CIO Tech Eksperten IT-JOB IT-Kurser Events Podcast Søg

Log ind eller opret profil

Du kan også logge ind via nedenstående tjenester

spiffed Nybegynder

26. november 2010 - 01:46 Der er 18 kommentarer og
1 løsning

hijack log

Jeg mener at junior har fået en account til steam og gmail hijacked, så jeg kune forestille mig der ligger noget snavs på hans pc nu. Jeg har kørt lidt forskellige antivirus programmer
og tænkte om der var en venlig sjæl som havde tid til at gå en log igennem for evt andet som ikke bør gøre krav på sin plads der:)

venligst herfra

Således ser den ud :

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 01:28:37, on 26-11-2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18975)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
C:\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigseekpro.com/hypercam/{119D8C09-D048-408C-93D3-CA8760D72D43}
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETVÆRKSTJENESTE')
O4 - Global Startup: Logitech SetPoint.lnk = ?
O8 - Extra context menu item: Google Sidewiki ... - res://C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} (Battlefield Heroes Updater) - https://www.battlefieldheroes.com/static/updater/BFHUpdater_5.0.31.0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - AVAST Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Tjenesten Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 7536 bytes

Synes godt om

f-arn Guru

26. november 2010 - 06:16 #1

Hent "Malwarebytes' Anti-Malware" her

Eller her

Installer og start programmet, klik på fanen opdater, klik Tjek for opdatering, lav "Hurtig skan" under fanebladet "skanner"
Bagefter klik på "vis resultater", tryk på "Fjern det valgte" og send loggen herind sammen med en log fra DDS som du finder her

eller her

Den laver to logs,(DDS.txt og Attach.txt) gem dem på skrivebordet og kopier indholdet af DDS.txt herind.

OBS - DDS skal gemmes på computeren og ikke køres fra nettet

Mht.: Vista og Windows 7 - højreklik på filen - Kør som Administrator.

NB Når du opdaterer Malwarebytes, så klik på Tjek for opdatering til den skriver at der ikke er flere opdateringer.

Synes godt om

spiffed Nybegynder

26. november 2010 - 13:32 #2

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 5191

Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18975

26-11-2010 13:06:38
mbam-log-2010-11-26 (13-06-38).txt

Skanningstype: Hurtig skanning
Objekter skannet: 138802
Tid gået: 3 minut(ter), 31 sekund(er)

Hukommelses Processorer Inficeret: 0
Hukommelses Moduler Inficeret: 0
Registreringsdatabasenøgler Inficeret: 0
Registreringsdatabaseværdier Inficeret: 0
Registreringsdatabasedata Objekter Inficeret: 0
Inficerede Mapper: 0
Inficerede Filer: 0

Hukommelses Processorer Inficeret:
(Ingen skadelige objekter blev fundet)

Hukommelses Moduler Inficeret:
(Ingen skadelige objekter blev fundet)

Registreringsdatabasenøgler Inficeret:
(Ingen skadelige objekter blev fundet)

Registreringsdatabaseværdier Inficeret:
(Ingen skadelige objekter blev fundet)

Registreringsdatabasedata Objekter Inficeret:
(Ingen skadelige objekter blev fundet)

Inficerede Mapper:
(Ingen skadelige objekter blev fundet)

Inficerede Filer:
(Ingen skadelige objekter blev fundet)

----------------------------------------------------

DDS (Ver_10-11-26.01) - NTFS_AMD64
Run by Oliver at 13:20:33,38 on 26-11-2010
Internet Explorer: 8.0.6001.18975
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.45.1030.18.4094.2952 [GMT 1:00]

SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\nvvsvc.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
C:\Windows\SysWow64\Macromed\Flash\FlashUtil10e.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Oliver\Downloads\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

mStart Page = hxxp://www.bigseekpro.com/hypercam/{119D8C09-D048-408C-93D3-CA8760D72D43}
mWinlogon: Userinit=userinit.exe
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
mRun: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
StartupFolder: C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\LOGITE~1.LNK - C:\Program Files\Logitech\SetPoint\SetPoint.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Google Sidewiki ... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxps://www.battlefieldheroes.com/static/updater/BFHUpdater_5.0.31.0.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
{AA58ED58-01DD-4d91-8333-CF10577473F7}
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
{2318C2B1-4965-11d4-9B18-009027A5CD4F}
mRun-x64: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun-x64: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

================= FIREFOX ===================

FF - ProfilePath - C:\Users\Oliver\AppData\Roaming\Mozilla\Firefox\Profiles\ohzj0oeu.default\
FF - prefs.js: browser.search.selectedEngine - Search
FF - prefs.js: browser.startup.homepage - hxxp://www.bigseekpro.com/hypercam/{13896421-BEC7-383E-B256-49B87E9B7323}
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=);user_pref(microsoft.CLR.auto_install, false
FF - prefs.js: network.proxy.type - 0
FF - plugin: C:\Program Files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Users\Oliver\AppData\Roaming\Mozilla\Firefox\Profiles\ohzj0oeu.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;C:\Windows\System32\drivers\Lbd.sys [2010-6-6 69152]
R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2010-1-24 121936]
R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2010-1-24 20048]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2010-1-24 61008]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-2-5 40384]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2010-2-4 1352832]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2010-5-6 600912]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-1-11 240232]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\Windows\System32\drivers\atl01v64.sys [2010-1-24 58880]
R3 avast! Mail Scanner;avast! Mail Scanner;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-2-5 40384]
R3 avast! Web Scanner;avast! Web Scanner;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-2-5 40384]
R3 rt61x64;Linksys Wireless-G PCI Adapter Driver;C:\Windows\System32\drivers\WMP54Gv41x64.sys [2007-6-26 362496]
S2 gupdate;Tjenesten Google Update (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-11-26 135664]
S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2010-2-25 89920]
S3 FontCache;Tjenesten Windows-skrifttypecache;C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2010-1-26 27648]
S3 PerfHost;Vært for DLL-ydelsestæller;C:\Windows\SysWOW64\perfhost.exe [2010-1-27 19968]

=============== File Associations ===============

JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %*

=============== Created Last 30 ================

2010-11-26 12:09:37 8199504 ----a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{436C72ED-4545-4693-A9EC-D526A5F37543}\mpengine.dll
2010-11-26 00:28:01 -------- d-----w- C:\Hijackthis
2010-11-25 23:58:13 -------- d-----w- C:\Users\Oliver\AppData\Local\Microsoft Games
2010-11-25 23:12:45 -------- d-----w- C:\Users\Oliver\AppData\Roaming\Malwarebytes
2010-11-25 23:12:19 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2010-11-25 23:12:18 24664 ----a-w- C:\Windows\System32\drivers\mbam.sys
2010-11-25 23:12:18 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2010-11-25 23:12:18 -------- d-----w- C:\PROGRA~3\Malwarebytes
2010-11-25 23:04:01 -------- d-----w- C:\Program Files\CCleaner
2010-11-25 22:24:16 15880 ----a-w- C:\Windows\System32\lsdelete.exe
2010-11-25 16:37:08 38848 ----a-w- C:\Windows\avastSS.scr
2010-11-25 16:29:11 -------- d-----w- C:\Windows\pss
2010-11-24 17:59:38 -------- d-----w- C:\Program Files (x86)\TMonitor
2010-11-24 09:25:56 7680 ----a-w- C:\Program Files\Internet Explorer\iecompat.dll
2010-11-24 09:25:56 7680 ----a-w- C:\Program Files (x86)\Internet Explorer\iecompat.dll
2010-11-19 17:01:13 -------- d-----w- C:\Users\Oliver\.thumbnails
2010-11-19 16:49:43 -------- d-----w- C:\Users\Oliver\.gimp-2.6
2010-11-19 16:49:14 -------- d-----w- C:\Program Files (x86)\GIMP-2.0
2010-11-16 16:55:20 -------- d-----w- C:\Users\Oliver\AppData\Local\Sony
2010-11-16 15:41:41 -------- d-----w- C:\Program Files (x86)\Sony
2010-11-13 11:14:38 685 ----a-w- C:\Users\Oliver\Launch CorruptionX.bat
2010-11-10 14:14:24 2409784 ----a-w- C:\Program Files\Windows Mail\OESpamFilter.dat
2010-11-10 14:14:24 2409784 ----a-w- C:\Program Files (x86)\Windows Mail\OESpamFilter.dat
2010-10-30 18:05:13 -------- d-----w- C:\Program Files (x86)\Cheat Engine
2010-10-30 18:04:47 -------- d-----w- C:\Program Files (x86)\Brothersoft
2010-10-30 18:02:42 -------- d-----w- C:\Users\Oliver\AppData\Roaming\GetRightToGo
2010-10-27 12:50:21 1927680 ----a-w- C:\Windows\System32\gameux.dll
2010-10-27 12:50:20 1696256 ----a-w- C:\Windows\SysWow64\gameux.dll
2010-10-27 12:50:19 4240384 ----a-w- C:\Windows\SysWow64\GameUXLegacyGDFs.dll
2010-10-27 12:50:19 32256 ----a-w- C:\Windows\System32\Apphlpdm.dll
2010-10-27 12:50:19 28672 ----a-w- C:\Windows\SysWow64\Apphlpdm.dll
2010-10-27 12:50:18 4240384 ----a-w- C:\Windows\System32\GameUXLegacyGDFs.dll

==================== Find3M ====================

2010-11-12 12:42:29 215016 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr
2010-11-12 12:42:29 215016 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe
2010-10-21 00:13:07 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2010-10-19 09:41:44 270720 ------w- C:\Windows\System32\MpSigStub.exe
2010-09-13 14:32:37 8147968 ----a-w- C:\Windows\System32\wmploc.DLL
2010-09-13 13:56:41 8147456 ----a-w- C:\Windows\SysWow64\wmploc.DLL
2010-09-08 06:41:05 1147904 ----a-w- C:\Windows\System32\wininet.dll
2010-09-08 06:36:53 56832 ----a-w- C:\Windows\System32\licmgr10.dll
2010-09-08 06:36:38 1538560 ----a-w- C:\Windows\System32\inetcpl.cpl
2010-09-08 06:36:24 132096 ----a-w- C:\Windows\System32\iesysprep.dll
2010-09-08 06:36:23 77312 ----a-w- C:\Windows\System32\iesetup.dll
2010-09-08 06:01:28 916480 ----a-w- C:\Windows\SysWow64\wininet.dll
2010-09-08 05:57:18 43520 ----a-w- C:\Windows\SysWow64\licmgr10.dll
2010-09-08 05:57:05 1469440 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2010-09-08 05:56:53 71680 ----a-w- C:\Windows\SysWow64\iesetup.dll
2010-09-08 05:56:53 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll
2010-09-08 05:36:07 479232 ----a-w- C:\Windows\System32\html.iec
2010-09-08 05:04:36 385024 ----a-w- C:\Windows\SysWow64\html.iec
2010-09-08 04:51:18 162816 ----a-w- C:\Windows\System32\ieUnatt.exe
2010-09-08 04:49:56 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
2010-09-08 04:26:46 133632 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2010-09-08 04:25:15 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2010-09-07 15:47:33 61008 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2010-09-06 18:28:38 179712 ----a-w- C:\Windows\System32\srvsvc.dll
2010-09-06 18:28:38 12288 ----a-w- C:\Windows\System32\sscore.dll
2010-09-06 18:27:03 17920 ----a-w- C:\Windows\System32\netevent.dll
2010-09-06 16:20:29 9728 ----a-w- C:\Windows\SysWow64\sscore.dll
2010-09-06 16:19:06 17920 ----a-w- C:\Windows\SysWow64\netevent.dll
2010-09-06 15:34:14 451584 ----a-w- C:\Windows\System32\drivers\srv.sys
2010-09-06 15:33:51 175104 ----a-w- C:\Windows\System32\drivers\srv2.sys
2010-09-06 15:33:49 145920 ----a-w- C:\Windows\System32\drivers\srvnet.sys
2010-08-31 17:27:07 633856 ----a-w- C:\Windows\System32\comctl32.dll
2010-08-31 15:46:37 954752 ----a-w- C:\Windows\SysWow64\mfc40.dll
2010-08-31 15:46:37 954288 ----a-w- C:\Windows\SysWow64\mfc40u.dll
2010-08-31 15:44:31 531968 ----a-w- C:\Windows\SysWow64\comctl32.dll
2010-08-31 14:57:39 2753024 ----a-w- C:\Windows\System32\win32k.sys

============= FINISH: 13:20:57,15 ===============

Således.

Synes godt om

spiffed Nybegynder

26. november 2010 - 13:34 #3

Jeg har også foretaget fuld scanning med mbam, med samme resultat til følge.

Synes godt om

f-arn Guru

26. november 2010 - 14:34 #4

Jeg mener at junior har fået en account til steam og gmail hijacked

Det sker hele tiden, men det er meget sjældent det skyldes "snavs", på den lokale PC. Der er ikke noget at se i loggen.

Skift Kodeord til begge.

------

Deaktiver dit antivirus-program, kør en online scanning med ESET Online Scanner:
http://www.eset.com/onlinescan/

Du skal acceptere betingelserne for brug, og klik på Start.
Efter ActiveX Control er indlæst, vil det tage et par minutter for scanneren at blive klar.
Dernæst skal du sætte flueben i følgende felter:
Remove found threats
Scan archives

under advanced settings
Scan for potentialy unwanted applications
Scan for potentially unsafe applications
Enable anti-stealth technology

Klik på Start. Denne scanning kan tage et stykke tid, så vær tålmodig.
En log vil åbne, når scanningen er færdig.

(hvis ikke, skal du gå til C:\Programmer\EsetOnlineScanner\ og åbne filen Log.txt).

Kopier den herind i næste svar.

Synes godt om

spiffed Nybegynder

26. november 2010 - 16:10 #5

C:\Program Files (x86)\TMonitor\TMonitor.exe a variant of Win32/KeyLogger.KeyloggerOnline.AA application cleaned by deleting - quarantined

-------------

ja det tog tid.

Mht steam account, så er det ikke muligt at få adgang til den længere, da email som password ref. bliver sendt til, tilsyneladende er ændret, så jeg ikke modtager anmodning om nulstilling længere..
gmail har jeg dog fået reetableret password.

Synes godt om

f-arn Guru

26. november 2010 - 16:42 #6

Det, er så et af de få tilfælde jeg har set, hvor der faktisk bliver fundet noget der kan forklare det.

------

Hent og installer SuperAntiSpyware
Start superantispyware, klik på Check for updates, når det er opdateret skal du lade det skanne din computer
(Fixed disk betyder harddisk)
Flyt prikken til Perform complete scan og klik på Næste, så kører scanningen.

Når den er færdig kommer der et vindue med en opsummering, klik på OK, klik så på næste og så på Udfør.

Der kommer et vindue med Quarantine and removal Complete, klik på OK, klik på Udfør.
Luk programmet, genstart normalt.

Start så superantispyware, klik på preferences, statistics/logs, view log. Indholdet af denne log må du gerne kopiere herind.

Synes godt om

spiffed Nybegynder

26. november 2010 - 18:05 #7

dette er loggen

-------------------

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 11/26/2010 at 05:54 PM

Application Version : 4.46.1000

Core Rules Database Version : 5917
Trace Rules Database Version: 3729

Scan type : Complete Scan
Total Scan Time : 01:01:20

Memory items scanned : 516
Memory threats detected : 0
Registry items scanned : 14777
Registry threats detected : 0
File items scanned : 41386
File threats detected : 42

Adware.Tracking Cookie
.doubleclick.net [ C:\Users\Oliver\AppData\Local\Google\Chrome\User Data\Default\Cookies ]
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@statcounter[1].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@hitbox[2].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@revsci[2].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@legolas-media[2].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@adserver.adtechus[1].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@msnportal.112.2o7[2].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@collective-media[1].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@delivery-media.surftown[2].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@collective-media[2].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@eyewonder[2].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@adtech[1].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@delivery-media.surftown[3].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@specificclick[1].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@mediaplex[1].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@mediaplex[3].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@elkjop.112.2o7[1].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@adserver3.openadex[2].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@atdmt[1].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@atdmt[2].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@content.yieldmanager[1].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@harrenmedianetwork[1].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@apmebf[1].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@eset.122.2o7[1].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@apmebf[3].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@fastclick[2].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@adtech[2].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@adform[1].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@adform[2].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@tribalfusion[1].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@adviva[2].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@ehg-eset.hitbox[1].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@track.adform[2].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@track.adform[3].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@kontera[2].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@doubleclick[1].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@ad.yieldmanager[2].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@ad1.emediate[1].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@doubleclick[3].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@e2.emediate[2].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@adserver3.openadex[1].txt
C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Cookies\Low\oliver@msnportal.112.2o7[1].txt

Synes godt om

spiffed Nybegynder

26. november 2010 - 18:12 #8

Er de threats superantispyware har fundet så fjernet? det fandt jeg ikke helt ud af.

(har lige fundet ud af at hans gamehotel også er overtaget af hijacker.)
Ja det er nogle bitre erfaringer han/vi må gøre os her, men også interessant hvis det kan lade sig gøre at rette op på det igen.

mon alle pc'er i huset skal cleanes nu hvor vi har trådløst netværk?

Synes godt om

f-arn Guru

26. november 2010 - 18:57 #9

SUPERAntiSpyware fandt kun Cookies. Det betyder ikke noget. Vil du godt sende Attach.txt fra DDS herind.

Synes godt om

spiffed Nybegynder

26. november 2010 - 19:22 #10

DDS (Ver_10-11-26.01) - NTFS_AMD64
Run by Oliver at 19:20:39,71 on 26-11-2010
Internet Explorer: 8.0.6001.18975
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.45.1030.18.4094.2592 [GMT 1:00]

SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Alwil Software\Avast5\AvastUI.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Program Files (x86)\Internet Explorer\iexplore.exe
C:\Windows\SysWow64\Macromed\Flash\FlashUtil10e.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Oliver\Downloads\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.dk/
mStart Page = hxxp://www.bigseekpro.com/hypercam/{119D8C09-D048-408C-93D3-CA8760D72D43}
mWinlogon: Userinit=userinit.exe
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
uRun: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
mRun: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
StartupFolder: C:\Users\Oliver\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\LOGITE~1.LNK - C:\Program Files\Logitech\SetPoint\SetPoint.exe
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Google Sidewiki ... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} - hxxps://www.battlefieldheroes.com/static/updater/BFHUpdater_5.0.31.0.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
{AA58ED58-01DD-4d91-8333-CF10577473F7}
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
{2318C2B1-4965-11d4-9B18-009027A5CD4F}
mRun-x64: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun-x64: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

================= FIREFOX ===================

FF - ProfilePath - C:\Users\Oliver\AppData\Roaming\Mozilla\Firefox\Profiles\ohzj0oeu.default\
FF - prefs.js: browser.search.selectedEngine - Search
FF - prefs.js: browser.startup.homepage - hxxp://www.bigseekpro.com/hypercam/{13896421-BEC7-383E-B256-49B87E9B7323}
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=);user_pref(microsoft.CLR.auto_install, false
FF - prefs.js: network.proxy.type - 0
FF - plugin: C:\Program Files (x86)\Google\Update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Users\Oliver\AppData\Roaming\Mozilla\Firefox\Profiles\ohzj0oeu.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;C:\Windows\System32\drivers\Lbd.sys [2010-6-6 69152]
R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2010-1-24 121936]
R1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2010-2-17 14920]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2010-2-17 12360]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2010-6-29 128752]
R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2010-1-24 20048]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2010-1-24 61008]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-2-5 40384]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;C:\Program Files (x86)\Lavasoft\Ad-Aware\AAWService.exe [2010-2-4 1352832]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2010-5-6 600912]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\Windows\System32\drivers\atl01v64.sys [2010-1-24 58880]
R3 avast! Mail Scanner;avast! Mail Scanner;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-2-5 40384]
R3 avast! Web Scanner;avast! Web Scanner;C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [2010-2-5 40384]
R3 rt61x64;Linksys Wireless-G PCI Adapter Driver;C:\Windows\System32\drivers\WMP54Gv41x64.sys [2007-6-26 362496]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 gupdate;Tjenesten Google Update (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-11-26 135664]
S3 FontCache;Tjenesten Windows-skrifttypecache;C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2010-1-26 27648]
S3 PerfHost;Vært for DLL-ydelsestæller;C:\Windows\SysWOW64\perfhost.exe [2010-1-27 19968]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-3-18 1020768]
S4 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64;C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2010-2-25 89920]

=============== File Associations ===============

JSEFile=C:\Windows\SysWOW64\WScript.exe "%1" %*

=============== Created Last 30 ================

2010-11-26 15:46:39 -------- d-----w- C:\Users\Oliver\AppData\Roaming\SUPERAntiSpyware.com
2010-11-26 15:46:39 -------- d-----w- C:\PROGRA~3\SUPERAntiSpyware.com
2010-11-26 15:46:18 -------- d-----w- C:\PROGRA~3\!SASCORE
2010-11-26 15:46:16 -------- d-----w- C:\Program Files\SUPERAntiSpyware
2010-11-26 13:42:11 -------- d-----w- C:\Program Files (x86)\ESET
2010-11-26 13:22:57 201184 ----a-w- C:\Windows\SysWow64\winrm.vbs
2010-11-26 13:21:18 -------- d-----w- C:\PROGRA~3\NVIDIA Corporation
2010-11-26 12:09:37 8199504 ----a-w- C:\PROGRA~3\Microsoft\Windows Defender\Definition Updates\{436C72ED-4545-4693-A9EC-D526A5F37543}\mpengine.dll
2010-11-26 00:28:01 -------- d-----w- C:\Hijackthis
2010-11-25 23:58:13 -------- d-----w- C:\Users\Oliver\AppData\Local\Microsoft Games
2010-11-25 23:12:45 -------- d-----w- C:\Users\Oliver\AppData\Roaming\Malwarebytes
2010-11-25 23:12:19 38224 ----a-w- C:\Windows\SysWow64\drivers\mbamswissarmy.sys
2010-11-25 23:12:18 24664 ----a-w- C:\Windows\System32\drivers\mbam.sys
2010-11-25 23:12:18 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2010-11-25 23:12:18 -------- d-----w- C:\PROGRA~3\Malwarebytes
2010-11-25 23:04:01 -------- d-----w- C:\Program Files\CCleaner
2010-11-25 22:24:16 15880 ----a-w- C:\Windows\System32\lsdelete.exe
2010-11-25 16:37:08 38848 ----a-w- C:\Windows\avastSS.scr
2010-11-25 16:29:11 -------- d-----w- C:\Windows\pss
2010-11-24 17:59:38 -------- d-----w- C:\Program Files (x86)\TMonitor
2010-11-24 09:25:56 7680 ----a-w- C:\Program Files\Internet Explorer\iecompat.dll
2010-11-24 09:25:56 7680 ----a-w- C:\Program Files (x86)\Internet Explorer\iecompat.dll
2010-11-19 17:01:13 -------- d-----w- C:\Users\Oliver\.thumbnails
2010-11-19 16:49:43 -------- d-----w- C:\Users\Oliver\.gimp-2.6
2010-11-19 16:49:14 -------- d-----w- C:\Program Files (x86)\GIMP-2.0
2010-11-16 16:55:20 -------- d-----w- C:\Users\Oliver\AppData\Local\Sony
2010-11-16 15:41:41 -------- d-----w- C:\Program Files (x86)\Sony
2010-11-13 11:14:38 685 ----a-w- C:\Users\Oliver\Launch CorruptionX.bat
2010-11-10 14:14:24 2409784 ----a-w- C:\Program Files\Windows Mail\OESpamFilter.dat
2010-11-10 14:14:24 2409784 ----a-w- C:\Program Files (x86)\Windows Mail\OESpamFilter.dat
2010-10-30 18:05:13 -------- d-----w- C:\Program Files (x86)\Cheat Engine
2010-10-30 18:04:47 -------- d-----w- C:\Program Files (x86)\Brothersoft
2010-10-30 18:02:42 -------- d-----w- C:\Users\Oliver\AppData\Roaming\GetRightToGo

==================== Find3M ====================

2010-11-12 12:42:29 215016 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr
2010-11-12 12:42:29 215016 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe
2010-10-21 00:13:07 472808 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2010-10-19 09:41:44 270720 ------w- C:\Windows\System32\MpSigStub.exe
2010-09-13 14:32:37 8147968 ----a-w- C:\Windows\System32\wmploc.DLL
2010-09-13 13:56:41 8147456 ----a-w- C:\Windows\SysWow64\wmploc.DLL
2010-09-08 06:41:05 1147904 ----a-w- C:\Windows\System32\wininet.dll
2010-09-08 06:36:53 56832 ----a-w- C:\Windows\System32\licmgr10.dll
2010-09-08 06:36:38 1538560 ----a-w- C:\Windows\System32\inetcpl.cpl
2010-09-08 06:36:24 132096 ----a-w- C:\Windows\System32\iesysprep.dll
2010-09-08 06:36:23 77312 ----a-w- C:\Windows\System32\iesetup.dll
2010-09-08 06:01:28 916480 ----a-w- C:\Windows\SysWow64\wininet.dll
2010-09-08 05:57:18 43520 ----a-w- C:\Windows\SysWow64\licmgr10.dll
2010-09-08 05:57:05 1469440 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2010-09-08 05:56:53 71680 ----a-w- C:\Windows\SysWow64\iesetup.dll
2010-09-08 05:56:53 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll
2010-09-08 05:36:07 479232 ----a-w- C:\Windows\System32\html.iec
2010-09-08 05:04:36 385024 ----a-w- C:\Windows\SysWow64\html.iec
2010-09-08 04:51:18 162816 ----a-w- C:\Windows\System32\ieUnatt.exe
2010-09-08 04:49:56 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
2010-09-08 04:26:46 133632 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2010-09-08 04:25:15 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2010-09-07 15:47:33 61008 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2010-09-06 18:28:38 179712 ----a-w- C:\Windows\System32\srvsvc.dll
2010-09-06 18:28:38 12288 ----a-w- C:\Windows\System32\sscore.dll
2010-09-06 18:27:03 17920 ----a-w- C:\Windows\System32\netevent.dll
2010-09-06 16:20:29 9728 ----a-w- C:\Windows\SysWow64\sscore.dll
2010-09-06 16:19:06 17920 ----a-w- C:\Windows\SysWow64\netevent.dll
2010-09-06 15:34:14 451584 ----a-w- C:\Windows\System32\drivers\srv.sys
2010-09-06 15:33:51 175104 ----a-w- C:\Windows\System32\drivers\srv2.sys
2010-09-06 15:33:49 145920 ----a-w- C:\Windows\System32\drivers\srvnet.sys
2010-08-31 17:27:07 633856 ----a-w- C:\Windows\System32\comctl32.dll
2010-08-31 15:46:37 954752 ----a-w- C:\Windows\SysWow64\mfc40.dll
2010-08-31 15:46:37 954288 ----a-w- C:\Windows\SysWow64\mfc40u.dll
2010-08-31 15:44:31 531968 ----a-w- C:\Windows\SysWow64\comctl32.dll
2010-08-31 14:57:39 2753024 ----a-w- C:\Windows\System32\win32k.sys

============= FINISH: 19:20:57,52 ===============

Synes godt om

f-arn Guru

26. november 2010 - 19:31 #11

Vil du godt sende Attach.txt fra DDS herind.

Attach.txt begynder sådan her:
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

Synes godt om

spiffed Nybegynder

26. november 2010 - 19:56 #12

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-11-26.01)

Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 24-01-2010 15:55:08
System Uptime: 26-11-2010 17:58:51 (2 hours ago)

Motherboard: ASUSTeK Computer INC. | | P5KC
Processor: Intel(R) Core(TM)2 Duo CPU E6750 @ 2.66GHz | LGA775 | 2664/333mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 149 GiB total, 26,323 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4d36e96b-e325-11ce-bfc1-08002be10318}
Description: PS/2 Keyboard
Device ID: ACPI\PNP0303\4&20D7719E&0
Manufacturer: Logitech
Name: PS/2 Keyboard
PNP Device ID: ACPI\PNP0303\4&20D7719E&0
Service: i8042prt

==== System Restore Points ===================

==== Installed Programs ======================

Ad-Aware
Ad-Aware Email Scanner for Outlook
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Attansic L1 Gigabit Ethernet Driver
avast! Free Antivirus
Battlefield Heroes
Call of Duty(R) 4 - Modern Warfare(TM)
Call of Duty: Modern Warfare 2
Call of Duty: Modern Warfare 2 - Multiplayer
Counter-Strike: Source
Counter-Strike: Source Beta
erLT
ESET Online Scanner v3
GIMP 2.6.11
Google Toolbar for Internet Explorer
Google Update Helper
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Java Auto Updater
Java(TM) 6 Update 22
Logitech SetPoint
Malwarebytes' Anti-Malware
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Mozilla Firefox (3.6.12)
MSVCRT Redists
NVIDIA PhysX
Portal: First Slice
PunkBuster Services
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Skype™ 5.0
Spybot - Search & Destroy
Steam(TM)
TeamSpeak 2 RC2
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Vegas Pro 10.0
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
World of Warcraft

==== End Of File ===========================

Synes godt om

f-arn Guru

27. november 2010 - 10:52 #13

Der var ikke noget der.

Prøv at køre BitDefender Online Scanner: http://www.bitdefender.com/scanner/online/free.html

Klik "Start Scanner" og følg instuktionerne.
Når den er færdig, klikker du på "Click here to view the report", og gemmer den på dit Skrivebord.
Kopier den herind.

PS Du skal bruge Internet Explorer.

Synes godt om

spiffed Nybegynder

27. november 2010 - 13:11 #14

f-arn det var desværre ikke muligt at foretage en scanning med denne uanset som admin og med bd som sikkert websted osv. (vista)!

Mon ikke skurken skulle være fundet ved Eset scanningen (keyloggeren)?

findes der evt. et købe prog. som vil forhindre situationer som denne, eller skal det måske bedre findes i jr's forståelse af mere sikker netadfærd :)

Spybot finder dog stadig et par ting som den ikke kan fixe. og den er ikke særlig smidig, da man bliver nødt til at overvåge for pop ups som skal bekræftes før den fortsætter scanningen. Det foregår ca 10-15 gange gennem forløbet

Synes godt om

spiffed Nybegynder

27. november 2010 - 13:25 #15

øjeblik.. jeg er ved at scanne med nu me BD efter 20 forsøg :)
vender tilbage..

Synes godt om

spiffed Nybegynder

27. november 2010 - 17:28 #16

BitDefender Online Scanner - Real Time Virus Report

Generated at: Sat, Nov 27, 2010 - 17:27:02

--------------------------------------------------------------------------------

Scan Info

Scanned Files
373306

Infected Files
0

Virus Detected

No virus found.

--------------------------------------------------------------------------------

This summary of the scan process will be used by the BitDefender Antivirus Lab to create agregate statistics about virus activity around the world.

Synes godt om

f-arn Guru

27. november 2010 - 17:52 #17

Hvis der var mere burde det ha' vist sig nu.

findes der evt. et købe prog. som vil forhindre situationer som denne

Der findes da flere, der med stor sandsynlighed, kan forhindre den slags.

Synes godt om

spiffed Nybegynder

27. november 2010 - 18:14 #18

ok, jeg har givet ham adgang til pc'en igen. det har været dejligt med hjælp fra dig, og jeg vil gerne som ydmyg tak give dig disse points for din tid og hjælp.
Og jeg vil da lige køre et par af de scannere på min egen pc også :)

Tak for hjælp.

Med venlig hilsen.

Synes godt om

f-arn Guru

27. november 2010 - 18:21 #19

Ok, men som du selv antyder - I bør nok overveje at få installeret noget bedre sikkerhed.

Synes godt om

Ny bruger Nybegynder

Din løsning...

Tilladte BB-code-tags: [b]fed[/b] [i]kursiv[/i] [u]understreget[/u] Web- og emailadresser omdannes automatisk til links. Der sættes "nofollow" på alle links.

Følg dette spørgsmål

Opret Preview

Se alle it-kurser fra Computerworld Kurser

IT-kurser om Microsoft 365, sikkerhed, personlig vækst, udvikling, digital markedsføring, grafisk design, SAP og forretningsanalyse.

Se alle it-kurser

Flere spørgsmål fra Virus kategorien

Titel	Indlæg	Oprettet	Seneste aktivitet
Findes der mon et Antivirus program, som ikke, konstant, reklamerer, for at købe ? Af Ikke-ekspert i Virus	21	22/06/202419:22	23/06/202412:54
Anbefaling af antivirusprogram med firewall Af OnePlusFan i Virus	23	07/05/202421:02	13/05/202419:48
trusler Af gerhardpet i Virus	4	26/01/202410:02	27/01/202408:32
Kan ikke fjerne virus Af mik28 i Virus	16	09/01/202416:37	10/01/202419:59
virusscanning Af JetteD i Virus	2	10/11/202312:55	10/11/202316:36

Se alle spørgsmål i kategorien Opret spørgsmål

Log ind eller opret profil

Hov!

For at kunne deltage på Computerworld Eksperten skal du være logget ind.

Det er heldigvis nemt at oprette en bruger: Det tager to minutter og du kan vælge at bruge enten e-mail, Facebook eller Google som login.

Du kan også logge ind via nedenstående tjenester

Alle kategorier på Eksperten

Seneste artiklerRSS