2008-06-23, 19:04
  #1
Medlem
suryoyos avatar
Min dator har betett sig vldigt mrkligt efter att jag hade ftt ngra trojaner som spywaredoctor rensade ut.
Jag mrkte att internet segade, samt att b.la mail.com inte fungerade lngre, frst d installerade jag spyware doctor.
Har provat att g in via mozilla firefox svl som ie explorer, terstllt instllningar, instalerat om ...Det funkar helt enkelt inte.
Via bitcomets browser, kommer jag in p alla sidor utan problem.
Ngon som vet hur jag skall g till vga fr att slippa instalera om allt skit igen?
Citera
2008-06-23, 19:28
  #2
Medlem
Tja, personligen skulle jag installera om allt igen
Det skulle nog behvas
Citera
2008-06-23, 19:56
  #3
Medlem
suryoyos avatar
Jaja ltt att sga nr man sjlv inte sitter i smeten
Har nog en 80 program som mste instaleras om igen, sen har jag inte kvar original cdn....
(knns bra att f gnlla lite)
Citera
2008-06-23, 20:03
  #4
Medlem
927s avatar
du kan posta en hijackthis logg s ser man om det finns ngot problem.
spara HJTInstall.exe p skrivbordet >klicka p filen >vlj install och klicka p: "do a system scan and save logfile".
posta den loggen frn txt filen som visas d.
http://www.trendsecure.com/portal/en...HJTInstall.exe
Citera
2008-06-23, 20:49
  #5
Medlem
suryoyos avatar
Tack fr vnligheten.
Shr sg min logg ut:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:48:25, on 2008-06-23
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program\Iomega\System32\AppServices.exe
C:\Program\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
C:\Program\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program\Spyware Doctor\pctsAuxs.exe
C:\Program\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\Program\Iomega\AutoDisk\ADService.exe
C:\Program\3S Software\CoDeSys ENI Server\ENI.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\bcmntray.exe
C:\WINDOWS\System32\MAFWTray.exe
C:\Program\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program\Mouse Driver\MouseDrv.exe
C:\Program\Synaptics\SynTP\SynTPLpr.exe
C:\Program\Synaptics\SynTP\SynTPEnh.exe
C:\Program\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\VM303_STI.EXE
C:\Program\QuickTime\qttask.exe
C:\Program\SyncroSoft\Pos\H2O\cledx.exe
C:\Program\Delade filer\InstallShield\UpdateService\issch.exe
C:\Program\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\MSN Messenger\msnmsgr.exe
C:\Program\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program\BitComet\BitComet.exe
C:\Program\Internet Explorer\iexplore.exe
C:\Program\MSN Messenger\usnsvc.exe
C:\Program\Spyware Doctor\pctsGui.exe
C:\Program\WinRAR\WinRAR.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Lnkar
O2 - BHO: (no name) - {05E4BD11-05FB-444A-95FE-51EADE348052} - C:\WINDOWS\system32\khfGyvwx.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\System32\bcmntray
O4 - HKLM\..\Run: [MAFWTaskbarApp] C:\WINDOWS\System32\MAFWTray.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [CreativeMouse ] C:\Program\Mouse Driver\MouseDrv.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program\Delade filer\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SynTPLpr] C:\Program\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Cpqset] C:\Program\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [BigDog303] C:\WINDOWS\VM303_STI.EXE VIMICRO USB PC Camera (ZC0301PLH)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [H2O] C:\Program\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program\Delade filer\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program\Delade filer\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISTray] "C:\Program\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [BM9fa5f8dc] Rundll32.exe "C:\WINDOWS\system32\xnmvblei.dll",s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/de...e/HPDEXAXO.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{173D926D-068A-4E4A-B161-5BA0D4EFC6A5}: NameServer = 217.10.96.65,217.10.96.44
O18 - Filter hijack: text/html - (no CLSID) - (no file)
O20 - Winlogon Notify: vtUOiIcc - vtUOiIcc.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: ENI Server - 3S-Smart Software Solutions GmbH - C:\Program\3S Software\CoDeSys ENI Server\ENI.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\Program\Iomega\System32\AppServices.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: M-Audio Series II MIDI Installer (MA_CMIDI_InstallerService) - Unknown owner - C:\Program\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program\Delade filer\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: RT Service 3S KM (RTService) - 3S-Smart Software Solutions GmbH - C:\Program\3S Software\CoDeSys SP RTE\RTService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program\Spyware Doctor\pctsSvc.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program\Iomega\AutoDisk\ADService.exe

--
End of file - 9169 bytes
Citera
2008-06-23, 22:08
  #6
Medlem
927s avatar
det ser ut som lite skrp finns kvar av vundo, om det har nn betydelse vet jag inte men gr s hr
http://www.besttechie.net/tools/mbam-setup.exe
installera programmet och klicka p scanna nr du ser den knappen.
klicka p ok >show results >remove selected, starta om.
gr en ny scan med MBAM, posta den loggen och en HJT logg
Citera
2008-06-23, 23:10
  #7
Medlem
suryoyos avatar
Frvnad som sjlva fan r jag!
Jag har skt igenom datorn med spywaredoctor utan att hitta ngra infektioner, nu hux flux hittade jag flera infektioner.



Malwarebytes' Anti-Malware 1.18
Databasversion: 883

23:00:52 2008-06-23
mbam-log-6-23-2008 (23-00-46).txt

Skanningstyp: Snabb skanning
Antal skannade objekt: 43272
Frfluten tid: 11 minute(s), 23 second(s)

Infekterade minnesprocesser: 0
Infekterade minnesmoduler: 1
Infekterade registernycklar: 3
Infekterade registervrden: 2
Infekterade registerdataposter: 0
Infekterade mappar: 0
Infekterade filer: 12

Infekterade minnesprocesser:
(Inga illasinnade poster hittades)

Infekterade minnesmoduler:
C:\WINDOWS\system32\xnmvblei.dll (Trojan.Vundo) -> No action taken.

Infekterade registernycklar:
HKEY_CLASSES_ROOT\CLSID\{014da6c9-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.

Infekterade registervrden:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\BM9fa5f8dc (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\ShellExecuteHooks\{f53bafe5-ce7a-4e95-95ac-a3912efd3739} (Trojan.Vundo) -> No action taken.

Infekterade registerdataposter:
(Inga illasinnade poster hittades)

Infekterade mappar:
(Inga illasinnade poster hittades)

Infekterade filer:
C:\WINDOWS\system32\bpvjeman.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\namejvpb.ini (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\xxyvvSjg.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\gjSvvyxx.ini (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\gjSvvyxx.ini2 (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\xnmvblei.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\ggnumacx.dll (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\garen\Lokala instllningar\Temp\GLKE.tmp (Rogue.EvidenceEliminator) -> No action taken.
C:\WINDOWS\cookies.ini (Malware.Trace) -> No action taken.
C:\WINDOWS\Fonts\acrsecB.fon (Trojan.Agent) -> No action taken.
C:\WINDOWS\Fonts\acrsecI.fon (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> No action taken.
Citera
2008-06-23, 23:56
  #8
Medlem
927s avatar
"No action taken"
du mste ta bort det som hittas, starta om och scanna igen
Citera

Skapa ett konto eller logga in för att kommentera

Du måste vara medlem för att kunna kommentera

Skapa ett konto

Det är enkelt att registrera ett nytt konto

Bli medlem

Logga in

Har du redan ett konto? Logga in här

Logga in