Adware/Virus: Virtumonde

2007-07-23, 10:00 #13

Avslutad

Nope, den hänger sig när den ska kolla NT Services.
Det går inte o stänga av det heller, processen vägrar stängas ner, jag måste starta om datorn för att bli av med det.

Citera

2007-07-23, 10:14 #14

Medlem

Reg: Apr 2005

Inlägg: 31

har erfarning med at denna guiden brukar hjälpa på at ta bort virtumonde

http://www.bleepingcomputer.com/forums/topic18610.html

Citera

2007-07-23, 10:15 #15

Medlem

Reg: Mar 2007

Inlägg: 12 238

om du inte installerat något sedan den första HJT loggen så är detta konstigt för det finns ingen dålig service i den förra loggen

kanske det går bättre med den här versionen
http://www.spywareinfo.com/~merijn/files/HijackThis.exe

Citera

2007-07-23, 10:24 #16

Avslutad

Den funkade inte heller. Men jag läste att v1.99 kan krasha av något rootkit Ms4Hd, som stoppar program från att hitta det...
Men v1.98.2 funkade, så postar loggen från den

Logfile of HijackThis v1.98.2
Scan saved at 10:23:20 AM, on 7/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Documents and Settings\David\Desktop\div.shit\Screenshooter\Scre enshooter21.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Documents and Settings\David\Desktop\HiJackThis_v2.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\Documents and Settings\David\Desktop\HiJackThis.exe
C:\Documents and Settings\David\Desktop\HijackTshis.exe
C:\Documents and Settings\David\Desktop\hijackthis1982\HijackThis.e xe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.se/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {E6D436F7-7439-48A7-8B44-315972C2CBCE} - C:\WINDOWS\system32\jkhfd.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Screenshooter] "C:\Documents and Settings\David\Desktop\div.shit\Screenshooter\Scre enshooter21.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{5F44B3E7-FA37-4BAD-A01B-746C2E46345F}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

Cubic, samma program som nämns tidigare i tråden, skulle tro att Virtumonde är borta nu, antiviruset har inte märkt av något iaf, och programet hittar inget längre

Citera

2007-07-23, 10:39 #17

Medlem

Reg: Apr 2005

Inlägg: 31

Citat:

Ursprungligen postat av anatal

Cubic, samma program som nämns tidigare i tråden, skulle tro att Virtumonde är borta nu, antiviruset har inte märkt av något iaf, och programet hittar inget längre

aha sorry, läste inte hela tråden, sitter på jobb just nu

Citera

2007-07-23, 10:43 #18

Medlem

Reg: Mar 2007

Inlägg: 12 238

kör den här vers, den du har är en beta
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

Citera

2007-07-23, 11:08 #19

Avslutad

Jag har prövat den versionen också, samma händer med den.

Citera

2007-07-23, 11:13 #20

Medlem

Reg: Mar 2007

Inlägg: 12 238

kör detta program, det rensar bort om det finns nån dålig service
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
spara SDFix.exe på skrivbordet >klicka på SDFix.exe >sdfixen packas upp här: C:\SDFix.

starta om i felsäkert läge (F8) >gå hit: C:\SDFix >klicka på runthis.bat >välj y.

när scanningen är klar så tryck på valfri tangent för att starta om.
när det står finished så tryck på valfri tangent. en logg kommer automatiskt att visas, kopiera in loggen här.
(notera att sdfix återställer hostfilen till orignal inställningen)

kör blacklight, posta loggen om nåt hittas innan du gör nåt annat
https://europe.f-secure.com/exclude/blacklight/fsbl.exe

Citera

2007-07-23, 11:47 #21

Avslutad

SDFix (nedkortad - för många tecken):

SDFix: Version 1.93

Run by David on Mon 07/23/2007 at 11:25 AM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:
ntio256
NtmlSvc
runtime2

ImagePath:
\??\C:\WINDOWS\system32\ntio256.sys
%SystemRoot%\System32\svchost.exe -k netsvcs
\SystemRoot\system32\drivers\runtime2.sys

ntio256 - Deleted
NtmlSvc - Deleted

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\system32\drivers\asc3550u.sys - Deleted
C:\WINDOWS\Temp\$b17a2e8.tmp - Deleted
C:\WINDOWS\Temp\startdrv.exe - Deleted
C:\WINDOWS\system32\drivers\runtime2.sys - Deleted

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\servic es\sharedaccess\parameters\firewallpolicy\standard profile\authorizedapplications\list]
"C:\\Program Files\\Sunbelt Software\\Personal Firewall 4\\kpf4gui.exe"="C:\\Program Files\\Sunbelt Software\\Personal Firewall 4\\kpf4gui.exe:*:Enabled:Sunbelt Kerio Personal Firewall 4 - GUI"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\utorrent\\utorrent.exe"="C:\\Program Files\\utorrent\\utorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\Steam\\SteamApps\\xxx@hotmail.com\\counter-strike\\hl.exe"="C:\\Program Files\\Steam\\SteamApps\\xxxll@hotmail.com\\counte r-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"D:\\IRC\\FBK\\mirc.exe"="D:\\IRC\\FBK\\mirc.exe:* :Enabled:mIRC"
"D:\\IRC\\nnscript\\mirc.exe"="D:\\IRC\\nnscript\\ mirc.exe:*:Enabled:mIRC"
"C:\\Program Files\\Miranda IM\\miranda32.exe"="C:\\Program Files\\Miranda IM\\miranda32.exe:*:Enabled:Miranda IM"
"C:\\Program Files\\foobar2000\\foobar2000.exe"="C:\\Program Files\\foobar2000\\foobar2000.exe:*:Enabled:foobar 2000 Application"
"D:\\IRC\\Copy of Copy of mirc\\mirc.exe"="D:\\IRC\\Copy of Copy of mirc\\mirc.exe:*:Enabled:mIRC"
"C:\\Program Files\\Steam\\SteamApps\\xxxll@hotmail.com\\team fortress classic\\hl.exe"="C:\\Program Files\\Steam\\SteamApps\\xxxll@hotmail.com\\team fortress classic\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Program Files\\xchat\\xchat.exe"="C:\\Program Files\\xchat\\xchat.exe:*:Enabled:XChat IRC Client"
"C:\\Program Files\\UltraEdit\\uedit32.exe"="C:\\Program Files\\UltraEdit\\uedit32.exe:*:Enabled:UltraEdit-32 Professional Text/Hex Editor"
"D:\\DC++\\DCPlusPlus.exe"="D:\\DC++\\DCPlusPlus.e xe:*:Enabled

C++"
"D:\\IRC\\IRC Bot\\mirc.exe"="D:\\IRC\\IRC Bot\\mirc.exe:*:Enabled:mIRC"
"D:\\IRC\\Copy of mirc\\mirc.exe"="D:\\IRC\\Copy of mirc\\mirc.exe:*:Enabled:mIRC"
"D:\\ftpsrv110\\ftpserv.exe"="D:\\ftpsrv110\\ftpse rv.exe:*:Enabled:TYPSoft FTP Server"
"C:\\Program Files\\Cerberus\\Cerberus.exe"="C:\\Program Files\\Cerberus\\Cerberus.exe:*:Enabled:Cerberus FTP Server"
"C:\\Documents and Settings\\David\\Desktop\\ftpsrv110\\ftpserv.exe"= "C:\\Documents and Settings\\David\\Desktop\\ftpsrv110\\ftpserv.exe:* :Enabled:TYPSoft FTP Server"
"C:\\Program Files\\BPFTP Server\\bpftpserver.exe"="C:\\Program Files\\BPFTP Server\\bpftpserver.exe:*:Enabled:BulletProof FTP Server (http://www.bpftpserver.com)"
"C:\\Documents and Settings\\David\\Desktop\\YnHub1033135\\YnHub.exe" ="C:\\Documents and Settings\\David\\Desktop\\YnHub1033135\\YnHub.exe: *:Enabled:YnHub 1.033"
"C:\\Games\\World of Warcraft\\WoW-1.10.0-enGB-downloader.exe"="C:\\Games\\World of Warcraft\\WoW-1.10.0-enGB-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\wamp\\Apache2\\bin\\Apache.exe"="C:\\wamp\\Ap ache2\\bin\\Apache.exe:*:Enabled:Apache HTTP Server"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\servic es\sharedaccess\parameters\firewallpolicy\domainpr ofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\syste m32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll, -20000"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files:
---------------

Backups Folder: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

C:\Documents and Settings\David\My Documents\downloads\MSN\xxxll@hotmail.com\turk\tur k\Thumbs.db
C:\Documents and Settings\David\NetHood\sellchain.com\Desktop.ini
C:\Program Files\outlook express\msimn.exe
C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp
C:\WINDOWS\system32\config\default.tmp.LOG
C:\WINDOWS\system32\config\software.tmp.LOG
C:\WINDOWS\system32\config\system.tmp.LOG

Finished

blacklight hittade inget

Citera

2007-07-23, 12:12 #22

Medlem

Reg: Mar 2007

Inlägg: 12 238

och vad händer med HJT nu?

Citera

2007-07-23, 12:19 #23

Avslutad

Ah, nu funkar det

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:19:22 PM, on 7/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Documents and Settings\David\Desktop\div.shit\Screenshooter\Scre enshooter21.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Miranda IM\miranda32.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\David\Desktop\putty.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.se/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] "C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Screenshooter] "C:\Documents and Settings\David\Desktop\div.shit\Screenshooter\Scre enshooter21.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{5F44B3E7-FA37-4BAD-A01B-746C2E46345F}: NameServer = 208.67.222.222,208.67.220.220
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

--
End of file - 5235 bytes

äntligen! - som gert fylking hade sagt

Citera

2007-07-23, 12:26 #24

Medlem

Reg: Mar 2007

Inlägg: 12 238

nu ser det bra ut men man kan ju undra vad du hann att klicka på/köra efter du postat den första HJT loggen... man måste ju vara lite försiktig och inte tro att alla filer som inte nåt skyddsprogram varnar för är ok.

för att kolla så ingen vundofil fanns kvar så öppna HJT >klicka på open misc tools >open process manager >markera winlogon.exe >bocka för show dll's >klicka på kopiera ikonen bredvid >kopiera in här

Citera

Adware/Virus: Virtumonde

Skapa ett konto eller logga in för att kommentera

Skapa ett konto

Logga in