Hijackthis hjälp

15 januari, 2011

Misstänker att jag drabbats av ett flertal virus. Bl a ett som ställer om klockan vid varje inloggning. Har kört ett Hijack this log men är osäker på vilka jag kan ta bort.

Någon som kan ta sig en titt ?

[log]Logfile of HijackThis v1.99.1

Scan saved at 10:10:02, on 2010-11-23

Platform: Windows 2000 SP4 (WinNT 5.00.2195)

MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:

C:\WINNT\System32\smss.exe

C:\WINNT\system32\winlogon.exe

C:\WINNT\system32\services.exe

C:\WINNT\system32\lsass.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\system32\LEXBCES.EXE

C:\WINNT\system32\spoolsv.exe

C:\WINNT\system32\LEXPPS.EXE

C:\Program\AVG\AVG8\avgwdsvc.exe

C:\WINNT\system32\bgsvcgen.exe

C:\WINNT\System32\svchost.exe

C:\Program\Java\jre6\bin\jqs.exe

C:\WINNT\System32\nvsvc32.exe

C:\WINNT\system32\MSTask.exe

C:\WINNT\system32\stisvc.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\Program\AVG\AVG8\avgrsx.exe

C:\WINNT\system32\mspmspsv.exe

C:\WINNT\system32\svchost.exe

C:\WINNT\Explorer.exe

C:\Program\AVG\AVG8\avgtray.exe

C:\Program\Delade filer\Java\Java Update\jusched.exe

C:\WINNT\system32\internat.exe

C:\Program\Skype\Phone\Skype.exe

C:\Program\DAEMON Tools Lite\daemon.exe

C:\Program Files\FinePixViewer\QuickDCF2.exe

C:\Program\Personal\bin\Personal.exe

C:\Program\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe

C:\Program\Packard Bell Diamond 1200Plus\Driver\WATCH.exe

C:\Program\Microsoft Office\Office\OSA.EXE

C:\Program\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe

C:\WINNT\System32\SCardSvr.exe

C:\Program\Mozilla Firefox\firefox.exe

C:\Program\Delade filer\Java\Java Update\jucheck.exe

C:\Program\Outlook Express\msimn.exe

C:\Program\AVG\AVG8\avgnsx.exe

C:\Program\Microsoft Office\Office\Winword.exe

C:\Program\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.blt.se/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896'>http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

F2 - REG:system.ini: Shell=Explorer.exe %windir%\system32\drivers\Scqs.exe

O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program\AskBarDis\bar\bin\askBar.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program\AVG\AVG8\avgssie.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program\AskBarDis\bar\bin\askBar.dll

O3 - Toolbar: FreeRIP.com Toolbar - {081230F8-EA50-42A9-983C-D22ABC2EED3B} - C:\Program\FreeRIP3\toolband.dll

O4 - HKLM\..\Run: [synchronization Manager] mobsync.exe /logon

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [AVG8_TRAY] C:\Program\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [Microsoft Driver Setup] C:\WINNT\system32\drivers\Cafgm.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program\Delade filer\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [sta] rundll32 "stcup.dll",,Run

O4 - HKLM\..\Run: [MChk] C:\WINNT\system32\ftcup.exe

O4 - HKLM\..\Run: [szetyj67v] C:\WINNT\system32\szetyj67v.exe

O4 - HKLM\..\Run: [szetyj67vx] C:\WINNT\system32\szetyj67vx.exe

O4 - HKCU\..\Run: [internat.exe] internat.exe

O4 - HKCU\..\Run: [skype] "C:\Program\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [COM+ Manager] "C:\Documents and Settings\Per Johansson\.COMMgr\complmgr.exe"

O4 - HKCU\..\Run: [XBV6RD5SZF] C:\DOCUME~1\PERJOH~1\LOKALA~1\Temp\Yzk.exe

O4 - Startup: Microsoft Office Snabbsökning.lnk = C:\Program\Microsoft Office\Office\FINDFAST.EXE

O4 - Startup: Office-autostart.lnk = C:\Program\Microsoft Office\Office\OSA.EXE

O4 - Startup: Picture Motion Browser verktyg för mediekontroll.lnk = C:\Program\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Exif Launcher 2.lnk = C:\Program Files\FinePixViewer\QuickDCF2.exe

O4 - Global Startup: Personal.lnk = C:\Program\Personal\bin\Personal.exe

O4 - Global Startup: Ulead Photo Express 3.0 SE Calendar Checker.lnk = C:\Program\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe

O4 - Global Startup: Watch.lnk = C:\Program\Packard Bell Diamond 1200Plus\Driver\WATCH.exe

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

O8 - Extra context menu item: &FreeRIP Search - res://C:\Program\FreeRIP3\toolband.dll/MENUSEARCH.HTM

O16 - DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} (IPSUploader4 Control) - https://asp.photoprintit.de/microsite/5025/defaults/activex/ips/IPSUploader4.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program\AVG\AVG8\avgpp.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINNT\SYSTEM32\avgrsstx.dll

O20 - Winlogon Notify: nwprovau - C:\WINNT\SYSTEM32\nwprovau.dll

O23 - Service: ASKUpgrade - Unknown owner - C:\Program\AskBarDis\bar\bin\ASKUpgrade.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgwdsvc.exe

O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINNT\system32\bgsvcgen.exe

O23 - Service: DegCs Controler - Unknown owner - C:\WINNT\system32\drivers\DegCs.exe (file missing)

O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program\Java\jre6\bin\jqs.exe" -service -config "C:\Program\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINNT\System32\nvsvc32.exe[/log]

15 januari, 2011

Hej,

kör en DDS, den visar mera än en Hijack This!

Klistra in loggen/resultatet från programmet DDS. Spara DDS på Skrivbordet.

http://download.blee...om/sUBs/dds.scr

Starta programmet genom att dubbelklicka på det.

Tryck Yes/Ja om frågan om Optional Scan dyker upp.

I ditt svar klistrar du in loggen DSS.txt. Medan du bifogar Attach.txt som en fil.

DDS är ett program som listar processer som kör, program och tjänster som startas automatiskt samt filer i sådana mappar som är vanliga att skadliga program och som är nya eller ändrade under senaste 1-3 månader. DDS är ett mycket vanligt program bland oss som hjälper till att rensa datorer. Resultatet ger oss en grundläggande kunskap om vad som händer och har hänt nyligen i datorn, och från det kan vi dra slutsatser om vad som är nästa lämpliga steg i rensningen av datorn.

Obs! När du klistrar in en logg eller ett resultat i ditt inlägg använd inga knappar eller taggar utan kopiera det i programmet (oftast Anteckningar) och klistra in det direkt i rutan du skriver i.

Mvh

Mats H

15 januari, 2011

Såhär blev DDS.txt:

DDS (Ver_10-12-12.02) - NTFSx86

Run by Per Johansson at 14:05:39,77 on ti 2010-11-23

Internet Explorer: 6.0.2800.1106 BrowserJavaVersion: 1.6.0_18

Microsoft Windows 2000 Professional 5.0.2195.4.1252.46.1053.18.639.265 [GMT 1:00]

============== Running Processes ===============

C:\WINNT\system32\LEXBCES.EXE

C:\WINNT\system32\spoolsv.exe

C:\WINNT\system32\LEXPPS.EXE

C:\Program\AVG\AVG8\avgwdsvc.exe

C:\WINNT\system32\bgsvcgen.exe

C:\Program\Java\jre6\bin\jqs.exe

C:\WINNT\System32\nvsvc32.exe

C:\WINNT\system32\MSTask.exe

C:\WINNT\system32\stisvc.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\Program\AVG\AVG8\avgrsx.exe

C:\WINNT\system32\mspmspsv.exe

C:\WINNT\Explorer.exe

C:\Program\AVG\AVG8\avgtray.exe

C:\Program\Delade filer\Java\Java Update\jusched.exe

C:\WINNT\system32\internat.exe

C:\Program\Skype\Phone\Skype.exe

C:\Program\DAEMON Tools Lite\daemon.exe

C:\Program Files\FinePixViewer\QuickDCF2.exe

C:\Program\Personal\bin\Personal.exe

C:\Program\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe

C:\Program\Packard Bell Diamond 1200Plus\Driver\WATCH.exe

C:\Program\Microsoft Office\Office\OSA.EXE

C:\Program\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe

C:\WINNT\System32\SCardSvr.exe

C:\Program\Delade filer\Java\Java Update\jucheck.exe

C:\Program\AVG\AVG8\avgnsx.exe

C:\Program\Outlook Express\msimn.exe

C:\Program\uTorrent\uTorrent.exe

C:\Program\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Per Johansson\Mina dokument\Hämtade filer\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.blt.se/

mStart Page = about:blank

mWinlogon: Shell=Explorer.exe %windir%\system32\drivers\Scqs.exe

mWinlogon: SFCDisable=-99 (0xffffff9d)

BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program\askbardis\bar\bin\askBar.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program\avg\avg8\avgssie.dll

BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program\askbardis\bar\bin\askBar.dll

TB: FreeRIP.com Toolbar: {081230f8-ea50-42a9-983c-d22abc2eed3b} - c:\program\freerip3\toolband.dll

TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

EB: Media Band: {32683183-48a0-441b-a342-7c2a440a9478} - %SystemRoot%\System32\browseui.dll

uRun: [internat.exe] internat.exe

uRun: [skype] "c:\program\skype\phone\Skype.exe" /nosplash /minimized

uRun: [DAEMON Tools Lite] "c:\program\daemon tools lite\daemon.exe" -autorun

uRun: [COM+ Manager] "c:\documents and settings\per johansson\.commgr\complmgr.exe"

uRun: [XBV6RD5SZF] c:\docume~1\perjoh~1\lokala~1\temp\Yzk.exe

mRun: [synchronization Manager] mobsync.exe /logon

mRun: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize

mRun: [nwiz] nwiz.exe /install

mRun: [AVG8_TRAY] c:\program\avg\avg8\avgtray.exe

mRun: [Microsoft Driver Setup] c:\winnt\system32\drivers\Cafgm.exe

mRun: [sunJavaUpdateSched] "c:\program\delade filer\java\java update\jusched.exe"

mRun: [sta] rundll32 "stcup.dll",,Run

mRun: [MChk] c:\winnt\system32\ftcup.exe

mRun: [szetyj67v] c:\winnt\system32\szetyj67v.exe

mRun: [szetyj67vx] c:\winnt\system32\szetyj67vx.exe

dRun: [internat.exe] internat.exe

dRunOnce: [^SetupICWDesktop] c:\program\internet explorer\connection wizard\icwconn1.exe /desktop

mExplorerRun: [Microsoft Driver Setup] c:\winnt\system32\drivers\Cafgm.exe

mExplorerRun: [jgyo0w] c:\docume~1\perjoh~1\lokala~1\temp\19aqp.exe

StartupFolder: c:\docume~1\perjoh~1\start-~1\program\autost~1\micros~1.lnk - c:\program\microsoft office\office\FINDFAST.EXE

StartupFolder: c:\docume~1\perjoh~1\start-~1\program\autost~1\office~1.lnk - c:\program\microsoft office\office\OSA.EXE

StartupFolder: c:\docume~1\perjoh~1\start-~1\program\autost~1\pictur~1.lnk - c:\program\sony\sony picture utility\volumewatcher\SPUVolumeWatcher.exe

StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\adobeg~1.lnk - c:\program\delade filer\adobe\calibration\Adobe Gamma Loader.exe

StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\exifla~1.lnk - c:\program files\finepixviewer\QuickDCF2.exe

StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\personal.lnk - c:\program\personal\bin\Personal.exe

StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\uleadp~1.lnk - c:\program\ulead systems\ulead photo express 3.0 se\CalCheck.exe

StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\watch.lnk - c:\program\packard bell diamond 1200plus\driver\WATCH.exe

uPolicies-system: DisableTaskMgr = 1 (0x1)

uPolicies-system: DisableRegistryTools = 1 (0x1)

dPolicies-system: DisableTaskMgr = 1 (0x1)

dPolicies-system: DisableRegistryTools = 1 (0x1)

IE: &FreeRIP Search - c:\program\freerip3\toolband.dll/MENUSEARCH.HTM

DPF: DirectAnimation Java Classes - file://c:\winnt\java\classes\dajava.cab

DPF: Microsoft XML Parser for Java - file://c:\winnt\java\classes\xmldso.cab

DPF: {0000000A-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/d/4/4/d446e8a9-3a86-4b59-bb19-f5bd11b40367/wmavax.CAB

DPF: {00000161-0000-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/msaudio.cab

DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {31564D57-0000-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/wmvax.cab

DPF: {3234504D-0000-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/mpeg4ax.CAB

DPF: {32564D57-0000-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/wmv8ax.cab

DPF: {3334504D-0000-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/mpeg4ax.cab

DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAC677B6-4963-4305-9066-0BD135CD9233} - hxxps://asp.photoprintit.de/microsite/5025/defaults/activex/ips/IPSUploader4.cab

DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program\avg\avg8\avgpp.dll

Notify: avgrsstarter - avgrsstx.dll

Notify: nwprovau - nwprovau.dll

LSA: Authentication Packages = msv1_0 nwprovau

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\perjoh~1\applic~1\mozilla\firefox\profiles\y5n96x1p.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.blt.se

FF - plugin: c:\documents and settings\per johansson\application data\mozilla\firefox\profiles\y5n96x1p.default\extensions\2020player@2020technologies.com\plugins\NP2020Player.dll

FF - plugin: c:\program\personal\bin\np_prsnl.dll

FF - plugin: c:\program\real\realone player\netscape6\nppl3260.dll

FF - plugin: c:\program\real\realone player\netscape6\nprjplug.dll

FF - plugin: c:\program\real\realone player\netscape6\nprpjplug.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - c:\program\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program\java\jre6\lib\deploy\jqs\ff

FF - Ext: 20-20 3D Viewer: 2020Player@2020Technologies.com - %profile%\extensions\2020Player@2020Technologies.com

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\winnt\system32\drivers\avgldx86.sys [2009-4-10 335240]

R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\winnt\system32\drivers\avgmfx86.sys [2009-4-10 27784]

R1 AvgTdiX;AVG Free8 Network Redirector;c:\winnt\system32\drivers\avgtdix.sys [2009-4-10 108552]

R2 AppleTalk;AppleTalk Protocol;c:\winnt\system32\drivers\sfmatalk.sys [2000-1-12 148400]

R2 avg8wd;AVG Free8 WatchDog;c:\program\avg\avg8\avgwdsvc.exe [2009-4-10 297752]

R2 nvTUNEP;nVidia WDM TVTuner;c:\winnt\system32\drivers\NVTUNEP.SYS [2003-4-26 15968]

R2 nvtvSND;nVidia WDM TVAudio Crossbar;c:\winnt\system32\drivers\NVTVSND.SYS [2003-4-26 13776]

R3 usbhub20;Stöd för USB 2.0 Rotnav;c:\winnt\system32\drivers\usbhub20.sys [2004-9-13 49776]

S2 ASKUpgrade;ASKUpgrade;c:\program\askbardis\bar\bin\ASKUpgrade.exe [2009-9-13 234888]

S2 DegCs Controler;DegCs Controler;"c:\winnt\system32\drivers\degcs.exe" --> c:\winnt\system32\drivers\DegCs.exe [?]

S3 viafilter;VIA USB Filter;c:\winnt\system32\drivers\viausb.sys [2003-4-26 9038]

=============== Created Last 30 ================

2010-11-23 06:46:23 -------- d-----w- c:\docume~1\alluse~1\applic~1\MFAData

2010-11-17 08:23:35 -------- d-----w- c:\docume~1\alluse~1\applic~1\FreeRIP

==================== Find3M ====================

2006-05-03 09:06:54 163328 --sh--r- c:\winnt\system32\flvDX.dll

2007-02-21 10:47:16 31232 --sh--r- c:\winnt\system32\msfDX.dll

============= FINISH: 14:06:39,35 ===============

Attach.txt

15 januari, 2011

Loggen är svårläst,klistra in den utan att använda LOG-knappen...

15 januari, 2011

Hej,

börja med att köra Malwarebytes,

hittas här:

Malwarebytes' Anti-Malware

Kör en snabbskanner. Följ programmets instruktioner noga, när något hittats.

Omstart kan krävas.

Återkom med logg, som du klistrar in i din tråd, om loggen inte poppar upp, hittas den under fliken loggar i Malwarebytes.

Mvh

Mats H

15 januari, 2011

Att klockan ställer om sig vid varje inloggning beror på att BIOS batteriet är slut

(virusangripet ;-) av det sk silverviruset som regelmässigt drabbar äldre datorer)

men det finns bot, köp ett nytt BIOS batteri, litet runt platt batteri, sitter på moderkortet

stort som ungefär en 1kr.

15 januari, 2011

Jag ser i DDS-loggen att det finns en gammal java-version med säkerhetshål,ladda

hem och installera uppdaterad version http://www.java.com/sv/ när datorn är ren.

16 januari, 2011

Körde Malaware och tog bort de filer han hittade.

Här är logen:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Databasversion: 5531

Windows 5.0.2195 Service Pack 4

Internet Explorer 6.0.2800.1106

2011-01-16 15:53:55

mbam-log-2011-01-16 (15-53-55).txt

Skanningstyp: Snabbskanning

Antal skannade objekt: 105939

Förfluten tid: 29 minut(er), 1 sekund(er)

Infekterade minnesprocesser: 0

Infekterade minnesmoduler: 0

Infekterade registernycklar: 4

Infekterade registervärden: 9

Infekterade registerdataposter: 5

Infekterade mappar: 1

Infekterade filer: 18

Infekterade minnesprocesser:

(Inga illasinnade poster hittades)

Infekterade minnesmoduler:

(Inga illasinnade poster hittades)

Infekterade registernycklar:

HKEY_CURRENT_USER\SOFTWARE\OTGV1DNWQQ (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\XBV6RD5SZF (Trojan.FakeAlert) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$NtUninstallMTF1011$ (Adware.Adrotator) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_WINSOFT_SERVICE_CONTROLER (Backdoor.IRCBot) -> Quarantined and deleted successfully.

Infekterade registervärden:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\COM+ Manager (Trojan.Agent) -> Value: COM+ Manager -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XBV6RD5SZF (Trojan.FakeAlert) -> Value: XBV6RD5SZF -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft Driver Setup (Worm.Palevo) -> Value: Microsoft Driver Setup -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jgyo0w (Trojan.Downloader) -> Value: jgyo0w -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Driver Setup (Worm.Palevo) -> Value: Microsoft Driver Setup -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sta (Trojan.Agent.Gen) -> Value: sta -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MChk (Trojan.Agent.Gen) -> Value: MChk -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\szetyj67v (Trojan.Dropper) -> Value: szetyj67v -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\szetyj67vx (Trojan.Dropper) -> Value: szetyj67vx -> Quarantined and deleted successfully.

Infekterade registerdataposter:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (PUM.Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (PUM.Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (Explorer.exe %windir%\system32\drivers\Scqs.exe) Good: (Explorer.exe) -> Quarantined and deleted successfully.

Infekterade mappar:

c:\WINNT\$ntuninstallmtf1011$ (Adware.Adrotator) -> Quarantined and deleted successfully.

Infekterade filer:

c:\WINNT\system32\asr_12677.exe (Virus.Virut) -> Quarantined and deleted successfully.

c:\documents and settings\per johansson\lokala inställningar\temp\sgg7yhw5.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

c:\documents and settings\per johansson\lokala inställningar\temp\aecnwxorsm.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.

c:\documents and settings\per johansson\lokala inställningar\temp\jydtya.exe (Rogue.SecuritySuite) -> Quarantined and deleted successfully.

c:\documents and settings\per johansson\lokala inställningar\temp\rnoecxsawm.tmp (Malware.Packer.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\per johansson\lokala inställningar\temp\pcofizrp.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

c:\documents and settings\per johansson\lokala inställningar\temp\yzh.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

c:\documents and settings\per johansson\lokala inställningar\temp\yzi.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

c:\documents and settings\per johansson\lokala inställningar\temp\yzj.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

c:\documents and settings\per johansson\lokala inställningar\temp\srmnocxwea.tmp (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.

c:\documents and settings\per johansson\lokala inställningar\temp\ufgxxw.exe (Adware.BHO) -> Quarantined and deleted successfully.

c:\zrpt.xml (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINNT\system32\comsats.sys (Trojan.Agent) -> Quarantined and deleted successfully.

c:\WINNT\system32\wsrchc2.dll (Adware.WordsOnWeb) -> Quarantined and deleted successfully.

c:\WINNT\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

c:\WINNT\Tasks\{35dc3473-a719-4d14-b7c1-fd326ca84a0c}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

c:\WINNT\$ntuninstallmtf1011$\apuninstall.exe (Adware.Adrotator) -> Quarantined and deleted successfully.

c:\WINNT\$ntuninstallmtf1011$\zrpt.xml (Adware.Adrotator) -> Quarantined and deleted successfully.

16 januari, 2011

Det var mycket det. Det visar hur farligt det är att ha datorer med Windows 2000 anslutna till internet, många säkerhetshål att infektera datorn genom.

Eftersom "virut" nämns gör en scan med programmet http://download.avgfree.com/filedir/util/avg_rem_sup.dir/rmvirut/rmvirut.exe så man får en uppfattning hur många och vilka filer som är infekterade. Klistra in loggen i ditt svar, eller om den är väldigt lång bifoga den.

Kör DDS och klistra in DDS.txt också så får vi se vad som finns kvar.

c:\documents and settings\per johansson\lokala inställningar\temp\srmnocxwea.tmp (Spyware.Passwords.XGen)

Det innebär att alla lösenord som du någonsin använt på den datorn för inloggning på någon webbsida etc behöver bytas ut från en säkert ren dator.

16 januari, 2011

Körde AVG virut/rmvirut.exe loggen blev låååång men den hittade ingenting mer som var infekterat. Klockan har börjat gå rätt så det är ju ett bra tecken....

Körde DDS och .txt ligger som bilaga.

Attach.txt

16 januari, 2011

Hej,

din DDS vore fint att få se!

Mvh

Mats H

16 januari, 2011

Här e DDS'n:

DDS (Ver_10-12-12.02) - NTFSx86

Run by Per Johansson at 19:08:39,95 on sö 2011-01-16

Internet Explorer: 6.0.2800.1106 BrowserJavaVersion: 1.6.0_18

Microsoft Windows 2000 Professional 5.0.2195.4.1252.46.1053.18.639.307 [GMT 1:00]

============== Running Processes ===============

C:\WINNT\system32\LEXBCES.EXE

C:\WINNT\system32\spoolsv.exe

C:\WINNT\system32\LEXPPS.EXE

C:\Program\AVG\AVG8\avgwdsvc.exe

C:\WINNT\system32\bgsvcgen.exe

C:\Program\Java\jre6\bin\jqs.exe

C:\WINNT\System32\nvsvc32.exe

C:\WINNT\system32\MSTask.exe

C:\WINNT\system32\stisvc.exe

C:\WINNT\System32\WBEM\WinMgmt.exe

C:\WINNT\system32\mspmspsv.exe

C:\Program\AVG\AVG8\avgnsx.exe

C:\Program\AVG\AVG8\avgrsx.exe

C:\WINNT\Explorer.EXE

C:\Program\AVG\AVG8\avgtray.exe

C:\Program\Delade filer\Java\Java Update\jusched.exe

C:\WINNT\system32\internat.exe

C:\Program\Skype\Phone\Skype.exe

C:\Program\DAEMON Tools Lite\daemon.exe

C:\Program Files\FinePixViewer\QuickDCF2.exe

C:\Program\Personal\bin\Personal.exe

C:\Program\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe

C:\Program\Packard Bell Diamond 1200Plus\Driver\WATCH.exe

C:\Program\Microsoft Office\Office\OSA.EXE

C:\Program\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe

C:\WINNT\System32\SCardSvr.exe

C:\Program\Delade filer\Java\Java Update\jucheck.exe

C:\Program\Mozilla Firefox\firefox.exe

C:\Documents and Settings\Per Johansson\Mina dokument\Hämtade filer\dds(3).scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.blt.se/

mStart Page = about:blank

mWinlogon: SFCDisable=-99 (0xffffff9d)

BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program\askbardis\bar\bin\askBar.dll

BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program\avg\avg8\avgssie.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll