Problem med webbläsare som öppnar fel sidor

9 december, 2006

Har ett litet problem med en polares dator som öppnar fel sidor i Internet explorer, förmodligen något program som kapat webbläsaren. Han har f-secure via bredbandsbolaget installerat. Har haft problem med msn live messenger som tydligen skickade meddelanden utan hans vetskap till folk på hans kompislista, detta är förmodligen borta då han har formaterat och ominstallerat windows XP. Hoppas på lite hjälp. Skickar med en loggfil från hijack this.

[log]Logfile of HijackThis v1.99.1

Scan saved at 22:51:40, on 2006-12-09

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program\WinPortrait\wpctrl.exe

C:\Program\Bredbandsbolaget Security Services\Common\FSM32.EXE

C:\WINDOWS\CTHELPER.EXE

C:\Program\Bredbandsbolaget\Servicecenter\servicecenter.exe

C:\Program\WinPortrait\floater.exe

C:\Program\BREDBA~1\backweb\1803213\Program\SERVIC~1.EXE

C:\Program\Bredbandsbolaget Security Services\Anti-Virus\fsgk32st.exe

C:\Program\Bredbandsbolaget Security Services\Anti-Virus\FSGK32.EXE

C:\Program\Bredbandsbolaget Security Services\backweb\1803213\program\fsbwsys.exe

C:\Program\Bredbandsbolaget Security Services\Anti-Virus\fssm32.exe

C:\Program\Bredbandsbolaget Security Services\Common\FSMA32.EXE

C:\Program\Bredbandsbolaget Security Services\Common\FSMB32.EXE

C:\WINDOWS\system32\svchost.exe

C:\Program\Bredbandsbolaget Security Services\backweb\1803213\Program\fspex.exe

C:\Program\Bredbandsbolaget Security Services\Common\FCH32.EXE

C:\Program\Bredbandsbolaget Security Services\Common\FAMEH32.EXE

C:\Program\Bredbandsbolaget Security Services\Anti-Virus\fsqh.exe

C:\Program\Bredbandsbolaget Security Services\Anti-Virus\fsrw.exe

C:\Program\Bredbandsbolaget Security Services\Anti-Virus\fsav32.exe

C:\Program\Bredbandsbolaget Security Services\FWES\Program\fsdfwd.exe

C:\WINDOWS\System32\alg.exe

C:\Program\BREDBA~1\ANTI-S~1\fsaw.exe

C:\Program\Bredbandsbolaget Security Services\FSGUI\fsguidll.exe

C:\WINDOWS\system32\WgaTray.exe

C:\WINDOWS\system32\svchost.exe

C:\DOCUME~1\Vibbe\LOKALA~1\Temp\Temporär katalog 2 för hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.internetstart.se/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [PivotSoftware] "C:\Program\WinPortrait\wpctrl.exe"

O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program\Bredbandsbolaget Security Services\Common\FSM32.EXE" /splash

O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program\Bredbandsbolaget Security Services\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW

O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program\Bredbandsbolaget Security Services\FSGUI\FSSW.EXE" /reboot

O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE

O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE

O4 - HKLM\..\Run: [bredbandsbolaget] "C:\Program\Bredbandsbolaget\Servicecenter\servicecenter.exe"

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background

O4 - Global Startup: Bredbandsbolaget Security Services.lnk = C:\Program\Bredbandsbolaget Security Services\backweb\1803213\Program\fspex.exe

O8 - Extra context menu item: &Blockera detta popup-fönster - C:\Program\Bredbandsbolaget Security Services\Anti-Spyware\blockpopups.htm

O9 - Extra button: IE-sköld - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program\Bredbandsbolaget Security Services\Anti-Spyware\ieshield.dll

O9 - Extra 'Tools' menuitem: IE-sköld... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program\Bredbandsbolaget Security Services\Anti-Spyware\ieshield.dll

O9 - Extra button: Betway.com Poker - {4CBB5C71-1BA0-49ca-93CD-159AF8AA0CC9} - C:\Program\BetwayMPP\MPPoker.exe

O9 - Extra button: bet365 Poker - {B1BA4A3F-1C95-497b-9F82-F8DA4A5C89DD} - C:\Program\bet365MPP\MPPoker.exe

O9 - Extra button: Noble Poker - {B723B1B8-9788-4684-ADA7-D1DB02E1D516} - C:\Program\Noble Poker\casino.exe

O9 - Extra 'Tools' menuitem: Noble Poker - {B723B1B8-9788-4684-ADA7-D1DB02E1D516} - C:\Program\Noble Poker\casino.exe

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra button: Ladbrokes Poker - {C2A80015-C447-4dc4-82DD-AED83D6ED57E} - C:\Program\ladbrokesMPP\MPPoker.exe

O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Program\UnibetpokerMPP\MPPoker.exe

O9 - Extra button: NordicBet Poker - {E6073F93-9541-4be4-9800-109D378EB99B} - C:\Program\nordicbetMPP\MPPoker.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15026/CTSUEng.cab

O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15026/CTPID.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{6A8EB82F-4CC6-4101-B70D-45533FD4BF77}: NameServer = 85.255.115.46,85.255.112.154

O17 - HKLM\System\CCS\Services\Tcpip\..\{F2C27814-7DC8-4D73-B042-EA05D7410912}: NameServer = 85.255.115.46,85.255.112.154

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: Bredbandsbolaget Security Services (BackWeb Plug-in - 1803213) - BackWeb Technologies Inc. - C:\Program\BREDBA~1\backweb\1803213\Program\SERVIC~1.EXE

O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program\Bredbandsbolaget Security Services\Anti-Virus\fsgk32st.exe

O23 - Service: FSBWSYS - F-Secure Corp. - C:\Program\Bredbandsbolaget Security Services\backweb\1803213\program\fsbwsys.exe

O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program\Bredbandsbolaget Security Services\FWES\Program\fsdfwd.exe

O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program\Bredbandsbolaget Security Services\Common\FSMA32.EXE

[/log]

10 december, 2006

HijackThis får inte köras inifrån den nedladdade zip-filen för då kan den inte spara några säkerhetskopior. Installera denna variant av HijackThis i stället:

http://www.thespykiller.co.uk/files/HJTsetup.exe

Ladda ner FixWareout från en av dessa platser och spara t ex på Skrivbordet:

http://downloads.subratam.org/Fixwareout.exe

http://www.bleepingcomputer.com/files/lonny/Fixwareout.exe

Stäng alla program eftersom datorn kommer att startas om snart.

Dubbelklicka på den just nedladdade filen för att starta programmet FixWareout.

Tryck sedan Next, Install, kolla att Run fixit är förbockad och tryck Finish.

Fixen börjar köra, följ alla anvisningar. När du blir ombedd att starta om datorn så gör det. Det är normalt att omstarten tar längre tid än vanligt.

Klistra in loggfilen C:\fixwareout\report.txt som normalt öppnas automatiskt och en ny HijackThis-logg i ditt svar samt skriv hur det har gått.

10 december, 2006

Här kommer loggfilerna från Fixwareout och en ny logg från Hijackthis.

[log]

Fixwareout

Last edited 12/06/2006

Post this report in the forums please

...

Prerun check

[HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

"System"="kdixs.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"PivotSoftware"="\"C:\\Program\\WinPortrait\\wpctrl.exe\""

...

Reg Entries that were deleted

...

Random Runs removed from HKLM

...

PLEASE NOTE, There WILL be LEGITIMATE FILES LISTED. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.

»»»»» Searching by size/names...

»»»»»

Search five digit cs, dm kd and jb files.

This WILL/CAN also list Legit Files, Submit them at Virustotal

Other suspects.

»»»»» Misc files.

»»»»» Checking for older varients covered by the Rem3 tool.

...

Postrun check

[HKEY_LOCAL_MACHINE\\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]

"system"=""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"PivotSoftware"="\"C:\\Program\\WinPortrait\\wpctrl.exe\""[/log]

[log]Logfile of HijackThis v1.99.1

Scan saved at 12:21:11, on 2006-12-10

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program\BREDBA~1\backweb\1803213\Program\SERVIC~1.EXE

C:\Program\Bredbandsbolaget Security Services\Anti-Virus\fsgk32st.exe

C:\Program\Bredbandsbolaget Security Services\Anti-Virus\FSGK32.EXE

C:\Program\Bredbandsbolaget Security Services\backweb\1803213\program\fsbwsys.exe

C:\Program\Bredbandsbolaget Security Services\Anti-Virus\fssm32.exe

C:\Program\Bredbandsbolaget Security Services\Common\FSMA32.EXE

C:\Program\Bredbandsbolaget Security Services\Common\FSMB32.EXE

C:\WINDOWS\system32\svchost.exe

C:\Program\Bredbandsbolaget Security Services\backweb\1803213\Program\fspex.exe

C:\Program\Bredbandsbolaget Security Services\Common\FCH32.EXE

C:\Program\Bredbandsbolaget Security Services\Anti-Virus\fsqh.exe

C:\Program\Bredbandsbolaget Security Services\Common\FAMEH32.EXE

C:\Program\Bredbandsbolaget Security Services\Anti-Virus\fsrw.exe

C:\Program\Bredbandsbolaget Security Services\Anti-Virus\fsav32.exe

C:\Program\Bredbandsbolaget Security Services\FWES\Program\fsdfwd.exe

C:\WINDOWS\system32\WgaTray.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program\WinPortrait\wpctrl.exe

C:\Program\Bredbandsbolaget Security Services\Common\FSM32.EXE

C:\WINDOWS\CTHELPER.EXE

C:\Program\Bredbandsbolaget\Servicecenter\servicecenter.exe

C:\Program\WinPortrait\floater.exe

C:\Program\BREDBA~1\ANTI-S~1\fsaw.exe

C:\Program\Bredbandsbolaget Security Services\FSGUI\fsguidll.exe

C:\Documents and Settings\Vibbe\Skrivbord\HijackThis.exe