Jag kan inte Googla?

2008-09-18, 19:12 #1

Medlem

Reg: Okt 2005

Inlägg: 889

Hej, har ett jävligt irriterande problem. Jag installerade om datorn igår efter en massiv virusinfektion på datorn. Och nu kan jag inte söka med google. Jag kan gå in på googles hemsida men om jag försöker söka på nåt så laddar den i evigheter tills webbläsaren låser sig.

Det är inte bara google det gäller utan vissa andra sidor funkar inte heller, medans t ex flashback funkar perfekt. Webbläsaren laddar i all evighet för att tillslut sluta svara/låsa sig. Jag skall tillägga att problemet upprepas både i Firefox (som jag använder som primär webbläsare) och Internet Explorer. Såhär har det varit sen jag formaterade och installerade om C: disken.

Har försökt att söka efter spywares och andra virus men hittar inget!

Vad är det som är fel?!
----------------------------------------------------------------------------
Edit: Andra sidor som inte fungerar är t ex:

Piratebay.org
Piratebits.org
Bilddagboken.se
Download.com

__________________
Senast redigerad av Skabben 2008-09-18 kl. 19:18.

Citera

2008-09-18, 20:22 #2

Medlem

Reg: Jun 2008

Inlägg: 206

Låter faktiskt som att det fattas något för att köra ett script, har du installerat eventuella tillägg?

Samt vad använder du för webbläsare?

Citera

2008-09-18, 20:23 #3

Medlem

Reg: Okt 2005

Inlägg: 270

Testat Google Chrome?

Citera

2008-09-18, 20:36 #4

Medlem

Reg: Okt 2005

Inlägg: 889

Citat:

Ursprungligen postat av Spliffward

Låter faktiskt som att det fattas något för att köra ett script, har du installerat eventuella tillägg?

Samt vad använder du för webbläsare?

Vet inte vilka tillägg som jag borde installera, annars brukar det funka och jag installerar tilläggen allteftersom jag behöver dom.

Citat:

Ursprungligen postat av Skabben

Jag skall tillägga att problemet upprepas både i Firefox (som jag använder som primär webbläsare) och Internet Explorer.

-----------------------------------------------------------------------------

Citat:

Ursprungligen postat av .aspx

Testat Google Chrome?

Nej, testade och verkar inte funka det heller.

Citera

2008-09-18, 21:06 #5

Medlem

Reg: Mar 2007

Inlägg: 12 238

du kan posta en hijackthis logg så ser man om det finns något problem.
spara HJTInstall.exe på skrivbordet >klicka på filen >välj install och klicka på: "do a system scan and save logfile".
posta den loggen från txt filen som visas då.
http://www.trendsecure.com/portal/en...HJTInstall.exe

Citera

2008-09-18, 22:19 #6

Medlem

Reg: Okt 2005

Inlägg: 889

Loggen:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:17:43, on 2008-09-18
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program\Analog Devices\Core\smax4pnp.exe
C:\Program\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program\iTunes\iTunesHelper.exe
C:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program\Eset\nod32kui.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\Windows Live\Messenger\MsnMsgr.Exe
C:\Program\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\ATKKBService.exe
C:\Program\Bonjour\mDNSResponder.exe
C:\Program\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program\iPod\bin\iPodService.exe
C:\Program\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\Program\Ventrilo\Ventrilo.exe
C:\Program\eRightSoft\SUPER\SUPER.exe
C:\Program\Messenger\msmsgs.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program\Outlook Express\msimn.exe
C:\Program\Adobe\Adobe Photoshop CS3\Photoshop.exe
C:\Program\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [Cm108Sound] RunDll32 cm108.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Program\Essentials Codec Pack\update.exe -silent
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [b04b68ee] rundll32.exe "C:\WINDOWS\system32\xsvyvbok.dll",b
O4 - HKLM\..\Run: [nod32kui] "C:\Program\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [BMb3785b72] Rundll32.exe "C:\WINDOWS\system32\inovihoq.dll",s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Append to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O20 - AppInit_DLLs: augwhh.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Bonjour-tjänst (Bonjour Service) - Apple Inc. - C:\Program\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6490 bytes

Exakt hur granskar man en sånhär logg? Vad skall man leta efter?

__________________
Senast redigerad av Skabben 2008-09-18 kl. 22:45.

Citera

2008-09-18, 22:31 #7

Medlem

Reg: Sep 2008

Inlägg: 7 644

Följande verkar lite suspekta:

Citat:

O4 - HKLM\..\Run: [b04b68ee] rundll32.exe "C:\WINDOWS\system32\xsvyvbok.dll",b

O4 - HKLM\..\Run: [BMb3785b72] Rundll32.exe "C:\WINDOWS\system32\inovihoq.dll",s

Testa ta bort dem.

Citera

2008-09-18, 22:41 #8

Medlem

Reg: Mar 2007

Inlägg: 12 238

använd helst spoiler taggar

http://www.besttechie.net/tools/mbam-setup.exe
installera programmet och klicka på scanna när du ser den knappen.
klicka på ok >show results >remove selected, starta om.
gör en ny snabb scan med MBAM, posta den loggen och till sist en HJT logg

Citera

2008-09-18, 23:13 #9

Medlem

Reg: Okt 2005

Inlägg: 889

Citat:

Ursprungligen postat av 927

använd helst spoiler taggar

http://www.besttechie.net/tools/mbam-setup.exe
installera programmet och klicka på scanna när du ser den knappen.
klicka på ok >show results >remove selected, starta om.
gör en ny snabb scan med MBAM, posta den loggen och till sist en HJT logg

Det funkade! Jag älskar dig 927!

Första Malware scanloggen:

Malwarebytes' Anti-Malware 1.28
Databasversion: 1170
Windows 5.1.2600 Service Pack 2

2008-09-18 22:58:14
mbam-log-2008-09-18 (22-58-14).txt

Skanningstyp: Snabb skanning
Antal skannade objekt: 37892
Förfluten tid: 1 minute(s), 49 second(s)

Infekterade minnesprocesser: 0
Infekterade minnesmoduler: 6
Infekterade registernycklar: 17
Infekterade registervärden: 3
Infekterade registerdataposter: 2
Infekterade mappar: 0
Infekterade filer: 41

Infekterade minnesprocesser:
(Inga illasinnade poster hittades)

Infekterade minnesmoduler:
C:\WINDOWS\system32\xsvyvbok.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\xxyywwtR.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\inovihoq.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\augwhh.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\rqRJBQGV.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\brojwllk.dll (Trojan.Vundo) -> Delete on reboot.

Infekterade registernycklar:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{09c72999-5c10-41a3-a524-24661d942003} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\rqrjbqgv (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{09c72999-5c10-41a3-a524-24661d942003} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{5c4b785d-1675-414c-900c-c92c5475765a} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5c4b785d-1675-414c-900c-c92c5475765a} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{a9ba85b7-a918-49fb-b07d-348b56126bbb} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{a9ba85b7-a918-49fb-b07d-348b56126bbb} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{053cd371-15a5-4f21-aa21-283f9ae6ddab} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{053cd371-15a5-4f21-aa21-283f9ae6ddab} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{14f34dc5-15a5-4f21-aa21-283f9ae6ddab} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{14f34dc5-15a5-4f21-aa21-283f9ae6ddab} (Trojan.BHO.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvid er (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Infekterade registervärden:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\b04b68ee (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run\bmb3785b72 (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\ShellExecuteHooks\{09c72999-5c10-41a3-a524-24661d942003} (Trojan.Vundo) -> Delete on reboot.

Infekterade registerdataposter:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\xxyywwtr -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\xxyywwtr -> Delete on reboot.

Infekterade mappar:
(Inga illasinnade poster hittades)

Infekterade filer:
C:\WINDOWS\system32\rqRJBQGV.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\augwhh.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\xxyywwtR.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\Rtwwyyxx.ini (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\Rtwwyyxx.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xsvyvbok.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\kobvyvsx.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\brojwllk.dll (Trojan.BHO.H) -> Delete on reboot.
C:\WINDOWS\system32\inovihoq.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\idqbbqeg.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\aowfyrre.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cqtwnrgr.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\opnlIbCV.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ovpqtmdj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lnwtdrhh.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qnxevcld.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sbmvcvej.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ufgwwyvp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wajsoxvq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fwcjuwmb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gdcwbpab.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\utdtieel.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cxhbmehj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ecxtgxwq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\esiihttt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\eunihldl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hbcaneuq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ijoidnbr.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lxbyqava.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pdpbxc.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pepioteu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kwjhiqtj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wxuqbemb.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ywfouyve.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bxfmpuus.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rbiufill.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rebihxeg.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mcrh.tmp (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\pskt.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BMb3785b72.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BMb3785b72.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

Andra Malwareloggen:

Citera

2008-09-18, 23:14 #10

Medlem

Reg: Okt 2005

Inlägg: 889

Och slutligen HijackThis loggen:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:09:32, on 2008-09-18
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program\Analog Devices\Core\smax4pnp.exe
C:\Program\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program\iTunes\iTunesHelper.exe
C:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program\Eset\nod32kui.exe
C:\Program\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\Windows Live\Messenger\MsnMsgr.Exe
C:\Program\DAEMON Tools\daemon.exe
C:\Program\Messenger\msmsgs.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\ATKKBService.exe
C:\Program\Bonjour\mDNSResponder.exe
C:\Program\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Ventrilo\Ventrilo.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\Program\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [Cm108Sound] RunDll32 cm108.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Media Codec Update Service] C:\Program\Essentials Codec Pack\update.exe -silent
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Append to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O20 - AppInit_DLLs: augwhh.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: Bonjour-tjänst (Bonjour Service) - Apple Inc. - C:\Program\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 6413 bytes

Förstår inte riktigt dock hur trojanerna kan blockera mig från att ladda olika sidor och till vilken nytta gör dom det?

Citera

2008-09-18, 23:22 #11

Medlem

Reg: Mar 2007

Inlägg: 12 238

det är dll filer som är inlästa i webbläsaren, typ som ett tillägg. dom förhindrar men kan säkerligen även dirigera om dig till andra sajter där det finns skitprogram typ xp antivirus

gör en scan med HJT, bocka för den här raden och klicka på knappen fix checked
O20 - AppInit_DLLs: augwhh.dll

Citera

2008-09-18, 23:32 #12

Medlem

Reg: Okt 2005

Inlägg: 889

Citat:

Ursprungligen postat av 927

det är dll filer som är inlästa i webbläsaren, typ som ett tillägg. dom förhindrar men kan säkerligen även dirigera om dig till andra sajter där det finns skitprogram typ xp antivirus

gör en scan med HJT, bocka för den här raden och klicka på knappen fix checked
O20 - AppInit_DLLs: augwhh.dll

Done, tack som fan!

Jag märkte att det ploppade upp jobbiga sidor som blinkade till och dolde sig i bakgrunden. Plus att internet var bra mycket segare. Men nu funkar allt prima igen!

Tack igen!

Citera

Jag kan inte Googla?

Skapa ett konto eller logga in för att kommentera

Skapa ett konto

Logga in