDOWS\system32\services.exe (860);"Virus identified Win32/Cryptor";"Infected"
C:\WINDOWS\system32\svchost.exe (1052);"Virus identified Win32/Cryptor";"Infected"
C:\WINDOWS\system32\svchost.exe (1256);"Virus identified Win32/Cryptor";"Infected"
C:\WINDOWS\system32\svchost.exe (1576);"Virus identified Win32/Cryptor";"Infected"
C:\WINDOWS\system32\svchost.exe (1612);"Virus identified Win32/Cryptor";"Infected"
C:\WINDOWS\system32\svchost.exe (2040);"Virus identified Win32/Cryptor";"Infected"
C:\WINDOWS\system32\svchost.exe (540);"Virus identified Win32/Cryptor";"Infected"
C:\WINDOWS\system32\winlogon.exe (816);"Virus identified Win32/Cryptor";"Infected"

Er jeg den eneste der får "røde knopper" når der står "geyekr" i en log?

pls fortæl hvad jeg skal gøre.!

ville få det en del bedre, hvis du ville sige hvad jeg skal gøre, istedet for at få røde knopper.

Hent og pak RootRepeal ud.

http://rootrepeal.googlepages.com/RootRepeal.zip

Start og vælg "report", klik skan og sæt flueben i "files"  og lad den søge
Når den er færdig viser den en liste over filer.
Tryk på "save report" og send den herind.

Den har problemer med at komme på nettet...
sidder på min bærbare lige pt.

er der mere jeg skal gøre, eller er den report det eneste du skal bruge lige nu?

har søgt lidt på google, og fandt en som har brugt "superantispyware" og sagt det virkede.
Hørt om det?

(Jeg skal da også have lov til at spise færdig...)

Tak <f-arn> ...

hehe, ikke når det drejer sig om min PC! :D

ej

#23 først som <f-arn> skriver!!!

jeg har prøvet at genstarte internettet, intet svar... jeg har genstartet pc'en uden held...

det virker fint på min bærbare :S det er som om at når jeg tænder den stationære, så ryger hele netværket.

Det kan måske have noget at gøre med, at min bærbare kører på trådløst, mens min stationære kører LAN.

Der er ikke noget at gøre... Hver gang internettet på min stationære starter, så ryger nettet. Selvom der står der forbindelse osv.

Ved ikke hvad jeg skal gøre!

Du har et rootkit og jeg skal bruge en rapport fra RootRepeal for at smadre den.

Så jeg skal bare gøre alt, for at komme på nettet? og få det rootrepeal.

aner bare ikke hvad jeg skal gøre, men prøver...

går nok noget tid (HÅBER IKKE)

karise_larry >> Er det ikke rigtig at følgende linie skal fixes for at få forbindelse til internettet?

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

... jo - det er der nok noget om...

er på nette nu (YES!)

og har hentet root, og igang med søgningen

allerede nu kan jeg se, den har fundet geyekr'medmere' filer, som er usynlige for windows API

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time:        2009/07/28 21:14
Program Version:        Version 1.3.3.0
Windows Version:        Windows XP SP3
==================================================

Hidden/Locked Files
-------------------
Path: Volume C:\
Status: MBR Rootkit Detected!

Path: Volume C:\, Sector 1
Status: Sector mismatch

Path: Volume C:\, Sector 2
Status: Sector mismatch

Path: Volume C:\, Sector 3
Status: Sector mismatch

Path: Volume C:\, Sector 4
Status: Sector mismatch

Path: Volume C:\, Sector 5
Status: Sector mismatch

Path: Volume C:\, Sector 6
Status: Sector mismatch

Path: Volume C:\, Sector 7
Status: Sector mismatch

Path: Volume C:\, Sector 8
Status: Sector mismatch

Path: Volume C:\, Sector 9
Status: Sector mismatch

Path: Volume C:\, Sector 10
Status: Sector mismatch

Path: Volume C:\, Sector 11
Status: Sector mismatch

Path: Volume C:\, Sector 12
Status: Sector mismatch

Path: Volume C:\, Sector 13
Status: Sector mismatch

Path: Volume C:\, Sector 14
Status: Sector mismatch

Path: Volume C:\, Sector 15
Status: Sector mismatch

Path: Volume C:\, Sector 16
Status: Sector mismatch

Path: Volume C:\, Sector 17
Status: Sector mismatch

Path: Volume C:\, Sector 18
Status: Sector mismatch

Path: Volume C:\, Sector 19
Status: Sector mismatch

Path: Volume C:\, Sector 20
Status: Sector mismatch

Path: Volume C:\, Sector 21
Status: Sector mismatch

Path: Volume C:\, Sector 22
Status: Sector mismatch

Path: Volume C:\, Sector 23
Status: Sector mismatch

Path: Volume C:\, Sector 24
Status: Sector mismatch

Path: Volume C:\, Sector 25
Status: Sector mismatch

Path: Volume C:\, Sector 26
Status: Sector mismatch

Path: Volume C:\, Sector 27
Status: Sector mismatch

Path: Volume C:\, Sector 28
Status: Sector mismatch

Path: Volume C:\, Sector 29
Status: Sector mismatch

Path: Volume C:\, Sector 30
Status: Sector mismatch

Path: Volume C:\, Sector 31
Status: Sector mismatch

Path: Volume C:\, Sector 32
Status: Sector mismatch

Path: Volume C:\, Sector 33
Status: Sector mismatch

Path: Volume C:\, Sector 34
Status: Sector mismatch

Path: Volume C:\, Sector 35
Status: Sector mismatch

Path: Volume C:\, Sector 36
Status: Sector mismatch

Path: Volume C:\, Sector 37
Status: Sector mismatch

Path: Volume C:\, Sector 38
Status: Sector mismatch

Path: Volume C:\, Sector 39
Status: Sector mismatch

Path: Volume C:\, Sector 40
Status: Sector mismatch

Path: Volume C:\, Sector 41
Status: Sector mismatch

Path: Volume C:\, Sector 42
Status: Sector mismatch

Path: Volume C:\, Sector 43
Status: Sector mismatch

Path: Volume C:\, Sector 44
Status: Sector mismatch

Path: Volume C:\, Sector 45
Status: Sector mismatch

Path: Volume C:\, Sector 46
Status: Sector mismatch

Path: Volume C:\, Sector 47
Status: Sector mismatch

Path: Volume C:\, Sector 48
Status: Sector mismatch

Path: Volume C:\, Sector 49
Status: Sector mismatch

Path: Volume C:\, Sector 51
Status: Sector mismatch

Path: Volume C:\, Sector 52
Status: Sector mismatch

Path: Volume C:\, Sector 53
Status: Sector mismatch

Path: Volume C:\, Sector 54
Status: Sector mismatch

Path: Volume C:\, Sector 55
Status: Sector mismatch

Path: Volume C:\, Sector 56
Status: Sector mismatch

Path: Volume C:\, Sector 57
Status: Sector mismatch

Path: Volume C:\, Sector 58
Status: Sector mismatch

Path: Volume C:\, Sector 59
Status: Sector mismatch

Path: Volume C:\, Sector 60
Status: Sector mismatch

Path: Volume C:\, Sector 61
Status: Sector mismatch

Path: Volume C:\, Sector 62
Status: Sector mismatch

Path: C:\WINDOWS\Temp\geyekrjtvxtuexgm.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\Temp\geyekrqdsvpivsop.tmp
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\geyekrfiqswaby.dat
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\geyekrfobvamxg.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\geyekrjxujxwlk.dll
Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\geyekrohlomfgh.dat
Status: Invisible to the Windows API!

Path: C:\WINDOWS\ServicePackFiles\i386\avc.sys
Status: Locked to the Windows API!

Path: C:\WINDOWS\system32\drivers\geyekrafumcmvx.sys
Status: Invisible to the Windows API!

Path: c:\documents and settings\anders\lokale indstillinger\application data\mozilla\firefox\profiles\k0ipmbgp.default\cache\_cache_001_
Status: Size mismatch (API: 502699, Raw: 500910)

Path: c:\documents and settings\anders\lokale indstillinger\application data\mozilla\firefox\profiles\k0ipmbgp.default\cache\_cache_002_
Status: Size mismatch (API: 358103, Raw: 355515)

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\frederikwessberg@hotmail.com\DFSR\Staging\CS{04DE5B58-5F14-4CFB-5014-03750AEEE898}\12\12-{D84411F8-16D6-4F71-843C-4AD099418ECB}-v12-{D84411F8-16D6-4F71-843C-4AD099418ECB}-v12-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\gangsta_kurder@hotmail.com\DFSR\Staging\CS{E224829A-F729-18FF-EB05-EC96068FDB63}\81\5681-{35DB77F7-FC33-4B8E-A5C7-89F8C4061C8A}-v5681-{35DB77F7-FC33-4B8E-A5C7-89F8C4061C8A}-v5681-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\14\14-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v14-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v14-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\15\15-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v15-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v15-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\16\16-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v16-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v16-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\17\17-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v17-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v17-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\18\18-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v18-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v18-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\19\19-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v19-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v19-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\20\20-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v20-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v20-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\21\21-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v21-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v21-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\22\22-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v22-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v22-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\23\23-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v23-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v23-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\24\24-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v24-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v24-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\25\25-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v25-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v25-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\26\26-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v26-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v26-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\27\27-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v27-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v27-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\28\28-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v28-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v28-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\29\29-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v29-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v29-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\30\30-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v30-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v30-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\31\31-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v31-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v31-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\32\32-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v32-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v32-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\33\33-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v33-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v33-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\34\34-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v34-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v34-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\35\35-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v35-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v35-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\36\36-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v36-{2DA33816-9891-47D5-9DE6-64B36BE739C5}-v36-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\jimmi.r.n@hotmail.com\DFSR\Staging\CS{E9EB3889-DA90-EC05-27A5-F6D55EB06957}\47\7747-{B8476262-7213-4463-B36B-C372055E3A45}-v7747-{B8476262-7213-4463-B36B-C372055E3A45}-v7747-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\26\26-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v26-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v26-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\28\28-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v28-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v28-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\33\33-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v33-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v33-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\34\34-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v34-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v34-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\38\38-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v38-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v38-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\40\40-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v40-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v40-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\42\42-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v42-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v42-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\44\44-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v44-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v44-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\46\46-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v46-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v46-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\48\48-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v48-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v48-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\50\50-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v50-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v50-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\52\52-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v52-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v52-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\54\54-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v54-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v54-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\56\56-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v56-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v56-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\57\57-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v57-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v57-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\58\58-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v58-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v58-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\59\59-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v59-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v59-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\60\60-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v60-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v60-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\62\62-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v62-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v62-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\63\63-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v63-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v63-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: C:\Documents and Settings\Anders\Lokale indstillinger\Application Data\Microsoft\Messenger\anders_wess@hotmail.com\SharingMetadata\seest_13@hotmail.com\DFSR\Staging\CS{651E3146-A28B-D877-DEC4-06A0D8C5F06A}\65\65-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v65-{2FA4D2A4-73EC-41FD-A2C9-987E8E696E24}-v65-Downloaded.frx:{59828bbb-3f72-4c1b-a420-b51ad66eb5d3}.XPRESS
Status: Visible to the Windows API, but not on disk.

Path: D:\Install\Symantec Antivirus 9\Rollout\AVServer\SERVER\NETWARE\vd18b407.vdb
Status: Locked to the Windows API!

Path: Volume E:\
Status: MBR Rootkit Detected!

Path: Volume E:\, Sector 1
Status: Sector mismatch

Path: Volume E:\, Sector 2
Status: Sector mismatch

Path: Volume E:\, Sector 4
Status: Sector mismatch

Path: Volume E:\, Sector 6
Status: Sector mismatch

Path: Volume E:\, Sector 7
Status: Sector mismatch

Path: Volume E:\, Sector 8
Status: Sector mismatch

Path: Volume E:\, Sector 9
Status: Sector mismatch

Path: Volume E:\, Sector 10
Status: Sector mismatch

Path: Volume E:\, Sector 11
Status: Sector mismatch

Path: Volume E:\, Sector 12
Status: Sector mismatch

Path: Volume E:\, Sector 13
Status: Sector mismatch

Path: Volume E:\, Sector 15
Status: Sector mismatch

Path: Volume E:\, Sector 16
Status: Sector mismatch

Path: Volume E:\, Sector 17
Status: Sector mismatch

Path: Volume E:\, Sector 21
Status: Sector mismatch

Path: Volume E:\, Sector 28
Status: Sector mismatch

Path: Volume E:\, Sector 29
Status: Sector mismatch

Path: Volume E:\, Sector 30
Status: Sector mismatch

Path: Volume E:\, Sector 31
Status: Sector mismatch

Path: Volume E:\, Sector 32
Status: Sector mismatch

Path: Volume E:\, Sector 33
Status: Sector mismatch

Path: Volume E:\, Sector 34
Status: Sector mismatch

Path: Volume E:\, Sector 35
Status: Sector mismatch

Path: Volume E:\, Sector 36
Status: Sector mismatch

Path: Volume E:\, Sector 38
Status: Sector mismatch

Path: Volume E:\, Sector 41
Status: Sector mismatch

Path: Volume E:\, Sector 42
Status: Sector mismatch

Path: Volume E:\, Sector 44
Status: Sector mismatch

Path: Volume E:\, Sector 45
Status: Sector mismatch

Path: Volume E:\, Sector 46
Status: Sector mismatch

Path: Volume E:\, Sector 47
Status: Sector mismatch

Path: Volume E:\, Sector 48
Status: Sector mismatch

Path: Volume E:\, Sector 49
Status: Sector mismatch

Path: Volume E:\, Sector 51
Status: Sector mismatch

Path: Volume E:\, Sector 52
Status: Sector mismatch

Path: Volume E:\, Sector 53
Status: Sector mismatch

Path: Volume E:\, Sector 57
Status: Sector mismatch

Path: Volume E:\, Sector 59
Status: Sector mismatch

Path: Volume E:\, Sector 60
Status: Sector mismatch

Path: Volume E:\, Sector 62
Status: Sector mismatch

Path: E:\Programmer\Steam\SteamApps\teh_master666\counter-strike\cstrike\radial.cdb
Status: Locked to the Windows API!

==EOF==

Den må <f-arn> vist 'tyde' ...

håber jeg så han gør :)

Start RootRepeal igen og find denne:


Path: C:\WINDOWS\system32\drivers\geyekrafumcmvx.sys


Højreklik på den og vælg "wipe file"
Genstart straks

hent og gem Combofix på dit skrivebord:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe



Højreklik på skrivebordet og vælg ny->tekstdokument og kopier  indholdet mellem  linierne ind og gem filen som CFScript.txt

Du skal sikre dig at den ikke kommer til at hedde CFScript.txt.txt

--------------

Killall::
Snapshot::

-------------

Tag så fat i den nye fil med musen, og før den hen over Combofix-filen, hvorefter du "giver slip" med musen.
http://www.fromsej.saknet.dk/billeder/cfscript.gif


Så skulle Combofix gerne give sig til at arbejde. Muligvis vil den kræve en genstart, hvilket du skal tillade. Du bør ikke klikke på vinduet imens værktøjet kører, idet det kan få din computer til at fryse.
Når Combofix er færdig, og efter det (muligvis) har genstartet, skulle der gerne åbnes en logfil: combofix.txt som ligger her C:\ Combofix txt

Indholdet af denne fil må du gerne lægge herind.

jeg kan ikke se filen "Path: C:\WINDOWS\system32\drivers\geyekrafumcmvx.sys"

har gjort det, genstarter

da jeg lige startede op, fandt mit AVG resident shield

"C:\WINDOWS\system32\1037m.dll";"Virus found Win32/Heur";"Moved to Virus Vault"

"C:\WINDOWS\system32\ahuih.exe";"Virus found Win32/Heur";"Moved to Virus Vault"

"Højreklik på skrivebordet og vælg ny->tekstdokument og kopier  indholdet mellem  linierne ind og gem filen som CFScript.txt"

forstår det ikke helt :S

sry, har gjort det helt forkert...
Men er kommet frem til at:

"http://download.bleepingcomputer.com/sUBs/ComboFix.exe "

er et dødt link

altså jeg har slettet filen, og genstartede straks... men det er det der link, som ikke virker..

(altså har ikke gjort alt ruende galt :D)

Ok - så prøv lige at opdatere og køre Malwarebytes igen.

ok

jeg sender logen ind efter ikk?

skal jeg også sende en hijacklog med?

mit avg resident shield har lige fundet:

"C:\System Volume Information\_restore{FA5B3EA8-7649-458E-A4F7-594461B4A4E6}\RP100\A0017797.exe";"Virus found Win32/Heur";"Infected"

"C:\System Volume Information\_restore{FA5B3EA8-7649-458E-A4F7-594461B4A4E6}\RP100\A0017796.dll";"Virus found Win32/Heur";"Infected"

er stadig igang med malware scanning

mit avg resident shield har lige fundet:

"C:\WINDOWS\system32\geyekrjxujxwlk.dll";"Virus identified Win32/Cryptor";"Infected"

"C:\WINDOWS\system32\geyekrfobvamxg.dll";"Virus identified Win32/Cryptor";"Infected"

er stadig igang med malware scanning

(det ser altså håbløst ud, i mine øjne :S)

nææ - grunden til at den finder dem er at beskyttelsen blev fjernet af ROOTREPEAL

årh tak, troede du var gået i seng :)

malware er stadig igang (MEGET LANGSOM!)

snart færdig dog, 2 inficerede...

venter spændt :) ligesom dig

Det gør jeg så nu :-)

Malwarebytes' Anti-Malware 1.39
Database version: 2522
Windows 5.1.2600 Service Pack 3

28-07-2009 23:08:06
mbam-log-2009-07-28 (23-08-06).txt

Skan type: Fuldstændig skanning (C:\|E:\|)
Objekter skannet: 184288
Tid tilbagelagt: 58 minute(s), 4 second(s)

Inficerede Hukommelses Processer: 0
Inficerede Hukommelses Moduler: 0
Inficerede Registeringsdatabase Nøgler: 0
Inficerede Registeringsdatabase Værdier: 0
Inficerede Registeringsdatabase Filer: 1
Inficerede Mapper: 0
Inficerede Filer: 3

Inficerede Hukommelses Processer:
(Ingen mistænkelige filer fundet)

Inficerede Hukommelses Moduler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Nøgler:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Værdier:
(Ingen mistænkelige filer fundet)

Inficerede Registeringsdatabase Filer:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Inficerede Mapper:
(Ingen mistænkelige filer fundet)

Inficerede Filer:
C:\WINDOWS\system32\drivers\mrxdavv.sys (Rootkit.Agent.H) -> Delete on reboot.
c:\WINDOWS\system32\geyekrfobvamxg.dll (Trojan.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kwave.sys (Trojan.Agent) -> Delete on reboot.


skal jeg sige ja til at genstarte?

har genstartet nu...

hvis du går i seng må du meget gerne skrive det :)

Jeg venter på svar til kl 1, men der går jeg altså i seng...

Hvis du har svaret inden, vil jeg blive oppe resten af mit liv, for at fjerne det her lort.

sry, tak for alt jeres assistance!
Håber vi kan arbejde videre imorgen!!!

Jeg går i hvert fald i seng nu, til noget south park, og oven på en heftig dag...

Håber i vil råde mig igen imorgen!!

på forhånd tak, og tak for alt hjælp!

ses xD

Har du en WINDOWS installations cd?

Nej, har jeg desv. ikke? men kan høre på det hele, at det er min eneste mulighed? formatere :(

Hvis du kan låne en og kan følge denne guide på ensgelsk så er der håb forude:

Got a Damaged Master Boot Record?

Although those messages sound pretty scary, there's a good chance your hard drive is still intact. In most cases this problem can be fixed with a simple procedure that repairs your Master Boot Record (MBR). When you start your computer, the BIOS (basic input/output system) looks for the MBR on the first sector of your hard drive. The MBR tells the BIOS which partition on the hard drive contains the operating system.

So... if the MBR is damaged, the BIOS can't locate and start the operating system. When your BIOS detects a damaged MBR or boot sector, you'll see ominous messages like Invalid partition table, Error loading operating system, or Missing operating system. In some cases, dark clouds will apppear on the horizon, and you may hear the distant rumble of thunder. But fortunately, the Recovery Console offers some tools to help clear up the problem.

Repairing a Damaged MBR
Your Windows XP setup CDROM has a tool called the Recovery Console, which is designed to help you repair a damaged master boot record or boot sector. To start the Recovery Console and fix your damaged MBR, follow these steps:

Restart your computer with the Windows XP Setup disk in the CDROM drive.
If you are prompted to press a key to start the computer from CDROM, do so quickly. Otherwise it may try to boot from the hard drive.
After a few minutes, you'll see a prompt to press the R key to start the Recovery Console.
When Recovery Console starts, it will prompt you to enter a number corresponding to the Windows XP installation that you need to repair. In most cases, you'll enter "1" (which will be the only choice). If you press ENTER without typing a number, Recovery Console will quit and restart your computer.
Enter your Administrator password. If you don't enter the correct password, you cannot continue.
At the Recovery Console command prompt, type fixmbr and then verify that you want to proceed.
Your damaged MBR will be replaced with a shiny new one, and you should then be able to boot your system normally. In some cases, you may need to repair the boot sector in addition to the MBR. If your system still doesn't boot properly, repeat the steps above, but issue the fixboot command instead.

NOTE: These procedures assume that you have only one operating system installed. If you are an advanced user and have a multi-boot system with more than one operating system, you may need to do some additional reading about the fixmbr and fixboot commands at the Microsoft website.

Do you have experience with a damaged master boot record? Post your comments below...







Send this article to a friend.
Jump to the Comments section.
Follow me on Twitter.
Buy Bob a Snickers.
Check out other articles in this category:

Terabyte Hard Drives Solid State Hard Drives Partitioning Your Hard Drive External Hard Drive Security Defrag Your Hard Drive Converting FAT to NTFS Low Disk Space Warning What is RAID? Clean Hard Drive What is a Terabyte? Sharing A Hard Drive Online Hard Drive Recovery Changing Disk Partitions SATA and IDE Hard Drives? Fix MBR Fiddling While Your Hard Drive Crashes Hard Drive Makes a Clicking Sound Add a Second Hard Drive Reformatting Hard Drive Hard Drive Crash Copying Old Hard Drive to New PC Removing Files from Hard Drive

tak for hjælpen..

men min administrator er på ferie, og kommer først hjem i næste uge. men skal da vise ham det her, før han putter cd'en ind :)

Hej

Download mbr.exe  til skrivebordet

http://www2.gmer.net/mbr/mbr.exe

Dobbeltklik på mbr.exe og følg vejledning
Når "mbr.exe" er kørt vil den oprette en logfil som ligger på skrivebordet (mbr)

Kopier indholdet af den logfil herind I din næste svar.

Kan jeg nå at føre ting ned på USB-stik, før at virussen bliver taget med, og ind i min anden PC?

vil helst gemme få ting, før jeg formaterer.

Prøv og kom med den logfil fra mit sidste indlæg.
Det er ikke  sikker du behøver at formater.

Den virus du har bliver ikke overført på den måde. Søm jeg skrev i mit svar på din e-mail er jeg ikke sikker på du behøver formatere.

@sullep
Tak, den kendte jeg ikke.

@f-arm
Jeg glemte mit password og logind til "Arkil" derfor kører jeg nu under "sullep"

@sullep
Det undrede mig også lidt. Jeg var nemlig ikke bekendt med ret mange der kunne finde den slags.

NB. Det er f-arn

PS. Måske vi bør lade "awezz" få sin "tråd" tilbage