Mangler hjaelp til at rense dette system!

Af Amatør Emil27 | 10-05-2004 18:03 | 1721 visninger | 10 svar, hop til seneste

Min ven har ogsaa faaet mysearchnow.com toolbar med tilhoerende trojanske hest. hvil gerne have hjaelp med loggen: Logfile of HijackThis v1.97.7 Scan saved at 5:59:40 PM, on 5/10/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) a Running processes: C:WINDOWSSystem32smss.exe C:WINDOWSsystem32winlogon.exe C:WINDOWSsystem32services.exe C:WINDOWSsystem32lsass.exe C:WINDOWSsystem32svchost.exe C:WINDOWSSystem32svchost.exe C:WINDOWSsystem32spoolsv.exe C:PROGRA~1GrisoftAVG7avgamsvr.exe C:PROGRA~1GrisoftAVG7avgupsvc.exe C:WINDOWSwanmpsvc.exe C:WINDOWSSystem32wltrysvc.exe C:WINDOWSSystem32cmwltry.exe C:WINDOWSExplorer.EXE C:WINDOWSSystem32hkcmd.exe C:WINDOWSAGRSMMSG.exe C:Program FilesApoint2KApoint.exe C:Program FilesFujitsuFujitsu Hotkey UtilityIndicatorUty.exe C:Program FilesFujitsuApplication PanelQuickTouch.exe C:Program FilesFujitsuBtnHndBtnHnd.exe C:WINDOWSsystem32dla fswctrl.exe C:Program FilesCommon FilesRealUpdate_OB ealsched.exe C:Program FilesWinampWinampa.exe C:WINDOWSSystem32javaw.exe C:PROGRA~1GrisoftAVG7avgcc.exe C:PROGRA~1GrisoftAVG7avgemc.exe C:Program FilesMUSICMATCHMUSICMATCH Jukeboxmmtask.exe C:Program FilesMSN MessengerMsnMsgr.Exe C:Program FilesApoint2KApntex.exe C:WINDOWSSystem32wuauclt.exe C:WINDOWSSystem32MOStat.exe C:Program FilesWebSavingsfromEbatesWebSavingsfromEbates.exe C:Documents and SettingsOwnerDesktopHijackThis.exe R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://msnbc.msn.com[...] R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.fujitsupc.com[...] R1 - HKCUSoftwareMicrosoftInternet Connection Wizard,Shellnext = http://www.fujitsupc.com[...] N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:Documents and SettingsOwnerApplication DataMozillaProfilesdefaultk22b0v4w.sltprefs.js) O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - C:Program FilesMyWaySrchAstt1.binMYSRCHAS.DLL O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:Program FilesMyWaymyBar1.binMYBAR.DLL O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 5.0ReaderActiveXAcroIEHelper.ocx O2 - BHO: (no name) - {4AF90A70-643E-45DB-8F26-31ECF03EA181} - C:WINDOWSsystem32moz030715s.dll O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:WINDOWSsystem32dla fswshx.dll O2 - BHO: (no name) - {AD8F4C6E-53E6-45B6-A2C2-667E86B86FA7} - C:WINDOWSsystem32qkmkg.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:Program FilesMyWaymyBar1.binMYBAR.DLL O4 - HKLM..Run: [HotKeysCmds] C:WINDOWSSystem32hkcmd.exe O4 - HKLM..Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM..Run: [Apoint] C:Program FilesApoint2KApoint.exe O4 - HKLM..Run: [IndicatorUtility] C:Program FilesFujitsuFujitsu Hotkey UtilityIndicatorUty.exe O4 - HKLM..Run: [LoadFujitsuQuickTouch] C:Program FilesFujitsuApplication PanelQuickTouch.exe O4 - HKLM..Run: [LoadBtnHnd] C:Program FilesFujitsuBtnHndBtnHnd.exe O4 - HKLM..Run: [StorageGuard] "C:Program FilesVERITAS SoftwareUpdate Managersgtray.exe" /r O4 - HKLM..Run: [dla] C:WINDOWSsystem32dla fswctrl.exe O4 - HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OB ealsched.exe" -osboot O4 - HKLM..Run: [WinampAgent] "C:Program FilesWinampWinampa.exe" O4 - HKLM..Run: [WebSavingsfromEbates] javaw -cp "C:Program FilesWebSavingsfromEbatesSystemCode" Main lp: "C:Program FilesWebSavingsfromEbates" O4 - HKLM..Run: [AVG7_CC] C:PROGRA~1GrisoftAVG7avgcc.exe /STARTUP O4 - HKLM..Run: [AVG7_EMC] C:PROGRA~1GrisoftAVG7avgemc.exe O4 - HKLM..Run: [mmtask] C:Program FilesMUSICMATCHMUSICMATCH Jukeboxmmtask.exe O4 - HKCU..Run: [Forbes] C:Program FilesForbesForbesAlerts.exe O4 - HKCU..Run: [MsnMsgr] "C:Program FilesMSN MessengerMsnMsgr.Exe" /background O4 - Global Startup: Adobe Gamma Loader.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:Program FilesAmerica Online 8.0aoltray.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:PROGRA~1MICROS~3Office10EXCEL.EXE/3000 O8 - Extra context menu item: E&xport to Microsoft Office Excel - res://C:PROGRA~1MICROS~3OFFICE11EXCEL.EXE/3000 O8 - Extra context menu item: Web Savings - file://C:Program FilesWebSavingsfromEbatesSystemTempebateswebsavings_script0.htm O9 - Extra button: Opslag (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: Real.com (HKLM) O9 - Extra button: @C:Program FilesMessengerMsgslang.dll,-61144 (HKLM) O9 - Extra 'Tools' menuitem: @C:Program FilesMessengerMsgslang.dll,-61144 (HKLM) O12 - Plugin for .bcf: C:Program FilesInternet ExplorerPluginsNPBelv32.dll O12 - Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://www.fujitsupc.com[...] O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com[...] O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com[...] O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com[...] O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com[...] O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com[...] O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com[...] O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.bgbank.dk[...] O16 - DPF: {EE2589EB-7FC8-44DB-A892-573F2C4B41E0} - http://pdf.forbes.com[...] Han er amerikaner! Det er derfor at hans keyboard ikke har vores skandibogstaver! paa forhaand tak!
--

Try to remember the paradox of life. Everybody dies nobody makes it!

#1
Azger
Gæst
10-05-2004 18:14

Rapporter til Admin

Kan en scanning og rens med ad-aware mon ikke gøre det? http://www.lavasoftusa.com[...]
--
Gæstebruger, opret dit eget login og få din egen signatur.

#2
Crash
Bruger Aspirant
10-05-2004 18:19

Rapporter til Admin

Prøv også Spy Sweeper det kan fjerne næsten alt spyware :o]
--
¬ P4 2.8GHz NW C @ 3.8 H2O ¬ 1536 MB DUAL OcZ 4200 ¬ Abit IC7-G ¬ 850GB Western Digital ¬ Sapphire 9800XT 256 MB ¬ Eizo 21" F77S ¬ Logitech MX510 ¬ SB Live 5.1 ¬ Server Cube ¬

#3
Armageddon
Nørd
10-05-2004 18:50

Rapporter til Admin

Hejsa, Det ser jo lidt skidt ud, men det får vi hurtigt fixet. Start med at deaktivere systemgendannelse. Kør en ny scanning med HJT og sæt flueben ved disse: R1 - HKLMSoftwareMicrosoftInternet ExplorerMain,Default_Page_URL = http://www.fujitsupc.com[...] R1 - HKCUSoftwareMicrosoftInternet Connection Wizard,Shellnext = http://www.fujitsupc.com[...] N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%5Csearchplugins%5CSBWeb_01.src"); (C:Documents and SettingsOwnerApplication DataMozillaProfilesdefaultk22b0v4w.sltprefs.js) O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-3ECD647AA554} - C:Program FilesMyWaySrchAstt1.binMYSRCHAS.DLL O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:Program FilesMyWaymyBar1.binMYBAR.DLL O2 - BHO: (no name) - {4AF90A70-643E-45DB-8F26-31ECF03EA181} - C:WINDOWSsystem32moz030715s.dll O2 - BHO: (no name) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:WINDOWSsystem32dla fswshx.dll O2 - BHO: (no name) - {AD8F4C6E-53E6-45B6-A2C2-667E86B86FA7} - C:WINDOWSsystem32qkmkg.dll O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:Program FilesMyWaymyBar1.binMYBAR.DLL O4 - HKLM..Run: [dla] C:WINDOWSsystem32dla fswctrl.exe O4 - HKLM..Run: [TkBellExe] "C:Program FilesCommon FilesRealUpdate_OB ealsched.exe" -osboot O4 - HKLM..Run: [WebSavingsfromEbates] javaw -cp "C:Program FilesWebSavingsfromEbatesSystemCode" Main lp: "C:Program FilesWebSavingsfromEbates" O4 - HKCU..Run: [Forbes] C:Program FilesForbesForbesAlerts.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:Program FilesAmerica Online 8.0aoltray.exe O8 - Extra context menu item: Web Savings - file://C:Program FilesWebSavingsfromEbatesSystemTempebateswebsavings_script0.htm O14 - IERESET.INF: START_PAGE_URL=http://www.fujitsupc.com[...] Luk alle øvrige programvinduer så kun HJT er åben. Klik på ”Fix checked”. Luk programmet og genstart i fejlsikret tilstand. Find og slet disse: C:\WINDOWS\system32\dla fswctrl.exe C:\WINDOWS\System32\MOStat.exe C:\Program Files\WebSavingsfromEbates\WebSavingsfromEbates.exe (hele “WebSavingsfromEbates” mappen skal væk) C:\Program Files\MyWay\SrchAstt1.bin\MYSRCHAS.DLL (hele “MyWay” mappen skal væk) C:\Program Files\MyWay\myBar1.bin\MYBAR.DLL (hele “MyWay” mappen skal væk) C:\WINDOWS\system32\moz030715s.dll C:\WINDOWS\system32\dla fswshx.dll C:\WINDOWS\system32\qkmkg.dll C:\Program Files\Forbes\ForbesAlerts.exe (hele ”Forbes” mappen skal væk) Genstart normalt. Kør med Ad-aware, Spybot S&D og CWShredder. Adaware http://www.lavasoft.de[...] SpyBot S&D http://www.safer-networking.org[...] CWShredder http://www.spywareinfo.com[...] Kør en ny scanning med HJT og smid loggen herind til kontrol.
--
/Armageddon - [email protected] http://www.mdegn.dk[...]

#4
Kim In Chul
Bruger Aspirant
10-05-2004 18:51

Rapporter til Admin

glem nu ikke Spybot Search And Destroy
--

#5
Emil27
Amatør
10-05-2004 19:20

Rapporter til Admin

Det er spybot S&D
--
Try to remember the paradox of life. Everybody dies nobody makes it!

#6
Emil27
Amatør
10-05-2004 19:52

Rapporter til Admin

Logfile of HijackThis v1.97.7 Scan saved at 7:52:41 PM, on 5/10/2004 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:WINDOWSSystem32smss.exe C:WINDOWSsystem32winlogon.exe C:WINDOWSsystem32services.exe C:WINDOWSsystem32lsass.exe C:WINDOWSsystem32svchost.exe C:WINDOWSSystem32svchost.exe C:WINDOWSsystem32spoolsv.exe C:PROGRA~1GrisoftAVG7avgamsvr.exe C:PROGRA~1GrisoftAVG7avgupsvc.exe C:WINDOWSwanmpsvc.exe C:WINDOWSSystem32wltrysvc.exe C:WINDOWSSystem32cmwltry.exe C:WINDOWSExplorer.EXE C:WINDOWSSystem32hkcmd.exe C:WINDOWSAGRSMMSG.exe C:Program FilesApoint2KApoint.exe C:Program FilesFujitsuFujitsu Hotkey UtilityIndicatorUty.exe C:Program FilesFujitsuApplication PanelQuickTouch.exe C:Program FilesFujitsuBtnHndBtnHnd.exe C:PROGRA~1GrisoftAVG7avgcc.exe C:PROGRA~1GrisoftAVG7avgemc.exe C:Program FilesMUSICMATCHMUSICMATCH Jukeboxmmtask.exe C:Program FilesMSN MessengerMsnMsgr.Exe C:Program FilesApoint2KApntex.exe C:Program FilesInternet Exploreriexplore.exe C:Documents and SettingsOwnerDesktopHijackThis.exe R0 - HKCUSoftwareMicrosoftInternet ExplorerMain,Start Page = http://msnbc.msn.com[...] N3 - Netscape 7: user_pref("browser.search.defaultengine", "http://www.google.com[...] (C:Documents and SettingsOwnerApplication DataMozillaProfilesdefaultk22b0v4w.sltprefs.js) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:Program FilesAdobeAcrobat 5.0ReaderActiveXAcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:PROGRA~1SPYBOT~1SDHelper.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:WINDOWSSystem32msdxm.ocx O4 - HKLM..Run: [HotKeysCmds] C:WINDOWSSystem32hkcmd.exe O4 - HKLM..Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM..Run: [Apoint] C:Program FilesApoint2KApoint.exe O4 - HKLM..Run: [IndicatorUtility] C:Program FilesFujitsuFujitsu Hotkey UtilityIndicatorUty.exe O4 - HKLM..Run: [LoadFujitsuQuickTouch] C:Program FilesFujitsuApplication PanelQuickTouch.exe O4 - HKLM..Run: [LoadBtnHnd] C:Program FilesFujitsuBtnHndBtnHnd.exe O4 - HKLM..Run: [StorageGuard] "C:Program FilesVERITAS SoftwareUpdate Managersgtray.exe" /r O4 - HKLM..Run: [WinampAgent] "C:Program FilesWinampWinampa.exe" O4 - HKLM..Run: [AVG7_CC] C:PROGRA~1GrisoftAVG7avgcc.exe /STARTUP O4 - HKLM..Run: [AVG7_EMC] C:PROGRA~1GrisoftAVG7avgemc.exe O4 - HKLM..Run: [mmtask] C:Program FilesMUSICMATCHMUSICMATCH Jukeboxmmtask.exe O4 - HKCU..Run: [MsnMsgr] "C:Program FilesMSN MessengerMsnMsgr.Exe" /background O4 - Global Startup: Adobe Gamma Loader.lnk = C:Program FilesCommon FilesAdobeCalibrationAdobe Gamma Loader.exe O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:Program FilesAmerica Online 8.0aoltray.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:PROGRA~1MICROS~3Office10EXCEL.EXE/3000 O8 - Extra context menu item: E&xport to Microsoft Office Excel - res://C:PROGRA~1MICROS~3OFFICE11EXCEL.EXE/3000 O9 - Extra button: Opslag (HKLM) O9 - Extra button: Related (HKLM) O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM) O9 - Extra button: Real.com (HKLM) O9 - Extra button: @C:Program FilesMessengerMsgslang.dll,-61144 (HKLM) O9 - Extra 'Tools' menuitem: @C:Program FilesMessengerMsgslang.dll,-61144 (HKLM) O12 - Plugin for .bcf: C:Program FilesInternet ExplorerPluginsNPBelv32.dll O12 - Plugin for .spop: C:Program FilesInternet ExplorerPluginsNPDocBox.dll O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com[...] O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) - http://download.macromedia.com[...] O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com[...] O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com[...] O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com[...] O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com[...] O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) - https://netbank.bgbank.dk[...] O16 - DPF: {EE2589EB-7FC8-44DB-A892-573F2C4B41E0} - http://pdf.forbes.com[...] Saa har vi gjort hvad du bad om! Kan dette godkendes?
--
Try to remember the paradox of life. Everybody dies nobody makes it!

#7
Armageddon
Nørd
10-05-2004 19:57

Rapporter til Admin

Der var lige en linie jeg overså i kampens hede (derfor er kontrol jo godt, hehe) O16 - DPF: {EE2589EB-7FC8-44DB-A892-573F2C4B41E0} - http://pdf.forbes.com[...] Fix lige denne. Så er loggen flot og ren. I kan godt aktivere systemgendannelse igen.
--
/Armageddon - [email protected] http://www.mdegn.dk[...]

#8
tAHellal
Ultrabruger
10-05-2004 20:01

Rapporter til Admin

#3 - det er du jo så RET hardcore til!!!
--
http://www.casetech.dk[...] - Casemodding: billeder og guides - Ja det var da tanken :D

#9
Emil27
Amatør
10-05-2004 22:23

Rapporter til Admin

Tusind tak! Jeg har fjernet den sidste og det kører bare top dollar! endnu en gang tak for hjælpen!
--
Try to remember the paradox of life. Everybody dies nobody makes it!

#10
Armageddon
Nørd
10-05-2004 22:26

Rapporter til Admin

Så var vi jo heldige nok engang :)
--
/Armageddon - [email protected] http://www.mdegn.dk[...]