MSN-Virus

23 juli, 2007

ok, jag har aldrig sett en fil vars namn har ett eller flera mellanslag och inte heller utan filändelse.

det finns ju program som tar bort filer men med tanke på sökvägen och att den inte innehåler något så tror jag inte dessa funkar.

du kan ju alltid försöka med tex detta program

http://killbox.net/downloads/KillBox.exe

23 juli, 2007

The file seems not to exist står det bara....

23 juli, 2007

det finns ju inget innehåll så i filen, det är väl som att jämnföra med en tom mapp. låt "objektet" vara.

det viktigaste var ju att msnfix tog bort dessa filer, speciellt dom filerna i system32 mappen

... C:\WINDOWS\album??.zip

... C:\WINDOWS\album???.zip

... C:\WINDOWS\image???.zip

... C:\WINDOWS\images??.zip

... C:\WINDOWS\images???.zip

... C:\WINDOWS\photo??.zip

... C:\WINDOWS\photo???.zip

... C:\WINDOWS\photos??.zip

... C:\WINDOWS\photos???.zip

... C:\WINDOWS\picture??.zip

... C:\WINDOWS\picture???.zip

... C:\WINDOWS\pictures???.zip

... C:\WINDOWS\system32\notiffy.dll

... C:\WINDOWS\system32\printers.exe

23 juli, 2007

ändå irriterande att filen ligger där och "finns inte" så man inte kan ta bort den

23 juli, 2007

kan inte komma på nått vettigt just nu men kan du byta namn på den, tex till baka.txt

23 juli, 2007

Man kan inte göra nått med en eftersom den inte finns

En annan vän som jobbar me datateknik sa att det inte gör nått om den ligger där för den kan inte komminucera med nått för alla de filerna är borttagna.

Men åndå irriterande, någon kan ju säga till o dom vet ett sätt att ta bort "icke existerande filer"

23 juli, 2007

Har du prövat att ta bort den i felsäkert läge?

Kan du flytta på filen ?

26 juli, 2007

Jag har prövat att flytta o ta bort, även i felsäkert läge.

26 juli, 2007

gör en scan med f-secures blacklight

29 juli, 2007

Jag fick denna loggen!

[log]MSN_Fix 1.447

C:\Documents and Settings\Andreas Kvarnstr”m\Skrivbord\MSNFix

Scan done at 2007-07-29 - 23:59:07,31 By Andreas Kvarnstr”m

normal mode

************************ Checking Files

... C:\WINDOWS\system32\libcintles3.dll

************************ Checking Folder

No Folder Found

************************ Deleting malware Files

/!\ ... C:\WINDOWS\system32\libcintles3.dll

************************ Registry Cleaning

Others Files will be delete after a reboot on normal mode

No Folder Found

************************ Deleting malware Files

.. OK ... C:\WINDOWS\system32\libcintles3.dll

************************ Suspect Files

/!\ The detected files must be controlled by a helper before any other handling

[C:\WINDOWS\photos2007_94.zip] EC405376BD7F23916E3A470CDF774FF4

[C:\WINDOWS\photos2007_52.zip] 9C58A6496DD5692C03F3A9EDBE57410B

[C:\WINDOWS\beyonce.scr] 3FE60B7095FF95BEC3662E450C7248FD

[C:\WINDOWS\b_marley.scr] E469663F4EF57BF10FEF0AE0E88FE6BE

The Files and Registry deleted have been save in 2007-07-30_ 0094634.zip[/log]

29 juli, 2007

det var ju kul men det är ingen bra med två problem i samma tråd.

starta en ny tråd, posta en hijacktis logg och berätta om dessa filer är dina

C:\WINDOWS\photos2007_94.zip

C:\WINDOWS\photos2007_52.zip

25 november, 2007

Hej har fått ett msn virus som skickar en massa skumma medelanden som "ahahaha sexxxy" till min kontakter. Har gjort exakt som "cecilia" skrivit att man ska göra. har kommer min logg från superantispyware: [log]SUPERAntiSpyware Scan Log

http://www.superantispyware.com

Generated 11/25/2007 at 08:59 PM

Application Version : 3.9.1008

Core Rules Database Version : 3259

Trace Rules Database Version: 1270

Scan type : Complete Scan

Total Scan Time : 01:08:58

Memory items scanned : 168

Memory threats detected : 0

Registry items scanned : 5384

Registry threats detected : 1

File items scanned : 62723

File threats detected : 95

Trojan.Media-Codec

HKU\S-1-5-21-4287499240-129385031-2460320682-1007\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser#{479FD0CF-5BE9-4C63-8CDA-B6D371C67BD5}

Adware.Tracking Cookie

C:\Documents and Settings\Dida\Cookies\dida@bs.serving-sys[1].txt

C:\Documents and Settings\Dida\Cookies\dida@statse.webtrendslive[1].txt

C:\Documents and Settings\Dida\Cookies\dida@www.googleadservices[3].txt

C:\Documents and Settings\Dida\Cookies\dida@ehg-playboy.hitbox[2].txt

C:\Documents and Settings\Dida\Cookies\dida@hitbox[2].txt

C:\Documents and Settings\Dida\Cookies\dida@mtgnewmedia[2].txt

C:\Documents and Settings\Dida\Cookies\dida@casalemedia[1].txt

C:\Documents and Settings\Dida\Cookies\dida@www.addfreestats[1].txt

C:\Documents and Settings\Dida\Cookies\dida@atwola[1].txt

C:\Documents and Settings\Dida\Cookies\dida@eas.apm.emediate[1].txt

C:\Documents and Settings\Dida\Cookies\dida@msnportal.112.2o7[1].txt

C:\Documents and Settings\Dida\Cookies\dida@adserver.eniro[1].txt

C:\Documents and Settings\Dida\Cookies\dida@realmedia[1].txt

C:\Documents and Settings\Dida\Cookies\dida@ehg-segaofamerica.hitbox[2].txt

C:\Documents and Settings\Dida\Cookies\dida@mediaplex[1].txt

C:\Documents and Settings\Dida\Cookies\dida@metacafe.122.2o7[1].txt

C:\Documents and Settings\Dida\Cookies\dida@fastclick[1].txt

C:\Documents and Settings\Dida\Cookies\dida@adserver.banneradministration[2].txt

C:\Documents and Settings\Dida\Cookies\dida@adserver.71i[2].txt

C:\Documents and Settings\Dida\Cookies\dida@ads.pointroll[1].txt

C:\Documents and Settings\Dida\Cookies\dida@clicktorrent[2].txt

C:\Documents and Settings\Dida\Cookies\dida@banner.casinoking[2].txt

C:\Documents and Settings\Dida\Cookies\dida@e2.emediate[2].txt

C:\Documents and Settings\Dida\Cookies\dida@server.cpmstar[2].txt

C:\Documents and Settings\Dida\Cookies\dida@www.googleadservices[2].txt

C:\Documents and Settings\Dida\Cookies\dida@questionmarket[2].txt

C:\Documents and Settings\Dida\Cookies\dida@worldlingomedia[1].txt

C:\Documents and Settings\Dida\Cookies\dida@atdmt[1].txt

C:\Documents and Settings\Dida\Cookies\dida@www.worldlingomedia[1].txt

C:\Documents and Settings\Dida\Cookies\dida@advertising[1].txt

C:\Documents and Settings\Dida\Cookies\dida@ad1.emediate[2].txt

C:\Documents and Settings\Dida\Cookies\dida@ads.adbrite[1].txt

C:\Documents and Settings\Dida\Cookies\dida@overture[1].txt

C:\Documents and Settings\Dida\Cookies\dida@tradedoubler[1].txt

C:\Documents and Settings\Dida\Cookies\dida@banners2.battleon[1].txt

C:\Documents and Settings\Dida\Cookies\dida@stepstone.112.2o7[1].txt

C:\Documents and Settings\Dida\Cookies\dida@ad.zanox[1].txt

C:\Documents and Settings\Dida\Cookies\dida@ehg-ifilm.hitbox[1].txt

C:\Documents and Settings\Dida\Cookies\dida@www.burstnet[1].txt

C:\Documents and Settings\Dida\Cookies\dida@youporn[1].txt

C:\Documents and Settings\Dida\Cookies\dida@counter6.sextracker[1].txt

C:\Documents and Settings\Dida\Cookies\dida@doubleclick[1].txt

C:\Documents and Settings\Dida\Cookies\dida@sextracker[1].txt

C:\Documents and Settings\Dida\Cookies\dida@ehg-wssuk.hitbox[1].txt

C:\Documents and Settings\Dida\Cookies\dida@adultadworld[2].txt

C:\Documents and Settings\Dida\Cookies\dida@revsci[2].txt

C:\Documents and Settings\Dida\Cookies\dida@imrworldwide[2].txt

C:\Documents and Settings\Dida\Cookies\dida@serving-sys[1].txt

C:\Documents and Settings\Dida\Cookies\dida@videoegg.adbureau[2].txt

C:\Documents and Settings\Dida\Cookies\dida@zedo[1].txt

C:\Documents and Settings\Dida\Cookies\dida@xiti[1].txt

C:\Documents and Settings\Dida\Cookies\dida@tribalfusion[1].txt

C:\Documents and Settings\Dida\Cookies\dida@ad.adtoma[2].txt

C:\Documents and Settings\Dida\Cookies\dida@burstnet[1].txt

C:\Documents and Settings\Dida\Cookies\dida@track.adform[2].txt

C:\Documents and Settings\Dida\Cookies\dida@statcounter[1].txt

C:\Documents and Settings\Dida\Cookies\dida@2o7[2].txt

C:\Documents and Settings\Dida\Cookies\dida@adtech[1].txt

C:\Documents and Settings\Dida\Cookies\dida@www.googleadservices[1].txt

C:\Documents and Settings\Dida\Cookies\dida@adbrite[1].txt

C:\Documents and Settings\Dida\Cookies\dida@rocku.adbureau[2].txt

C:\Documents and Settings\Dida\Cookies\dida@tacoda[2].txt

C:\Documents and Settings\Anna\Cookies\anna@ad.adtoma[1].txt

C:\Documents and Settings\Anna\Cookies\anna@ad.zanox[1].txt

C:\Documents and Settings\Anna\Cookies\anna@ad1.emediate[1].txt

C:\Documents and Settings\Anna\Cookies\anna@ads1.partnerlogic[1].txt

C:\Documents and Settings\Anna\Cookies\anna@adserver.banneradministration[2].txt

C:\Documents and Settings\Anna\Cookies\anna@adserver.eniro[2].txt

C:\Documents and Settings\Anna\Cookies\anna@banner.casinoking[2].txt

C:\Documents and Settings\Anna\Cookies\anna@dtftravel.112.2o7[1].txt

C:\Documents and Settings\Anna\Cookies\anna@dztadserver.dx-work[2].txt

C:\Documents and Settings\Anna\Cookies\anna@ehg-abupsala.hitbox[2].txt

C:\Documents and Settings\Anna\Cookies\anna@ehg-skistar.hitbox[1].txt

C:\Documents and Settings\Anna\Cookies\anna@hbxtracking.sueddeutsche[1].txt

C:\Documents and Settings\Anna\Cookies\anna@hitbox[2].txt

C:\Documents and Settings\Anna\Cookies\anna@impse.tradedoubler[1].txt

C:\Documents and Settings\Anna\Cookies\anna@interclick[2].txt

C:\Documents and Settings\Anna\Cookies\anna@komtrack[2].txt

C:\Documents and Settings\Anna\Cookies\anna@matklubben.banneradministration[2].txt

C:\Documents and Settings\Anna\Cookies\anna@media.adrevolver[1].txt

C:\Documents and Settings\Anna\Cookies\anna@members.tripod[2].txt

C:\Documents and Settings\Anna\Cookies\anna@msnportal.112.2o7[1].txt

C:\Documents and Settings\Anna\Cookies\anna@postclicktracking[2].txt

C:\Documents and Settings\Anna\Cookies\anna@sales.liveperson[1].txt

C:\Documents and Settings\Anna\Cookies\anna@stat.swedbank[1].txt

C:\Documents and Settings\Anna\Cookies\anna@statse.webtrendslive[1].txt

C:\Documents and Settings\Anna\Cookies\anna@tacoda[1].txt

C:\Documents and Settings\Anna\Cookies\anna@tipset.medianet[1].txt

C:\Documents and Settings\Anna\Cookies\anna@track.adform[2].txt

C:\Documents and Settings\Anna\Cookies\anna@tracking.notabenestats[1].txt

C:\Documents and Settings\Anna\Cookies\anna@tripod[2].txt

C:\Documents and Settings\Anna\Cookies\anna@worldlingomedia[2].txt

C:\Documents and Settings\Anna\Cookies\anna@www.googleadservices[1].txt

C:\Documents and Settings\Anna\Cookies\anna@www.googleadservices[2].txt

C:\Documents and Settings\Anna\Cookies\anna@www.worldlingomedia[2].txt[/log]

vore underbart om nån kunde kolla så att allt är som det ska.

[inlägget ändrat 2007-11-25 23:58:02 av Cecilia]

25 november, 2007

Till den MSN-mask som cirkulerar för tillfället så är inte SUPERAntiSpyware till så mycket hjälp.

Vi kan ju se om HijackThis visar något till att börja med:

http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe

Installera, kör, skanna och spara loggen (inget annat).

I ditt svar bifogar du HijackThis-loggen på detta sätt:

Tryck på LOG-knappen i Besvara-fönstret

Klistra in loggen

Tryck igen på LOG-knappen

Ladda ner MSN_Fix till Skrivbordet.

http://sosvirus.changelog.fr/MSNFix.zip

Packa upp filen och starta MSNFix.bat genom att dubbelklicka på den.

Välj språk genom att trycka på motsvarande bokstav.

Tryck R för att starta skanningen.

Om något hittas så tryck på valfri tangent för att starta borttagningen.

Ibland så kommer det upp ett meddelande om att starta om datorn, gör det i så fall.

Klistra in loggen som kommer upp i ditt svar här på samma sätt med LOG-knappen.

Om den inte kommer upp så hittar du den i den mappen där programmet ligger och namnet på loggen innehåller datum och klockslag för körningen.

27 november, 2007

Hej, här kommer min Hijackthis log, försökte med msnfix men när jag tryckte "R" kom det bara upp en ruta med "windows ingen disk" där man kunde trycka "fortsätt" "avbryt" eller "försök igen " vad jag än tryckte på kom det bara upp en ny likadan ruta. Men här kommer HT loggen iaf:[log]Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 17:14:43, on 2007-11-27

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program\Panda Software\Panda Platinum 2006 Internet Security\pavsrv51.exe

C:\Program\Panda Software\Panda Platinum 2006 Internet Security\AVENGINE.EXE

C:\WINDOWS\system32\svchost.exe

C:\Program\Panda Software\Panda Platinum 2006 Internet Security\TPSrv.exe

c:\program\panda software\panda platinum 2006 internet security\firewall\PNMSRV.EXE

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program\Winamp\winampa.exe

C:\Program\Java\jre1.5.0_10\bin\jusched.exe

C:\Program\QuickTime\qttask.exe

C:\Program\Dell\Media Experience\PCMService.exe

C:\Program\iTunes\iTunesHelper.exe

C:\Program\CyberLink\PowerDVD\DVDLauncher.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program\Dell AIO Printer A920\dlbkbmgr.exe

C:\Program\Panda Software\Panda Platinum 2006 Internet Security\APVXDWIN.EXE

C:\Program\Dell AIO Printer A920\dlbkbmon.exe

C:\Program\Windows Live\Messenger\msnmsgr.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

C:\Program\Glocalnet Bredband\Bredbandsklienten\GlocalnetBredbandService.exe

C:\Program\Delade filer\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\System32\nvsvc32.exe

C:\Program\Panda Software\Panda Platinum 2006 Internet Security\PavFnSvr.exe

C:\Program\Delade filer\Panda Software\PavShld\pavprsrv.exe

C:\Program\Panda Software\Panda Platinum 2006 Internet Security\AntiSpam\pskmssvc.exe

C:\Program\Panda Software\Panda Platinum 2006 Internet Security\psimsvc.exe

C:\WINDOWS\System32\svchost.exe

C:\Program\iPod\bin\iPodService.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program\Panda Software\Panda Platinum 2006 Internet Security\SRVLOAD.EXE

c:\program\panda software\panda platinum 2006 internet security\WebProxy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program\Internet Explorer\iexplore.exe

C:\Program\Delade filer\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Program\Panda Software\Panda Platinum 2006 Internet Security\psimreal.exe

C:\Program\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157'>http://go.microsoft.com/fwlink/?LinkId=69157'>http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896'>http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=488

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Delade filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_10\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\Windows Live Toolbar\msntb.dll

O4 - HKLM\..\Run: [WinampAgent] C:\Program\Winamp\winampa.exe

O4 - HKLM\..\Run: [updateManager] "C:\Program\Delade filer\Sonic\Update Manager\sgtray.exe" /r

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program\Java\jre1.5.0_10\bin\jusched.exe"

O4 - HKLM\..\Run: [sCANINICIO] "C:\Program\Panda Software\Panda Platinum 2006 Internet Security\Inicio.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [PCMService] "C:\Program\Dell\Media Experience\PCMService.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [DVDLauncher] "C:\Program\CyberLink\PowerDVD\DVDLauncher.exe"

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program\Dell AIO Printer A920\dlbkbmgr.exe"

O4 - HKLM\..\Run: [APVXDWIN] "C:\Program\Panda Software\Panda Platinum 2006 Internet Security\APVXDWIN.EXE" /s

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Program\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Policies\Explorer\Run: [NTSpool] NTSpool.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJÄNST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Personal.lnk = C:\Program\Personal\bin\Personal.exe

O8 - Extra context menu item: &Windows Live Search - res://C:\Program\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O17 - HKLM\System\CCS\Services\Tcpip\..\{4773AAE2-D9F4-4EE0-867A-6FA099140668}: NameServer = 195.58.103.130 195.58.103.18

O23 - Service: Glocalnet Bredband (GlocalnetBredbandClientService) - Glocalnet AB - C:\Program\Glocalnet Bredband\Bredbandsklienten\GlocalnetBredbandService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Program\iPod\bin\iPodService.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program\Intel\NCS\Sync\NetSvc.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program\Panda Software\Panda Platinum 2006 Internet Security\PavFnSvr.exe

O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program\Delade filer\Panda Software\PavShld\pavprsrv.exe

O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program\Panda Software\Panda Platinum 2006 Internet Security\pavsrv51.exe

O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program\Panda Software\Panda Platinum 2006 Internet Security\AntiSpam\pskmssvc.exe

O23 - Service: Panda Network Manager (PNMSRV) - Panda Software International - c:\program\panda software\panda platinum 2006 internet security\firewall\PNMSRV.EXE

O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software - C:\Program\Panda Software\Panda Platinum 2006 Internet Security\psimsvc.exe

O23 - Service: Panda TPSrv (TPSrv) - Panda Software - C:\Program\Panda Software\Panda Platinum 2006 Internet Security\TPSrv.exe

--

End of file - 8856 bytes

[/log]

27 november, 2007

Starta om datorn i felsäkert läge (tryck F8 upprepade gånger under uppstarten och välj felsäkert läge i menyn).

[log]Skanna med HijackThis och bocka för:

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKCU\..\Policies\Explorer\Run: [NTSpool] NTSpool.exe

Avsluta alla andra program.

Tryck Fix checked.

Ställ in Utforskaren så att du kan se alla filer:

Verktyg - Mappalternativ - Visning

Välj Visa dolda filer och mappar

Avbocka Dölj filnamnstillägg för kända filtyper

Avbocka Dölj skyddade operativsystemfiler

Ta bort filerna (om de finns kvar):

C:\WINDOWS\System32\NTSpool.exe

Om det finns några filer pics10.zip eller med andra siffror och som har skapats nu med infektionen så ta bort dem också.

Starta om i normalt läge och kontrollera själv att ovanstående rad är borta ur en ny HijackThis-logg.

Det är en gammal Java-version med säkerhetshål i datorn. Jag rekommenderar dig att installera en ny från http://www.java.com/sv/ och därefter avinstallera alla Java/J2SE/JRE utom den senaste i Kontrollpanelen - Lägg till eller ta bort program (inga webbläsare igång).[/log]

27 november, 2007

ok, tack så jättemycket =)

27 november, 2007

När du har gjort alltihop och raden är borta så är det dags att provköra MSN.

9 december, 2007

Hallå, jag är ny här och vill ha hjälp med att få bort virus från Msn. Så jag ska börja me HijackThis? Sen lägga upp loggen?

[inlägget ändrat 2007-12-09 20:19:11 av Golzmo]

9 december, 2007

[log]Ladda ner ComboFix på Skrivbordet:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Kör den och följ anvisningarna som visas.

VIKTIGT! Klicka inte på Combofix-fönstret med musen när den körs annars kan den hänga upp sig.

När den är färdig så ska en logg komma upp, klistra in den här.

I ditt svar bifogar du loggen på detta sätt:

Tryck på LOG-knappen i Besvara-fönstret

Klistra in loggen

Tryck igen på LOG-knappen[/log]

9 december, 2007

Hej!

Jag har problem med msn-virus. Kan du hjälpa mig också?

[log]SUPERAntiSpyware Scan Log

http://www.superantispyware.com

Generated 12/09/2007 at 10:41 PM

Application Version : 3.9.1008

Core Rules Database Version : 3259

Trace Rules Database Version: 1270

Scan type : Complete Scan

Total Scan Time : 00:58:56

Memory items scanned : 168

Memory threats detected : 0

Registry items scanned : 6860

Registry threats detected : 31

File items scanned : 39026

File threats detected : 10

Adware.MyWebSearch

[MyWebSearch Email Plugin] C:\PROGRAM\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE

C:\PROGRAM\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE

[MyWebSearch Email Plugin] C:\PROGRAM\MYWEBS~1\BAR\1.BIN\MWSOEMON.EXE

HKLM\Software\Classes\CLSID\{00A6FAF1-072E-44cf-8957-5838F569A31D}

HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}

HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}\InprocServer32

HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}\InprocServer32#ThreadingModel

HKCR\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}\Programmable

C:\PROGRAM\MYWEBSEARCH\SRCHASTT\1.BIN\MWSSRCAS.DLL

HKLM\Software\Classes\CLSID\{00A6FAF6-072E-44cf-8957-5838F569A31D}

HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}

HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\InprocServer32

HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\InprocServer32#ThreadingModel

HKCR\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}\Programmable

HKLM\Software\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}

HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}

HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\InprocServer32

HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\InprocServer32#ThreadingModel

HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\Programmable

HKCR\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}\TypeLib

C:\PROGRAM\MYWEBSEARCH\BAR\1.BIN\MWSBAR.DLL

HKLM\Software\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}

HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}

HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\InprocServer32

HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\InprocServer32#ThreadingModel

HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\Programmable

HKCR\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}\TypeLib

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}

HKU\S-1-5-21-1151725167-3917115542-1333564759-1007\Software\Microsoft\Internet Explorer\URLSearchHooks#{00A6FAF6-072E-44cf-8957-5838F569A31D}

C:\PROGRAM\MYWEBSEARCH\BAR\1.BIN\MWSOEMON.EXE

C:\DOCUMENTS AND SETTINGS\ALL USERS\START-MENY\PROGRAM\AUTOSTART\MYWEBSEARCH EMAIL PLUGIN.LNK

C:\WINDOWS\Prefetch\MWSOEMON.EXE-019502CF.pf

C:\WINDOWS\Prefetch\MWSOEMON.EXE-2DB69FA6.pf

Adware.Tracking Cookie

C:\Documents and Settings\Emma\Cookies\emma@mywebsearch[1].txt

C:\Documents and Settings\Emma\Cookies\emma@msnportal.112.2o7[1].txt

C:\Documents and Settings\Emma\Cookies\emma@imrworldwide[2].txt

[/log]

[log]Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:03:15, on 2007-12-09

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program\Delade filer\Symantec Shared\ccSetMgr.exe

C:\Program\Delade filer\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program\Delade filer\Symantec Shared\ccProxy.exe

C:\WINDOWS\system32\CTsvcCDA.EXE

C:\WINDOWS\System32\svchost.exe

C:\Program\Delade filer\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program\Norton Internet Security\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program\Delade filer\Symantec Shared\SNDSrvc.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program\Norton Internet Security\Norton AntiVirus\SAVScan.exe

C:\Program\Java\jre1.5.0_10\bin\jusched.exe

C:\Program\HPQ\Quick Launch Buttons\EabServr.exe

C:\Program\Synaptics\SynTP\SynTPLpr.exe

C:\Program\Synaptics\SynTP\SynTPEnh.exe

C:\Program\HP\Digital Imaging\Unload\hpqcmon.exe

C:\Program\HP\HP Share-to-Web\hpgs2wnd.exe

C:\WINDOWS\System32\hphmon05.exe

C:\Program\Delade filer\Nokia\NCLTools\NCLConf.exe

C:\Program\Microsoft IntelliPoint\point32.exe

C:\Program\Hewlett-Packard\HP Software Update\HPWuSchd2.exe

C:\Program\MYWEBS~1\bar\1.bin\mwsoemon.exe

C:\Program\Delade filer\Symantec Shared\ccApp.exe

C:\Program\HP\HP Share-to-Web\hpgs2wnf.exe

C:\Program\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\MSN Messenger\msnmsgr.exe

C:\WINDOWS\system32\wnpcgs.exe

C:\Program\Creative\MediaSource\Detector\CTDetect.exe

C:\Program\Creative\Sync Manager Unicode\CTSyncU.exe

C:\Program\Windows Media Player\WMPNSCFG.exe

C:\Program\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program\iPod\bin\iPodService.exe

C:\Program\MSN Toolbar Suite\DS\02.05.0001.1119\sv-se\bin\WindowsSearch.exe

C:\Program\MSN Toolbar Suite\DS\02.05.0001.1119\sv-se\bin\WindowsSearchIndexer.exe

C:\Program\Internet Explorer\iexplore.exe

C:\Program\Delade filer\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\WINDOWS\system32\notepad.exe

C:\Program\MSN Toolbar Suite\DS\02.05.0001.1119\sv-se\bin\WindowsSearchFilter.exe

C:\Program\Messenger\msmsgs.exe

C:\Program\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.se/0SESVSE/SAOS01

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.se/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157'>http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896'>http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL

O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program\MyWebSearch\bar\1.bin\MWSBAR.DLL

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_10\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Web assistant - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program\Delade filer\Symantec Shared\AdBlocking\NISShExt.dll

O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\MSN Toolbar Suite\TB\02.05.0000.1105\sv-se\msntb.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\MSN Toolbar Suite\TB\02.05.0000.1105\sv-se\msntb.dll

O3 - Toolbar: Web assistant - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program\Delade filer\Symantec Shared\AdBlocking\NISShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program\Norton Internet Security\Norton AntiVirus\NavShExt.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program\Java\jre1.5.0_10\bin\jusched.exe"

O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program\HPQ\Quick Launch Buttons\EabServr.exe /Start

O4 - HKLM\..\Run: [updateManager] "C:\Program\Delade filer\Sonic\Update Manager\sgtray.exe" /r

O4 - HKLM\..\Run: [synTPLpr] C:\Program\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [CamMonitor] C:\Program\HP\Digital Imaging\Unload\hpqcmon.exe

O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] C:\Program\HP\HP Share-to-Web\hpgs2wnd.exe

O4 - HKLM\..\Run: [HPHUPD05] c:\Program\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe

O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe

O4 - HKLM\..\Run: [Cpqset] C:\Program\HPQ\Default Settings\cpqset.exe

O4 - HKLM\..\Run: [Nokia Connection Monitor] "C:\Program\Delade filer\Nokia\NCLTools\NCLConf.exe"

O4 - HKLM\..\Run: [intelliPoint] "C:\Program\Microsoft IntelliPoint\point32.exe"

O4 - HKLM\..\Run: [HP Software Update] "C:\Program\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [iCQ Lite] C:\Program\ICQLite\ICQLite.exe -minimize

O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\Program\MYWEBS~1\bar\1.bin\mwsoemon.exe

O4 - HKLM\..\Run: [OM_Monitor] C:\Program\OLYMPUS\OLYMPUS Master\FirstStart.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program\Delade filer\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [urlLSTCK.exe] C:\Program\Norton Internet Security\UrlLstCk.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Windows Remote Addressing] wnpcgs.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\Program\MYWEBS~1\bar\1.bin\mwsoemon.exe

O4 - HKCU\..\Run: [OM_Monitor] C:\Program\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart

O4 - HKCU\..\Run: [Creative Detector] C:\Program\Creative\MediaSource\Detector\CTDetect.exe /R

O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program\Creative\Sync Manager Unicode\CTSyncU.exe"

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJÄNST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: MyWebSearch Email Plugin.lnk = C:\Program\MyWebSearch\bar\1.bin\MWSOEMON.EXE

O4 - Global Startup: Ringo Launcher.lnk = C:\Program\Ringo\Hub.exe

O4 - Global Startup: Windows Desktop Search.lnk = C:\Program\MSN Toolbar Suite\DS\02.05.0001.1119\sv-se\bin\WindowsSearch.exe

O8 - Extra context menu item: &MSN Search - res://C:\Program\MSN Toolbar Suite\TB\02.05.0000.1105\sv-se\msntb.dll/search.htm

O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZSzeb029YYSE_ZS