Lite hjälp med HJT-log mm.

26 september, 2006

Hej!

Sitter här med en bekants gammla bärbara dator med W98 som fått nåt skit i sig verkar det som. För det första så har den börjat gå väldigt "segt" och så står det ett felmeddelande på skrivbordet hela tiden:

"Security warning

A fatal error in IE has occured at 0028:C0011E36 in VXD VMM(01) + 00010E36. Error was caused by Trojan-Spy.HTML.Smitfraud.c

 System can not function in normal mode.

Please check you security settings.

 Scan your PC with any avaliable antivirus/spyware remover program to fix the problem."

Min bekante har på egen hand laddat ner ett antal "antivirsprogram" mm. och försökt bli av med "skiten" men har inte lyckats så jag tänkte göra ett försök på detta eminenta forum.

Jag har kört AdAware enl. instruktioner jag hittade här i forumet och har nu kört HiJackThis så här kommer den loggan:

26 september, 2006

Glömde loggen:

[log]Logfile of HijackThis v1.99.1

Scan saved at 10:46:22, on 2006-09-26

Platform: Windows 98 SE (Win9x 4.10.2222A)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINDOWS\SYSTEM\KERNEL32.DLL

C:\WINDOWS\SYSTEM\MSGSRV32.EXE

C:\WINDOWS\SYSTEM\SPOOL32.EXE

C:\WINDOWS\SYSTEM\MPREXE.EXE

C:\WINDOWS\SYSTEM\MSTASK.EXE

C:\WINDOWS\SYSTEM\SSDPSRV.EXE

C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE

C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE

C:\WINDOWS\SYSTEM\mmtask.tsk

C:\WINDOWS\EXPLORER.EXE

C:\WINDOWS\TASKMON.EXE

C:\WINDOWS\SYSTEM\SYSTRAY.EXE

C:\WINDOWS\SYSTEM\IRMON.EXE

C:\WINDOWS\RUNDLL32.EXE

C:\WINDOWS\LOADQM.EXE

C:\WINDOWS\SYSTEM\USBMONIT.EXE

C:\WINDOWS\IRXFER.EXE

C:\PROGRAM\MSN MESSENGER\MSNMSGR.EXE

C:\PROGRAM\MICROSOFT OFFICE\OFFICE\OSA.EXE

C:\PROGRAM\WINZIP\WZQKPICK.EXE

C:\PROGRAM\JENSENSCANDINAVIA\JENSEN AIRLINK 7554 WLAN UTILITY\INSTALLER\WIN9X\AWU.EXE

C:\WINDOWS\SYSTEM\WMIEXE.EXE

C:\WINDOWS\SYSTEM\DDHELP.EXE

C:\PROGRAM\INTERNET EXPLORER\IEXPLORE.EXE

C:\WINDOWS\SYSTEM\PSTORES.EXE

C:\HIJACKTHIS\HIJACKTHIS.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.leta.se/'>http://www.leta.se/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.leta.se/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Telenordia Internet Explorer

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy1.telia.com:8080

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX

O2 - BHO: AltaVista Toolbar - {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} - C:\WINDOWS\DOWNLO~1\CONFLICT.1\ALTAVI~1.DLL

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX

O3 - Toolbar: AltaVista Toolbar - {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} - C:\WINDOWS\DOWNLO~1\CONFLICT.1\ALTAVI~1.DLL

O4 - HKLM\..\Run: [scanRegistry] C:\WINDOWS\scanregw.exe /autorun

O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe

O4 - HKLM\..\Run: [systemTray] SysTray.Exe

O4 - HKLM\..\Run: [irMon] IrMon.exe

O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\Run: [iCSDCLT] C:\WINDOWS\rundll32.exe C:\WINDOWS\SYSTEM\icsdclt.dll,ICSClient

O4 - HKLM\..\Run: [Aktivitetsfältet] SysTray.Exe

O4 - HKLM\..\Run: [LoadQM] loadqm.exe

O4 - HKLM\..\Run: [Gene USB Monitor] C:\WINDOWS\SYSTEM\USBMonit.exe

O4 - HKLM\..\Run: [MSN Messenger] C:\WINDOWS\SYSTEM\msmsgs.exe

O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

O4 - HKLM\..\RunServices: [schedulingAgent] mstask.exe

O4 - HKLM\..\RunServices: [sSDPSRV] C:\WINDOWS\SYSTEM\ssdpsrv.exe

O4 - HKLM\..\RunServices: [KB918547] C:\WINDOWS\SYSTEM\KB918547\KB918547.EXE

O4 - HKLM\..\RunServices: [KB891711] C:\WINDOWS\SYSTEM\KB891711\KB891711.EXE

O4 - HKLM\..\RunServices: [CAISafe] C:\Program\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background

O4 - Startup: Office-autostart.lnk = C:\Program\Microsoft Office\Office\OSA.EXE

O4 - Startup: Microsoft Office Snabbsökning.lnk = C:\Program\Microsoft Office\Office\FINDFAST.EXE

O4 - Startup: WinZip Quick Pick.lnk = C:\Program\WinZip\WZQKPICK.EXE

O4 - Startup: Jensen AirLink 7554 Wlan Utility.lnk = C:\Program\JensenScandinavia\Jensen AirLink 7554 Wlan Utility\Installer\WIN9X\AWU.exe

O8 - Extra context menu item: AltaVista Sökning - file://C:\Program\ALTAVISTA Toolbar\Cache\SelectedContextSearch.htm

O8 - Extra context menu item: Translate - file://C:\Program\ALTAVISTA Toolbar\Cache\SelectedContextTranslation.htm

O9 - Extra button: Microsoft AntiSpyware helper - {AE94F600-C525-11D9-8FDE-0050DA562C1D} - C:\WINDOWS\SYSTEM\WLDR.DLL (file missing) (HKCU)

O9 - Extra 'Tools' menuitem: Microsoft AntiSpyware helper - {AE94F600-C525-11D9-8FDE-0050DA562C1D} - C:\WINDOWS\SYSTEM\WLDR.DLL (file missing) (HKCU)

O16 - DPF: {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} (AltaVista Toolbar) - http://toolbar.altavista.com/static/toolbar/altavista.cab?r=1117289453

[/log]

26 september, 2006

Titta om det finns uppdateringar till Aware

Ladda ner smitrem.exe på skrivbordet

http://noahdfear.geekstogo.com/click%20counter/click.php?id=1

Dubbelklicka på den och klicka Start så får du smitrem mappen på skrivbordet

Starta sen i felsäkert läge

Sen öppna smitRem-mappen, dubbelklicka på RunThis.bat filen och följ anvisningarna.

Efter det scanna och rensa med Aware.

Starta sen normalt och skicka smitrem logg ( C:\smitfiles.txt)och ny Hijack logg.

26 september, 2006

Hej och tack för att du hjälper till.

Den här "varningstexten" på skrivbordet försvann efter att h´jag hade kört AdAware första gången men jag gjorde efter dina instruktioner ändå. Men efter att ha kört smitrem en stund så kom det upp en ruta att "en förbjuden åtgärd var utförd och programmet måste stängas2 eller nåt sånt, jag startade om datan och här kommer loggorna:

[log] smitRem © log file

version 3.2

by noahdfear

Windows 98 [Version 4.10.2222]

Running from

C:\WINDOWS\Skrivbord\smitRem

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Pre-run SharedTask Export

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]

"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"

"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]

@="C:\WINDOWS\SYSTEM\BROWSEUI.DLL"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]

@="C:\WINDOWS\SYSTEM\BROWSEUI.DLL"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

spyaxe uninstaller NOT present

Winhound uninstaller NOT present

SpywareStrike uninstaller NOT present

AlfaCleaner uninstaller NOT present

SpyFalcon uninstaller NOT present

SpywareQuake uninstaller NOT present

SpywareSheriff uninstaller NOT present

Trust Cleaner uninstaller NOT present

SpyHeal uninstaller NOT present

VirusBurst uninstaller NOT present

BraveSentry uninstaller NOT present

Existing Pre-run Files

~~~ Program Files ~~~

~~~ Shortcuts ~~~

~~~ Favorites ~~~

~~~ system folder ~~~

amcompat.tlb

nscompat.tlb

~~~ Icons in system folder ~~~

~~~ Windows directory ~~~

wupdmgr.exe

sites.ini

~~~ Drive root ~~~

~~~ Miscellaneous Files/folders ~~~

~~~~ wininet.dll ~~~~

wininet.dll Present!!

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Starting registry repairs

Registry repairs complete

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

SharedTask Export after registry fix

(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)

Registry Pseudo-Format Mode (Not a valid reg file):

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]

"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"

"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]

@="C:\WINDOWS\SYSTEM\BROWSEUI.DLL"

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]

@="C:\WINDOWS\SYSTEM\BROWSEUI.DLL"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Deleting files

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Remaining Post-run Files

~~~ Program Files ~~~

~~~ Shortcuts ~~~

~~~ Favorites ~~~

~~~ system folder ~~~

~~~ Icons in system folder ~~~

~~~ Windows directory ~~~

~~~ Drive root ~~~

~~~ Miscellaneous Files/folders ~~~

~~~~ wininet.dll ~~~~

wininet.dll Clean!!

[/log]

[log]Logfile of HijackThis v1.99.1

Scan saved at 15:04:25, on 2006-09-26