Mega-virus... -HELP!

2008-07-08, 15:52 #25

Medlem

Reg: Nov 2006

Inlägg: 4 088

Citat:

Ursprungligen postat av Champinjonen

thought soo...

mmm.. aldrig mer faktiskt..

förutom från folk man kan lita på..

2008-07-08, 16:09 #26

Medlem

Reg: Nov 2006

Inlägg: 4 088

Det hela är ju en fråga om tid egentligen.

Att man ska slippa blåsa datorn o installera om allt igen, så egentligen ska jag inte kvida. Men det hade varit skönt att kunna bränna/kopiera så mycket som möjligt av de filer jag har användning av före en eventuell blåsning.

2008-07-08, 17:13 #27

Medlem

Reg: Nov 2006

Inlägg: 4 088

Hej nu är jag hemma. till min glädje kan jag använda windows utan felsäkert läge..

håller i detta nu på att scanna datorn via eset.com online.

2008-07-08, 19:25 #28

Medlem

Reg: Nov 2006

Inlägg: 4 088

Den dog och sedan startade den om sig själv.. Lyckades inte komma till felsäkert läge heller av nånn anledning..

Provade igen och när AVG satte igång och varna så la jag dem i karantän en efter en. nu verkar det lite mer stabilt. Kör Anti-Malware nu..

AVG poppar upp då och då och varnar under processen, men jag lägger dem bara rakt i karantän nu kom en hel drös.. gäller o va snabb...

__________________
Senast redigerad av portnoy 2008-07-08 kl. 19:28.

2008-07-08, 20:10 #29

Medlem

Reg: Nov 2006

Inlägg: 4 088

Malware Rapport del 1

Malwarebytes' Anti-Malware 1.20
Databasversion: 932
Windows 5.1.2600 Service Pack 2

20:09:16 2008-07-08
mbam-log-7-8-2008 (20-09-16).txt

Skanningstyp: Fullständig skanning (C:\|X:\|)
Antal skannade objekt: 275964
Förfluten tid: 47 minute(s), 22 second(s)

Infekterade minnesprocesser: 6
Infekterade minnesmoduler: 6
Infekterade registernycklar: 13
Infekterade registervärden: 9
Infekterade registerdataposter: 4
Infekterade mappar: 16
Infekterade filer: 69

Infekterade minnesprocesser:
C:\WINDOWS\VistaDrive\VistaDrive.exe (Trojan.Agent) -> Unloaded process successfully.
C:\Program\antiviirus.exe (Trojan.Downloader) -> Unloaded process successfully.
C:\Program\tmp0.exe (Trojan.FakeAlert) -> Unloaded process successfully.
C:\Program\tmp1.exe (Trojan.FakeAlert) -> Unloaded process successfully.
C:\Program\tmp2.exe (Trojan.FakeAlert) -> Unloaded process successfully.
C:\WINDOWS\system32\lphc9c9j0e561.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Infekterade minnesmoduler:
C:\WINDOWS\system32\fmdrjluw.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\system32\jkkKbCrs.dll (Trojan.Vundo) -> Unloaded module successfully.
C:\WINDOWS\Resources\PrxKbd.dll (Trojan.Clicker) -> Unloaded module successfully.
C:\WINDOWS\Resources\ServiceService.dll (Trojan.Clicker) -> Unloaded module successfully.
C:\WINDOWS\Resources\UnknownSDRAM.dll (Trojan.Clicker) -> Unloaded module successfully.
C:\WINDOWS\system32\blphc9c9j0e561.scr (Trojan.FakeAlert) -> Unloaded module successfully.

Infekterade registernycklar:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{4f87c15f-30c8-4093-ae1b-e1418ad5a357} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{4f87c15f-30c8-4093-ae1b-e1418ad5a357} (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\VAV (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{eda97863-6861-4c03-ab16-ddbb7287ffd0} (Trojan.Clicker) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{e9fb8d0b-d17d-46f4-86c2-829893cf1783} (Trojan.Clicker) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{2046f032-e864-409a-8de1-52daadfe7aac} (Trojan.Clicker) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sqvgnrpx.bbpq (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sqvgnrpx.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infekterade registervärden:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\8052d06a (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\vistadrive (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\ShellServiceObjectDelayLoad\prxkbd (Trojan.Clicker) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\ShellServiceObjectDelayLoad\serviceserv ice (Trojan.Clicker) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\ShellServiceObjectDelayLoad\unknownsdra m (Trojan.Clicker) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\antiviirus (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\lphc9c9j0e561 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\smrhccc9j0e561 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\smshcec9j0e561 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Infekterade registerdataposter:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\jkkkbcrs -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\jkkkbcrs -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infekterade mappar:
C:\Program\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program\rhccc9j0e561 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program\shcec9j0e561 (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program\VAV (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\778670 (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Johan\Application Data\rhccc9j0e561 (Rogue.Multiple) -> Delete on reboot.
C:\Documents and Settings\Johan\Application Data\rhccc9j0e561\Quarantine (Rogue.Multiple) -> Delete on reboot.
C:\Documents and Settings\Johan\Application Data\rhccc9j0e561\Quarantine\Autorun (Rogue.Multiple) -> Delete on reboot.
C:\Documents and Settings\Johan\Application Data\rhccc9j0e561\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Delete on reboot.
C:\Documents and Settings\Johan\Application Data\rhccc9j0e561\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Johan\Application Data\rhccc9j0e561\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Delete on reboot.
C:\Documents and Settings\Johan\Application Data\rhccc9j0e561\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Johan\Application Data\rhccc9j0e561\Quarantine\Autorun\StartMenuAllU sers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Johan\Application Data\rhccc9j0e561\Quarantine\Autorun\StartMenuCurr entUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Johan\Application Data\rhccc9j0e561\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Johan\Application Data\rhccc9j0e561\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.

2008-07-08, 20:11 #30

Medlem

Reg: Nov 2006

Inlägg: 4 088

Malware Rapport del 2

Infekterade filer:
C:\WINDOWS\system32\jkkKbCrs.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\srCbKkkj.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\srCbKkkj.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fmdrjluw.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\wuljrdmf.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\VistaDrive\VistaDrive.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program\rhccc9j0e561\rhccc9j0e561Skin.dll (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E8640468-463B-4C28-9922-28C227F4D92F}\RP157\A0025746.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E8640468-463B-4C28-9922-28C227F4D92F}\RP157\A0025747.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E8640468-463B-4C28-9922-28C227F4D92F}\RP157\A0025767.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\reboot.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program\PCHealthCenter\0.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program\PCHealthCenter\0.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program\PCHealthCenter\1.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program\PCHealthCenter\1.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program\PCHealthCenter\2.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program\PCHealthCenter\2.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program\PCHealthCenter\3.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program\PCHealthCenter\3.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program\PCHealthCenter\4.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program\PCHealthCenter\sc.html (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program\PCHealthCenter\sex1.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program\PCHealthCenter\sex2.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program\rhccc9j0e561\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program\rhccc9j0e561\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program\rhccc9j0e561\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program\rhccc9j0e561\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program\rhccc9j0e561\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program\rhccc9j0e561\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program\rhccc9j0e561\rhccc9j0e561.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program\rhccc9j0e561\Uninstall.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program\shcec9j0e561\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program\shcec9j0e561\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program\shcec9j0e561\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program\shcec9j0e561\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program\shcec9j0e561\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program\shcec9j0e561\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program\shcec9j0e561\shcec9j0e561.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program\shcec9j0e561\Uninstall.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program\VAV\vav0.dat (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.
C:\Program\VAV\vav1.dat (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Skrivbord\Antivirus XP 2008.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\Johan\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sex1.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sex2.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Skrivbord\Malware Protector 2008.lnk (Rogue.MalwareProtector2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\Johan\Application Data\Microsoft\Internet Explorer\Quick Launch\Malware Protector 2008.lnk (Rogue.MalwareProtector2008) -> Quarantined and deleted successfully.
C:\WINDOWS\Resources\PrxKbd.dll (Trojan.Clicker) -> Delete on reboot.
C:\WINDOWS\Resources\ServiceService.dll (Trojan.Clicker) -> Delete on reboot.
C:\WINDOWS\Resources\UnknownSDRAM.dll (Trojan.Clicker) -> Delete on reboot.
C:\Program\antiviirus.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Program\tmp0.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program\tmp1.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program\tmp2.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\fsrpknov.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\blphc9c9j0e561.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lphc9c9j0e561.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\phc9c9j0e561.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Johan\Skrivbord\0nline p0rn.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Johan\Skrivbord\FREE gallery of the day.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Johan\Skrivbord\Vista Antivirus 2008.lnk (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\Johan\Lokala inställningar\Temp\vista_sp1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Johan\Lokala inställningar\Temp\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Johan\Lokala inställningar\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Johan\Lokala inställningar\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Johan\Lokala inställningar\Temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Johan\Lokala inställningar\Temp\.tt5.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Johan\Lokala inställningar\Temp\.tt7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Johan\Lokala inställningar\Temp\.tt8.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.

2008-07-08, 20:29 #31

Medlem

Reg: Feb 2008

Inlägg: 23

posta en hijack logg också.

2008-07-08, 20:31 #32

Medlem

Reg: Nov 2006

Inlägg: 4 088

Citat:

Ursprungligen postat av und3rtak3r

posta en hijack logg också.

jeps.. kör med Rootkitrevealer nu..

Har dessutom 37 filer i AVG´s vault-.. .ska jag tömma det nu direkt??

Fick dessutom ca fem AVG alerts nu när Rootkit kör... Men systemet är mer stabilt nu...

2008-07-08, 20:35 #33

Medlem

Reg: Nov 2006

Inlägg: 4 088

Rootkitrevealer Logg

HKU\S-1-5-21-1645522239-261478967-839522115-1004\Software\SecuROM\!CAUTION! NEVER DELETE OR CHANGE ANY KEY* 2008-02-16 12:20 0 bytes Key name contains embedded nulls (*)
HKLM\SECURITY\Policy\Secrets\SAC* 2007-12-28 19:18 0 bytes Key name contains embedded nulls (*)
HKLM\SECURITY\Policy\Secrets\SAI* 2007-12-28 19:18 0 bytes Key name contains embedded nulls (*)
HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg 2008-02-14 23:22 0 bytes Access is denied.
C:\$VAULT$.AVG\00377187.FIL 2008-07-08 20:20 224.47 KB Hidden from Windows API.
C:\$VAULT$.AVG\00380328.FIL 2008-07-08 20:20 28.09 KB Hidden from Windows API.
C:\$VAULT$.AVG\00382187.FIL 2008-07-08 20:20 28.09 KB Hidden from Windows API.
C:\$VAULT$.AVG\00386921.FIL 2008-07-08 20:20 115.45 KB Hidden from Windows API.
C:\$VAULT$.AVG\00389703.FIL 2008-07-08 20:20 28.09 KB Hidden from Windows API.
C:\$VAULT$.AVG\00393671.FIL 2008-07-08 20:20 17.45 KB Hidden from Windows API.
C:\Documents and Settings\Johan\Lokala inställningar\Application Data\ApplicationHistory\Comrade.exe.ea42ac7b.ini.i nuse 2008-07-08 20:15 0 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Johan\Lokala inställningar\Application Data\GameSpy\Comrade\QueryData 2008-07-08 20:15 0 bytes Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Johan\Lokala inställningar\Application Data\Mozilla\Firefox\Profiles\1f8umuax.default\Cac he\520367BDd01 2008-07-08 20:19 35.20 KB Hidden from Windows API.
C:\Documents and Settings\Johan\Lokala inställningar\Application Data\Mozilla\Firefox\Profiles\1f8umuax.default\Cac he\59133791d01 2008-07-08 20:19 28.26 KB Hidden from Windows API.
C:\Documents and Settings\Johan\Lokala inställningar\Application Data\Mozilla\Firefox\Profiles\1f8umuax.default\Cac he\7DEB5410d01 2008-07-08 19:47 18.22 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Johan\Lokala inställningar\Application Data\Mozilla\Firefox\Profiles\1f8umuax.default\Cac he\8564DE06d01 2008-07-08 20:19 18.52 KB Hidden from Windows API.
C:\Documents and Settings\Johan\Lokala inställningar\Application Data\Mozilla\Firefox\Profiles\1f8umuax.default\Cac he\9061E0D5d01 2008-07-08 20:19 10.91 MB Hidden from Windows API.
C:\Documents and Settings\Johan\Lokala inställningar\Application Data\Mozilla\Firefox\Profiles\1f8umuax.default\Cac he\AF771A39d01 2008-07-08 20:19 1.15 MB Hidden from Windows API.
C:\Documents and Settings\Johan\Lokala inställningar\Application Data\Mozilla\Firefox\Profiles\1f8umuax.default\Cac he\C7F48DC3d01 2008-07-08 20:19 23.81 KB Hidden from Windows API.
C:\Documents and Settings\Johan\Lokala inställningar\Application Data\Mozilla\Firefox\Profiles\1f8umuax.default\Cac he\CEE01DEEd01 2008-07-08 19:49 9.21 MB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Johan\Lokala inställningar\Application Data\Mozilla\Firefox\Profiles\1f8umuax.default\Cac he\D1189721d01 2008-07-08 20:19 20.00 KB Hidden from Windows API.
C:\Documents and Settings\Johan\Lokala inställningar\Application Data\Mozilla\Firefox\Profiles\1f8umuax.default\Cac he\FB2696D9d01 2008-07-08 19:34 16.59 KB Visible in Windows API, but not in MFT or directory index.
C:\Documents and Settings\Johan\Lokala inställningar\Temp\fla2A.tmp 2008-07-08 20:19 72 bytes Hidden from Windows API.
C:\Documents and Settings\Johan\Lokala inställningar\Temp\plugtmp-9 2008-07-08 20:20 0 bytes Hidden from Windows API.
C:\Documents and Settings\Johan\Lokala inställningar\Temp\plugtmp-9\tracker 2008-07-08 20:19 2 bytes Hidden from Windows API.
C:\Documents and Settings\Johan\Lokala inställningar\Temp\plugtmp-9\tracker-1 2008-07-08 20:20 2 bytes Hidden from Windows API.
C:\Documents and Settings\Johan\Lokala inställningar\Temp\plugtmp-9\tracker-2 2008-07-08 20:20 2 bytes Hidden from Windows API.
C:\Documents and Settings\Johan\Lokala inställningar\Temp\~DF1745.tmp 2008-07-08 20:15 16.00 KB Visible in Windows API, but not in MFT or directory index.
C:\System Volume Information\_restore{E8640468-463B-4C28-9922-28C227F4D92F}\RP157\A0027775.dll 2008-07-07 17:15 224.00 KB Visible in Windows API, but not in MFT or directory index.
C:\System Volume Information\_restore{E8640468-463B-4C28-9922-28C227F4D92F}\RP157\A0027776.dll 2008-07-07 23:10 27.63 KB Visible in Windows API, but not in MFT or directory index.
C:\System Volume Information\_restore{E8640468-463B-4C28-9922-28C227F4D92F}\RP157\A0027777.dll 2008-07-07 23:09 27.63 KB Visible in Windows API, but not in MFT or directory index.
C:\System Volume Information\_restore{E8640468-463B-4C28-9922-28C227F4D92F}\RP157\A0027778.cpl 2008-07-07 07:11 115.00 KB Visible in Windows API, but not in MFT or directory index.
C:\System Volume Information\_restore{E8640468-463B-4C28-9922-28C227F4D92F}\RP157\A0027779.dll 2008-07-07 23:09 27.63 KB Visible in Windows API, but not in MFT or directory index.
C:\System Volume Information\_restore{E8640468-463B-4C28-9922-28C227F4D92F}\RP157\A0027780.dll 2008-07-08 05:09 17.00 KB Visible in Windows API, but not in MFT or directory index.
C:\System Volume Information\_restore{E8640468-463B-4C28-9922-28C227F4D92F}\RP157\A0027819.ini 2008-07-08 19:16 6.81 KB Hidden from Windows API.
C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp .edb 2008-07-08 20:21 64.00 KB Hidden from Windows API.

2008-07-08, 20:38 #34

Medlem

Reg: Nov 2006

Inlägg: 4 088

Btw.. Kan inte spara nåt på skrivbordet...

Får felmedd. som säger att "Skrivbord refererar till en plats som inte är tillgänglig. Det kan vara en hårddisk på den här datorn eller på ett nätverk. Kontrollera att disken är korrekt ansluten... bla bla bla"

jag kommer åt grejer och allt som normalt men kan inte spara.. kan även flytta grejer dit men inte spara. vet inte om det var nåt med rootkit..

__________________
Senast redigerad av portnoy 2008-07-08 kl. 20:41.

2008-07-08, 20:42 #35

Medlem

Reg: Nov 2005

Inlägg: 15 954

Citat:

Ursprungligen postat av portnoy

Ok, det där hjälpte inte så mycket...

hur så? (ok, hetsa inte upp mig i onödan nu!)

ska fan ALDRIG mer tanka ner spel från PB. jäkla infekterande snorungar.

man lär så länge man lever...

Man:
1. Läser kommentarer.
2. Tar den med mest seed.

2008-07-08, 20:44 #36

Medlem

Reg: Nov 2005

Inlägg: 15 954

Vad kör du för AV btw?

Mega-virus... -HELP!

Skapa ett konto eller logga in för att kommentera

Skapa ett konto

Logga in