Backdoor Haxdoor-Trojan

21 januari, 2005

Kan någon hjälpa mig att få bort denna Trojan från min dator. Enligt SpyBoot så är det 1 träff..och filen ska finnas i mappen C:\winnt\system32 och filen heter där klogini.dll tar bort den men den återkommer hela tiden

Enligt AdA finns det ingen Trojan, men jag har iaf kopierat in texten från AdA

[log]

Ad-Aware SE Build 1.05

Logfile Created on:den 21 januari 2005 22:55:44

Created with Ad-Aware SE Personal, free for private use.

Using definitions file:SE1R25 11.01.2005

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

References detected during the scan:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

MRU List(TAC index:0):5 total references

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Ad-Aware SE Settings

===========================

Set : Search for negligible risk entries

Set : Safe mode (always request confirmation)

Set : Scan active processes

Set : Scan registry

Set : Deep-scan registry

Set : Scan my IE Favorites for banned URLs

Set : Scan my Hosts file

Extended Ad-Aware SE Settings

===========================

Set : Unload recognized processes & modules during scan

Set : Scan registry for all users instead of current user only

Set : Always try to unload modules before deletion

Set : During removal, unload Explorer and IE if necessary

Set : Let Windows remove files in use at next reboot

Set : Delete quarantined objects after restoring

Set : Include basic Ad-Aware settings in log file

Set : Include additional Ad-Aware settings in log file

Set : Include reference summary in log file

Set : Include alternate data stream details in log file

Set : Play sound at scan completion if scan locates critical objects

2005-01-21 22:55:44 - Scan started. (Full System Scan)

MRU List Object Recognized!

Location: : S-1-5-21-1708537768-1935655697-2146702707-500\software\microsoft\windows\currentversion\explorer\recentdocs

Description : list of recent documents opened

MRU List Object Recognized!

Location: : S-1-5-21-1708537768-1935655697-2146702707-500\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru

Description : list of recently saved files, stored according to file extension

MRU List Object Recognized!

Location: : S-1-5-21-1708537768-1935655697-2146702707-500\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru

Description : list of recent programs opened

MRU List Object Recognized!

Location: : S-1-5-21-1708537768-1935655697-2146702707-500\software\microsoft\internet explorer

Description : last download directory used in microsoft internet explorer

MRU List Object Recognized!

Location: : C:\Documents and Settings\Administrator\recent

Description : list of recently opened documents

Listing running processes

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

#:1 [smss.exe]

FilePath : \SystemRoot\System32 ProcessID : 164

ThreadCreationTime : 2005-01-21 20:36:20

BasePriority : Normal

#:2 [csrss.exe]

FilePath : \??\C:\WINNT\system32 ProcessID : 188

ThreadCreationTime : 2005-01-21 20:36:32

BasePriority : Normal

#:3 [services.exe]

FilePath : C:\WINNT\system32 ProcessID : 236

ThreadCreationTime : 2005-01-21 20:36:37

BasePriority : Normal

FileVersion : 5.00.2195.3940

ProductVersion : 5.00.2195.3940

ProductName : Microsoft® Windows ® 2000 Operating System

CompanyName : Microsoft Corporation

FileDescription : Services and Controller app

InternalName : services.exe

OriginalFilename : services.exe

#:4 [lsass.exe]

FilePath : C:\WINNT\system32 ProcessID : 248

ThreadCreationTime : 2005-01-21 20:36:37

BasePriority : Normal

FileVersion : 5.00.2195.5430

ProductVersion : 5.00.2195.5430

ProductName : Microsoft® Windows ® 2000 Operating System

CompanyName : Microsoft Corporation

FileDescription : LSA Executable and Server DLL (Export Version)

InternalName : lsasrv.dll and lsass.exe

OriginalFilename : lsasrv.dll and lsass.exe

#:5 [svchost.exe]

FilePath : C:\WINNT\system32 ProcessID : 428

ThreadCreationTime : 2005-01-21 20:36:46

BasePriority : Normal

FileVersion : 5.00.2134.1

ProductVersion : 5.00.2134.1

ProductName : Microsoft® Windows ® 2000 Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:6 [spoolsv.exe]

FilePath : C:\WINNT\system32 ProcessID : 468

ThreadCreationTime : 2005-01-21 20:36:47

BasePriority : Normal

FileVersion : 5.00.2195.4299

ProductVersion : 5.00.2195.4299

ProductName : Microsoft® Windows ® 2000 Operating System

CompanyName : Microsoft Corporation

FileDescription : Spooler SubSystem App

InternalName : spoolss.exe

OriginalFilename : spoolss.exe

#:7 [avgamsvr.exe]

FilePath : C:\PROGRA~1\Grisoft\AVGFRE~1 ProcessID : 496

ThreadCreationTime : 2005-01-21 20:36:48

BasePriority : Normal

FileVersion : 7,1,0,299

ProductVersion : 7.1.0.299

ProductName : AVG Anti-Virus System

CompanyName : GRISOFT, s.r.o.

FileDescription : AVG Alert Manager

InternalName : avgamsvr

OriginalFilename : avgamsvr.EXE

#:8 [avgupsvc.exe]

FilePath : C:\PROGRA~1\Grisoft\AVGFRE~1 ProcessID : 524

ThreadCreationTime : 2005-01-21 20:36:51

BasePriority : Normal

FileVersion : 7,1,0,285

ProductVersion : 7.1.0.285

ProductName : AVG 7.0 Anti-Virus System

CompanyName : GRISOFT, s.r.o.

FileDescription : AVG Update Service

InternalName : avgupsvc

OriginalFilename : avgupdsvc.EXE

#:9 [svchost.exe]

FilePath : C:\WINNT\System32 ProcessID : 560

ThreadCreationTime : 2005-01-21 20:36:53

BasePriority : Normal

FileVersion : 5.00.2134.1

ProductVersion : 5.00.2134.1

ProductName : Microsoft® Windows ® 2000 Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:10 [incdsrv.exe]

FilePath : C:\Program Files\Ahead\InCD ProcessID : 572

ThreadCreationTime : 2005-01-21 20:36:54

BasePriority : Normal

FileVersion : 4, 1, 5, 10

ProductVersion : 4, 1, 5, 10

ProductName : Ahead Software AG incdsrv

CompanyName : Ahead Software AG

FileDescription : incdsrv

InternalName : incdsrv

LegalTrademarks : InCD is a trademark of Ahead Software AG

OriginalFilename : incdsrv.exe

#:11 [regsvc.exe]

FilePath : C:\WINNT\system32 ProcessID : 620

ThreadCreationTime : 2005-01-21 20:36:57

BasePriority : Normal

FileVersion : 5.00.2195.3649

ProductVersion : 5.00.2195.3649

ProductName : Microsoft® Windows ® 2000 Operating System

CompanyName : Microsoft Corporation

FileDescription : Remote Registry Service

InternalName : regsvc

OriginalFilename : REGSVC.EXE

#:12 [mstask.exe]

FilePath : C:\WINNT\system32 ProcessID : 636

ThreadCreationTime : 2005-01-21 20:36:58

BasePriority : Normal

FileVersion : 4.71.2195.1

ProductVersion : 4.71.2195.1

ProductName : Microsoft® Windows® Task Scheduler

CompanyName : Microsoft Corporation

FileDescription : Task Scheduler Engine

InternalName : TaskScheduler

OriginalFilename : mstask.exe

#:13 [stisvc.exe]

FilePath : C:\WINNT\system32 ProcessID : 696

ThreadCreationTime : 2005-01-21 20:36:59

BasePriority : Normal

FileVersion : 5.00.2195.3649

ProductVersion : 5.00.2195.3649

ProductName : Microsoft® Windows ® 2000 Operating System

CompanyName : Microsoft Corporation

FileDescription : Still Image Devices Monitor

InternalName : STIMON

OriginalFilename : STIMON.EXE

#:14 [winmgmt.exe]

FilePath : C:\WINNT\System32\WBEM ProcessID : 748

ThreadCreationTime : 2005-01-21 20:37:27

BasePriority : Normal

FileVersion : 1.50.1085.0070

ProductVersion : 1.50.1085.0070

ProductName : Windows Management Instrumentation

CompanyName : Microsoft Corporation

FileDescription : Windows Management Instrumentation

InternalName : WINMGMT

#:15 [mspmspsv.exe]

FilePath : C:\WINNT\System32 ProcessID : 724

ThreadCreationTime : 2005-01-21 20:37:29

BasePriority : Normal

FileVersion : 7.10.00.3068

ProductVersion : 7.10.00.3068

ProductName : Microsoft ® DRM

CompanyName : Microsoft Corporation

FileDescription : WMDM PMSP Service

InternalName : MSPMSPSV.EXE

OriginalFilename : MSPMSPSV.EXE

#:16 [svchost.exe]

FilePath : C:\WINNT\system32 ProcessID : 816

ThreadCreationTime : 2005-01-21 20:37:29

BasePriority : Normal

FileVersion : 5.00.2134.1

ProductVersion : 5.00.2134.1

ProductName : Microsoft® Windows ® 2000 Operating System

CompanyName : Microsoft Corporation

FileDescription : Generic Host Process for Win32 Services

InternalName : svchost.exe

OriginalFilename : svchost.exe

#:17 [explorer.exe]

FilePath : C:\WINNT ProcessID : 1000

ThreadCreationTime : 2005-01-21 21:03:29

BasePriority : Normal

FileVersion : 5.00.3502.5321

ProductVersion : 5.00.3502.5321

ProductName : Microsoft® Windows ® 2000 Operating System

CompanyName : Microsoft Corporation

FileDescription : Windows Explorer

InternalName : explorer

OriginalFilename : EXPLORER.EXE

#:18 [winampa.exe]

FilePath : C:\Program Files\Winamp ProcessID : 1008

ThreadCreationTime : 2005-01-21 21:03:36

BasePriority : Normal

#:19 [incd.exe]

FilePath : C:\Program Files\Ahead\InCD ProcessID : 1012

ThreadCreationTime : 2005-01-21 21:03:36

BasePriority : Normal

FileVersion : 4, 1, 5, 10

ProductVersion : 4, 1, 5, 10

ProductName : Ahead Software AG InCD

CompanyName : Ahead Software AG

FileDescription : InCD

InternalName : InCD

LegalTrademarks : InCD is a trademark of Ahead Software AG

OriginalFilename : InCD.exe

#:20 [qttask.exe]

FilePath : C:\Program Files\QuickTime ProcessID : 1168

ThreadCreationTime : 2005-01-21 21:03:38

BasePriority : Normal

FileVersion : 6.5.1

ProductVersion : QuickTime 6.5.1

ProductName : QuickTime

CompanyName : Apple Computer, Inc.

InternalName : QuickTime Task

LegalCopyright : © Apple Computer, Inc. 2001-2004

OriginalFilename : QTTask.exe

#:21 [avgemc.exe]

FilePath : C:\PROGRA~1\Grisoft\AVGFRE~1 ProcessID : 1188

ThreadCreationTime : 2005-01-21 21:03:40

BasePriority : Normal

FileVersion : 7,1,0,300

ProductVersion : 7.1.0.300

ProductName : AVG Anti-Virus System

CompanyName : GRISOFT, s.r.o.

FileDescription : AVG E-Mail Scanner

InternalName : avgemc

OriginalFilename : avgemc.exe

#:22 [msnmsgr.exe]

FilePath : C:\Program Files\MSN Messenger ProcessID : 1196

ThreadCreationTime : 2005-01-21 21:03:41

BasePriority : Normal

FileVersion : 7.0.0425

ProductVersion : 7.0.0425

ProductName : MSN Messenger

CompanyName : Microsoft Corporation

FileDescription : MSN Messenger

InternalName : msnmsgr

LegalTrademarks : Microsoft® is a registered trademark of Microsoft Corporation in the U.S. and/or other countries.

OriginalFilename : msnmsgr.exe

#:23 [iexplore.exe]

FilePath : C:\Program Files\Internet Explorer ProcessID : 3288

ThreadCreationTime : 2005-01-21 21:45:01

BasePriority : Normal

FileVersion : 6.00.2800.1106

ProductVersion : 6.00.2800.1106

ProductName : Microsoft® Windows® Operating System

CompanyName : Microsoft Corporation

FileDescription : Internet Explorer

InternalName : iexplore

OriginalFilename : IEXPLORE.EXE

#:24 [spybotsd.exe]

FilePath : C:\Program Files\Spybot - Search & Destroy ProcessID : 6632

ThreadCreationTime : 2005-01-21 21:46:02

BasePriority : Normal

FileVersion : 1, 3, 0, 12

ProductVersion : 1, 3, 0, 12

ProductName : SpyBot-S&D

CompanyName : Safer Networking Limited

FileDescription : Spybot - Search & Destroy

InternalName : SpybotSD

LegalTrademarks : "Spybot" und "Spybot - Search & Destroy" sind registrierte Warenzeichen.

OriginalFilename : SpyBotSD.exe

Comments : Software zum Entfernen von Spyware und ähnlichen Bedrohungen.

#:25 [ad-aware.exe]

FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal ProcessID : 9880

ThreadCreationTime : 2005-01-21 21:53:41

BasePriority : Normal

FileVersion : 6.2.0.206

ProductVersion : VI.Second Edition

ProductName : Lavasoft Ad-Aware SE

CompanyName : Lavasoft Sweden

FileDescription : Ad-Aware SE Core application

InternalName : Ad-Aware.exe

OriginalFilename : Ad-Aware.exe

Memory scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 5

Started registry scan

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Registry Scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 5

Started deep registry scan

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Deep registry scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 5

Started Tracking Cookie scan

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Tracking cookie scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 5

Deep scanning and examining files (C:)

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for C:»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 5

Deep scanning and examining files (D:)

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Disk Scan Result for D:»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 5

Scanning Hosts file......

Hosts file location:"C:\WINNT\system32\drivers\etc\hosts".

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Hosts file scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

698 entries scanned.

New critical objects:0

Objects found so far: 5

Performing conditional scans...

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Conditional scan result:

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

New critical objects: 0

Objects found so far: 5

23:31:47 Scan Complete

Summary Of This Scan

»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

Total scanning time:00:36:02.890

Objects scanned:120300

Objects identified:0

Objects ignored:0

New critical objects:0

[/log]

/Moyet

22 januari, 2005

[log]Från symantecs hemsida.

1.Disable System Restore (Windows Me/XP).

2.Update the virus definitions.

3.Run a full system scan, and delete all files that are detected as Backdoor.Mutny.

4.Delete the value that the Trojan added to the registry.

a. Click Start, and then click Run. (The Run dialog box appears.)

b. Type the following text: regedit

Then click OK. (The Registry Editor opens.)

c. Navigate to the following key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control

d. In the right pane, delete the following value:

"Impersonate"="[RandomLargeNumer]"

e. Delete the following key:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\ControlMPRServices\TestService

f. Navigate to the following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersionWinlogon\Notify\debugg

g. In the right pane, delete the following values:

"DllName"="debugg.dll"

"Startup"="MemManager"

"Impersonate"="1"

"Asynchronous"="1"

"MaxWait"="1"

h. Exit the Registry Editor.[/log]

[inlägget ändrat 2005-01-22 01:38:03 av Mentor]

22 januari, 2005

kolla här http://www.spywarezapper.com

[inlägget ändrat 2005-01-23 17:59:20 av Brynäsarn]

23 januari, 2005

Syns inget i Ad-aware-loggen.

Bra att Spybot har upptäckt den i alla fall. Då får vi ta till HijackThis, så ska vi nog kunna få bort den ordentligt.

HijackThis laddar du hem här:

http://www.spywareinfo.com/~merijn/downloads.html

Kör, skanna och spara loggen.

Lägg ut loggen i ditt svar på detta sätt:

Tryck på LOG-knappen i Besvara-fönstret

Klistra in loggen

Tryck igen på LOG-knappen

23 januari, 2005

Tack Cecilia för att du vill försöka hjälpa mig

[log]

Logfile of HijackThis v1.99.0

Scan saved at 23:02:02, on 2005-01-23

Platform: Windows 2000 SP3 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

C:\WINNT\System32\svchost.exe

C:\Program Files\Ahead\InCD\InCDsrv.exe

C:\WINNT\system32\regsvc.exe

C:\WINNT\system32\MSTask.exe

C:\WINNT\system32\stisvc.exe

C:\WINNT\Explorer.EXE

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\WINNT\System32\mspmspsv.exe

C:\WINNT\system32\svchost.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Ahead\InCD\InCD.exe

C:\Program Files\QuickTime\qttask.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Documents and Settings\Administrator\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.se/0SESVSE/SAOS01

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.qx.se/

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx

O4 - HKLM\..\Run: [synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [inCD] C:\Program Files\Ahead\InCD\InCD.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - Global Startup: qwe.exe

O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab

O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by19fd.bay19.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab

O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://game14.zylom.spray.se/activex/zylomloader.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{B3D8D843-D49B-42D4-96F9-0155E58387B4}: NameServer = 193.15.118.193,192.71.220.10

O23 - Service: AVG7 Alert Manager Server - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe

O23 - Service: AVG7 Update Service - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe

O23 - Service: Logical Disk Manager Administrative Service - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe

O23 - Service: InCD Helper - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe

O23 - Service: TrueVector Internet Monitor - Zone Labs Inc. - C:\WINNT\system32\ZoneLabs\vsmon.exe

[/log]

24 januari, 2005

Bra att loggen fick sina LOG-markeringar! :thumbsup:

Har du en hårdvarubrandvägg?

Eftersom Haxdoor kan tänkas ansluta till internet så är det bra om du drar ur anslutningen till internet så mycket som möjligt eller installerar ett brandväggsprogram som kan stoppa trojanen. Gratisbrandväggar finns från t ex Sygate och Kerio.

Du har väl uppdaterat Spybot?

Har du ställt in söksidan till http://g.msn.se/0SESVSE/SAOS01?'>http://g.msn.se/0SESVSE/SAOS01?

Ladda ner Stinger.exe härifrån och kör det sedan:

http://vil.nai.com/vil/stinger/

Skriv ner om det hittar något, vilka otrevligheter och i vilka filer.

Det finns många Haxdoor-varianter så vi behöver lite mer information. Tyvärr verkar de flesta svåra att få bort.

Rapporterade Trend Micros housecall något?

Kör dessa online-skanningar:

http://www3.ca.com/securityadvisor/virusinfo/scan.aspx

http://security.symantec.com/default.asp?productid=symhome&langid=ie&venid=sym

Skriv ner allt de rapporterar, vilka otrevligheter och i vilka filer.

Ställ in så att du kan se alla filer i Utforskaren:

Verktyg - Mappalternativ - Visning

Välj Visa dolda filer och mappar

Avbocka Dölj skyddade operativsystemfiler

Vilka av dessa filer finns på din dator:

i.a3d

draw32.dll

p2.ini

cm.dll

vdnt32.sys

hm.sys

memlow.sys

wd.sys

klogini.dll

klo5

ps.a3d

mszx23

vtd_16.exe

Kör HijackThis och skanna. Bocka sedan för dessa rader:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.se/0SESVSE/SAOS01 (om du inte har valt det själv)

O4 - Global Startup: qwe.exe

Avsluta alla program och fönster förutom HijackThis.

Tryck på Fix checked.

Starta om i felsäkert läge

Sök och ta bort filen:

qwe.exe

(om den finns kvar så bör det vara någonstans under C:\Windows)

Starta om i normalt läge.

Skanna med Spybot och se om det hittar något.

Om någon av online-skanningarna hittade något förut så kör dem igen och rapportera resultatet.

Ta ut en ny HijackThis-logg.

Tala om vad du har gjort och vad alla skanningarna rapporterade samt bifoga din nya HijackThis-logg.

24 januari, 2005

Hej Cecilia..

Jag har Zonelabs brandvägg men den går inte igång längre..vägrar starta.

qwe.exe Funnen och borttagen som du beskrev. Var det ett virus?

Filer som finns på min dator

ps.a3d

klogini.dll

p2.ini

klo5.sys

ps.a3d

Stinger

39998 clean files

<http://www3.ca.com/securityadvisor/virusinfo/scan.aspx>

Scan Results: Scan Completed. 19596 files scanned. No viruses found.

Symantec Online-scanning

Virus Detection:

20160 files scanned, 0 file(s) infected on your disk drives.

Efter Spybot

Haxdoor-H: Library (Fil, nothing done)

C:\WINNT\system32\klogini.dll

[log]

Logfile of HijackThis v1.99.0

Scan saved at 18:41:45, on 2005-01-24

Platform: Windows 2000 SP3 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\system32\spoolsv.exe

C:\WINNT\System32\svchost.exe

C:\Program Files\Ahead\InCD\InCDsrv.exe

C:\WINNT\system32\regsvc.exe

C:\WINNT\system32\MSTask.exe

C:\WINNT\system32\stisvc.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\WINNT\System32\mspmspsv.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\Explorer.EXE

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Ahead\InCD\InCD.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Windows NT\Accessories\WORDPAD.EXE