Smitfraud-c.msvps

**guccijana** · #1 29th 2008, 09:16

her vi går igjen

Logfile of Trend Micro HijackThis v2.0.2
Scan lagret 11:13:49, på 1/29/2008
Plattform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Kjører prosesser:
C: \ WINDOWS \ System32 \ smss.exe
C: \ WINDOWS \ system32 \ Winlogon.exe
C: \ WINDOWS \ system32 \ Services.exe
C: \ WINDOWS \ system32 \ Lsass.exe
C: \ WINDOWS \ system32 \ Ati2evxx.exe
C: \ WINDOWS \ system32 \ Svchost.exe
C: \ WINDOWS \ system32 \ Svchost.exe
C: \ Programfiler \ Avast4Software \ Avast4 \ aswUpdSv.exe
C: \ Programfiler \ Avast4Software \ Avast4 \ ashServ.exe
C: \ WINDOWS \ system32 \ Spoolsv.exe
C: \ WINDOWS \ system32 \ brss01a.exe
C: \ WINDOWS \ Explorer.exe
C: \ Programfiler \ Intel \ Intel Application Accelerator \ iaanotif.exe
C: \ Programfiler \ Intel \ Modem Event Monitor \ IntelMEM.exe
C: \ Programfiler \ Creative \ Sound Blaster Live! 24-bit \ Surround Mixer \ CTSysVol.exe
C: \ WINDOWS \ system32 \ rundll32.exe
C: \ Programfiler \ Dell \ Media Experience \ PCMService.exe
C: \ Program Files \ Cyberlink \ PowerDVD \ DVDLauncher.exe
C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe
C: \ progra ~ 1 \ Yahoo! \ Browser \ ybrwicon.exe
C: \ Programfiler \ BroadJump \ Client Foundation \ CFD.exe
C: \ progra ~ 1 \ Yahoo! \ Browser \ ycommon.exe
C: \ Programfiler \ Adobe \ Photoshop Elements 4.0 \ apdproxy.exe
C: \ WINDOWS \ system32 \ Spool \ drivers \ W32X86 \ 3 \ E_FATIA JA.EXE
C: \ progra ~ 1 \ AVAST4 ~ 1 \ Avast4 \ ashDisp.exe
C: \ Programfiler \ QuickTime \ QTTask.exe
C: \ Programfiler \ iTunes \ iTunesHelper.exe
C: \ Programfiler \ SUPERAntiSpyware \ SUPERAntiSpyware.exe
C: \ Programfiler \ Spybot - Search & Destroy \ TeaTimer.exe
C: \ WINDOWS \ system32 \ Ctfmon.exe
C: \ Programfiler \ Linksys EasyLink Advisor \ LinksysAgent.exe
C: \ WINDOWS \ system32 \ WTablet \ TabUserW.exe
C: \ Programfiler \ Adobe \ Photoshop Elements 3.0 \ PhotoshopElementsFileAgent.exe
C: \ Programfiler \ Adobe \ Photoshop Elements 4.0 \ PhotoshopElementsFileAgent.exe
C: \ progra ~ 1 \ FELLES ~ 1 \ AOL \ ACS \ acsd.exe
C: \ Programfiler \ APC \ APC PowerChute Personal Edition \ mainserv.exe
C: \ Programfiler \ Fellesfiler \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe
C: \ Programfiler \ Grisoft \ AVG Anti-Spyware 7.5 \ guard.exe
C: \ Programfiler \ CIFPFiltering \ CIFPLogAggregator.exe
C: \ WINDOWS \ system32 \ CTsvcCDA.EXE
C: \ Programfiler \ CIFPFiltering \ FilterService.exe
C: \ Programfiler \ Intel \ Intel Application Accelerator \ iaantmon.exe
C: \ Programfiler \ Fellesfiler \ LightScribe \ LSSrvc.exe
C: \ WINDOWS \ system32 \ Svchost.exe
C: \ WINDOWS \ system32 \ Tablet.exe
C: \ WINDOWS \ wanmpsvc.exe
C: \ WINDOWS \ system32 \ MsPMSPSv.exe
C: \ Programfiler \ Avast4Software \ Avast4 \ ashMaiSv.exe
C: \ Programfiler \ Avast4Software \ Avast4 \ ashWebSv.exe
C: \ Programfiler \ iPod \ bin \ iPodService.exe
C: \ Programfiler \ APC \ APC PowerChute Personal Edition \ apcsystray.exe
C: \ Programfiler \ Avast4Software \ Avast4 \ ashSimpl.exe
C: \ Programfiler \ Mozilla Firefox \ firefox.exe
C: \ Programfiler \ Spybot - Search & Destroy \ SpybotSD.exe
C: \ Program Files \ Windows NT \ Tilbehør \ wordpad.exe
C: \ Documents and Settings \ Tatjana Blazevic \ Skrivebord \ sniper.exe.exe

R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://www.yahoo.com/
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Innstillinger ProxyServer = 127.0.0.1:8080
R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Settings, ProxyOverride = lokale
N3 - Netscape 7: user_pref ( "browser.startup.homepage", "http://home.netscape.com/bookmark/7_2/home.html"), (C: \ Documents and Settings \ Tatjana BLAZEVIC \ Application Data \ Mozilla \ Profiles \ DEFAULT \ mhiwv3o3.slt \ prefs.js)
N3 - Netscape 7: user_pref ( "browser.search.defaultengine", "motor: / / C% 3A% 5CPROGRA% 7E1% 5CNETSCAPE% 5CNETSCAPE% 5Csearchpl ugins% 5CSBWeb_01.src"), (C: \ Documents and Settings \ Tatjana BLAZEVIC \ Application Data \ Mozilla \ Profiles \ DEFAULT \ mhiwv3o3.slt \ prefs.js)
O2 - BHO: AcroIEHlprObj Class - (06849E9F-C8D7-4D59-B87D-784B7D6BE0B3) - C: \ Programfiler \ Adobe \ Acrobat 6.0 \ Reader \ ActiveX \ AcroIEHelper.dll
O2 - BHO: (no name) - (0D5227BF-0C5B-4EA8-833C-FE09F1496F39) - (no file)
O2 - BHO: Spybot-S & D IE Protection - (53707962-6F74-2D53-2644-206D7942484F) - C: \ progra ~ 1 \ Spybot ~ 1 \ SDHelper.dll
O2 - BHO: (no name) - (549B5CA7-4A86-11D7-A4DF-000874180BB3) - (no file)
O2 - BHO: UberButton Class - (5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897) - C: \ Programfiler \ Yahoo! \ Common \ yiesrvc.dll
O2 - BHO: DriveLetterAccess - (5CA3D70E-1895-11CF-8E15-001234567890) - C: \ WINDOWS \ system32 \ dla \ tfswshx.dll
O2 - BHO: YahooTaggedBM Class - (65D886A2-7CA7-479B-BB95-14D1EFB7946A) - C: \ Programfiler \ Yahoo! \ Common \ YIeTagBm.dll
O2 - BHO: SidebarAutoLaunch Class - (F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D) - C: \ Programfiler \ Yahoo! \ Browser \ YSidebarIEBHO.dll
O2 - BHO: (no name) - (FDD3B846-8D59-4ffb-8758-209B6AD74ACC) - (no file)
O3 - Toolbar: McAfee VirusScan - (BA52B914-B692-46c4-B683-905236F6F655) - c: \ progra ~ 1 \ mcafee.com \ vso \ mcvsshl.dll
O4 - HKLM \ .. \ Run: [IAAnotif] "C: \ Programfiler \ Intel \ Intel Application Accelerator \ iaanotif.exe"
O4 - HKLM \ .. \ Run: [ATIPTA] "C: \ Programfiler \ ATI Technologies \ ATI Control Panel \ atiptaxx.exe"
O4 - HKLM \ .. \ Run: [IntelMeM] "C: \ Programfiler \ Intel \ Modem Event Monitor \ IntelMEM.exe"
O4 - HKLM \ .. \ Run: [CTSysVol] "C: \ Programfiler \ Creative \ Sound Blaster Live! 24-bit \ Surround Mixer \ CTSysVol.exe" / r
O4 - HKLM \ .. \ Run: [P17Helper] rundll32 P17.dll, P17Helper
O4 - HKLM \ .. \ Run: [PCMService] "C: \ Programfiler \ Dell \ Media Experience \ PCMService.exe"
O4 - HKLM \ .. \ Run: [DVDLauncher] "C: \ Program Files \ Cyberlink \ PowerDVD \ DVDLauncher.exe"
O4 - HKLM \ .. \ Run: [UpdateManager] "C: \ Programfiler \ Fellesfiler \ Sonic \ Update Manager \ sgtray.exe" / r
O4 - HKLM \ .. \ Run: [dla] C: \ WINDOWS \ system32 \ dla \ tfswctrl.exe
O4 - HKLM \ .. \ Run: [YBrowser] C: \ progra ~ 1 \ Yahoo! \ Browser \ ybrwicon.exe
O4 - HKLM \ .. \ Run: [BJCFD] "C: \ Programfiler \ BroadJump \ Client Foundation \ CFD.exe"
O4 - HKLM \ .. \ Run: [VSOCheckTask] "c: \ progra ~ 1 \ mcafee.com \ vso \ mcmnhdlr.exe" / checktask
O4 - HKLM \ .. \ Run: [Adobe Photo Downloader] "C: \ Programfiler \ Adobe \ Photoshop Elements 4.0 \ apdproxy.exe"
O4 - HKLM \ .. \ Run: [EPSON Stylus Photo R340 Series] "C: \ WINDOWS \ system32 \ Spool \ drivers \ W32X86 \ 3 \ E_FATI AJA.EXE" / P30 "EPSON Stylus Photo R340 Series" / O6 "USB002 "/ M" Stylus Photo R340 "
O4 - HKLM \ .. \ Run: [avast!] C: \ progra ~ 1 \ AVAST4 ~ 1 \ Avast4 \ ashDisp.exe
O4 - HKLM \ .. \ Run: [! AVG Anti-Spyware] "C: \ Programfiler \ Grisoft \ AVG Anti-Spyware 7.5 \ avgas.exe" / minimeres
O4 - HKLM \ .. \ Run: [QuickTime Task] "C: \ Programfiler \ QuickTime \ QTTask.exe"-atboottime
O4 - HKLM \ .. \ Run: [iTunesHelper] "C: \ Programfiler \ iTunes \ iTunesHelper.exe"
O4 - HKCU \ .. \ Run: [Yahoo! Personsøker] "c: \ progra ~ 1 \ Yahoo! \ Messen ~ 1 \ ypager.exe" stille
O4 - HKCU \ .. \ Run: [SUPERAntiSpyware] C: \ Programfiler \ SUPERAntiSpyware \ SUPERAntiSpyware.exe
O4 - HKCU \ .. \ Run: [SpybotSD TeaTimer] C: \ Programfiler \ Spybot - Search & Destroy \ TeaTimer.exe
O4 - HKCU \ .. \ Run: [Ctfmon.exe] C: \ WINDOWS \ system32 \ Ctfmon.exe
O4 - HKCU \ .. \ Run: [EasyLinkAdvisor] "C: \ Programfiler \ Linksys EasyLink Advisor \ LinksysAgent.exe" / oppstart
O4 - Global Startup: APC UPS Status.lnk =?
O4 - Global Startup: TabUserW.exe.lnk = C: \ WINDOWS \ system32 \ WTablet \ TabUserW.exe
O9 - Extra knappen: (no name) - (DFB852A3-47F8-48C4-a200-58CAB36FD2A2) - C: \ progra ~ 1 \ Spybot ~ 1 \ SDHelper.dll
O9 - Extra "Verktøy" MENUITEM: Spybot - Search & Destroy Configuration - (DFB852A3-47F8-48C4-a200-58CAB36FD2A2) - C: \ progra ~ 1 \ Spybot ~ 1 \ SDHelper.dll
O9 - Extra knappen: (no name) - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe
O9 - Extra "Verktøy" MENUITEM: @ xpsp3res.dll, -20001 - (e2e2dd38-d088-4134-82b7-f2ba38496583) - C: \ WINDOWS \ Network Diagnostic \ xpnetdiag.exe
O16 - DPF: (215B8138-A3CF-44C5-803F-8226143CFC0A) (Trend Micro ActiveX Scan Agent 6.6) -- http://prerelease.trendmicro-europe....vex/hcImpl.cab
O16 - DPF: (9A9307A0-7DA4-4DAF-B042-5009F29E09E1) --
O16 - DPF: (DBA230D1-8467-4e69-987E-5FAE815A3B45) --
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C: \ Programfiler \ Adobe \ Photoshop Elements 3.0 \ PhotoshopElementsFileAgent.exe
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C: \ Programfiler \ Adobe \ Photoshop Elements 4.0 \ PhotoshopElementsFileAgent.exe
O23 - Service: AOL Tilkobling Service (AOL ACS) - America Online, Inc. - c: \ progra ~ 1 \ FELLES ~ 1 \ AOL \ ACS \ acsd.exe
O23 - Service: APC UPS Service - American Power Conversion Corporation - C: \ Programfiler \ APC \ APC PowerChute Personal Edition \ mainserv.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C: \ Programfiler \ Fellesfiler \ Apple \ Mobile Device Support \ bin \ AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C: \ WINDOWS \ Microsoft.NET \ Framework \ v2.0.50727 \ aspn et_state.exe (fil mangler)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C: \ Programfiler \ Avast4Software \ Avast4 \ aswUpdSv.exe
O23 - Service: ATI Hurtigtast Poller - Unknown owner - C: \ WINDOWS \ system32 \ Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C: \ Programfiler \ Avast4Software \ Avast4 \ ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C: \ Programfiler \ Avast4Software \ Avast4 \ ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C: \ Programfiler \ Avast4Software \ Avast4 \ ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - Grisoft sro - C: \ Programfiler \ Grisoft \ AVG Anti-Spyware 7.5 \ guard.exe
O23 - Service: BrSplService (Brother XP SPL Service) - Brother Industries Ltd - C: \ WINDOWS \ system32 \ brsvc01a.exe
O23 - Service: CIFPLogAggregator - Unknown owner - C: \ Programfiler \ CIFPFiltering \ CIFPLogAggregator.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C: \ WINDOWS \ system32 \ CTsvcCDA.EXE
O23 - Service: CyclopeInternetFilter - Unknown owner - C: \ Programfiler \ CIFPFiltering \ FilterService.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C: \ Programfiler \ Intel \ Intel Application Accelerator \ iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C: \ Programfiler \ Fellesfiler \ InstallShield \ Driver \ 11 \ Intel 32 \ IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C: \ Programfiler \ iPod \ bin \ iPodService.exe
O23 - Service: LightScribeService Direct Disc Merking Service (LightScribeService) - Unknown owner - C: \ Programfiler \ Fellesfiler \ LightScribe \ LSSrvc.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c: \ progra ~ 1 \ mcafee.com \ vso \ mcshield.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c: \ progra ~ 1 \ mcafee.com \ vso \ mcvsrte.exe
O23 - Service: TabletService - Wacom Technology, Corp - C: \ WINDOWS \ system32 \ Tablet.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C: \ WINDOWS \ wanmpsvc.exe

--
End of file - 11218 bytes

**evilfantasy** · #2 29th 2008, 09:30

Åpne HijackThis og velg Gjør et søk.

Sett et merke ved siden av følgende oppføringer:

O2 - BHO: (no name) - (0D5227BF-0C5B-4EA8-833C-FE09F1496F39) - (no file)
O2 - BHO: (no name) - (549B5CA7-4A86-11D7-A4DF-000874180BB3) - (no file)
O2 - BHO: (no name) - (FDD3B846-8D59-4ffb-8758-209B6AD74ACC) - (no file)

Lukk alle vinduer unntatt HijackThis og klikk Fix kontrolleres.

Avslutt Hijackthis.

----------

Laste ned DrWeb CureIt Og lagre den på skrivebordet ditt.

Scan med DrWeb-CureIt som følger:

Dobbeltklikk drweb-cureit.exe og deretter Start.
En Express Scan på PCen Meldingen vil vises.
Under Start Express Scan Now Klikk OK å starte.
- Dette er en kort skanner som skanner filer kjørende i minnet.
- Hvis eller når noe blir funnet, klikker du Ja knappen når den spør om du vil helbrede den.
Når kort skanningen er ferdig, klikk Valg> Endre innstillinger
Velg Scan kategorien og Fjern merkingen Heuristic analyse og klikk OK
Tilbake til hovedvinduet, velger du Fullstendig skanning knappen.
Deretter klikker du Green Arrow Start Scanning knappen på høyre og skanningen starter.
- Klikk Ja til alle hvis den spør om du vil kurere / flytte filen (e).
Når skanningen er fullført.
I Dr.Web CureIt menyen øverst til venstre, klikker du Fil og velge Lagre rapportliste.
Lagre DrWeb.csv rapport til Desktop.
Avslutt Dr.Web Cureit.

Viktig! Starte datamaskinen på nytt, fordi det kan være mulig at filer som er i bruk vil bli flyttet / slettet under omstart.

Etter omstart, Høyreklikk den Dr.Web logg på skrivebordet og velge Åpne Med> Notisblokk
Kopier og lim denne loggen i neste svar

----------

Neste post
Dr Web log

**guccijana** · #3 29th 2008, 09:47

OKI sin skanning nå - det er funnet et virus CFd.exe! ser ut som den skal ta en stund?

jeg lette gjennom forumet og woooow det er så mange mennesker med virus hehe

**evilfantasy** · #4 29th 2008, 09:50

CFd.exe er egentlig ikke et virus, men det kan ha blitt smittet av en og gjør ingen skade i å bli fjernet.

**guccijana** · #5 29th 2008, 09:56

bør jeg fjerne den manuelt? eller?

**evilfantasy** · #6 29 januar 2008, 10:00

Ingen skanneren vil ta seg av det.

**guccijana** · #7 29th 2008, 10:14

fremgang 27% skanneren finnes to filer man blir "

-cfd.exe-(adware) action kategorien --- uhelbredelig slette>> vil det slette?
-reg-ubp2b Tatjana b.reg (trojan startside)-action kategorien slettet

**guccijana** · #8 29th 2008, 10:17

Hva betyr

Viktig! Starte datamaskinen på nytt, fordi det kan være mulig at filer som er i bruk vil bli flyttet / slettet under omstart. mener??

hvordan gjør jeg det?

**evilfantasy** · #9 29th 2008, 10:20

Bare starte datamaskinen på nytt hvis Dr Web ikke gjøre det for deg.

Vi er nødt til å se loggen for å være sikker på at alt er borte. Det skal ikke ta mye lengre tid nå.

**guccijana** · #10 29 januar 2008, 10:33

ohh ok, det opptil 70% nesten ferdig