[jjssj]

Jeg har kørt malare anti-malware men det er ikke at komme af med alle de vira / hukommelsesmoduler / registery nøgler
Jeg er også løb kapre dette og fjernet nogle. Dll's fundet ved malwarebytes men ikke alle gik.


Malwarebytes' Anti-Malware 1.37
Database version: 2216
Windows 5.1.2600 Service Pack 2

02/06/2009 22:04:31
mbam-log-2009-06-02 (22-04-31). txt

Scan type: Quick Scan
Objekter skannet: 89008
Tidsforbrug: 3 minut (s), 23 sekund (s)

Memory Processes Infected: 0
Memory Modules Infected: 3
Registreringsdatabasenøgler Inficerede: 13
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 2
Files Infected: 7

Memory Processes Infected:
(Nr. ondsindede elementer opdaget)

Memory Modules Infected:
C: \ WINDOWS \ system32 \ dwkljtof.dll (Trojan.Vundo.H) -> Slet om genstart.
C: \ WINDOWS \ system32 \ becbn.dll (Trojan.Agent) -> Slet om genstart.
C: \ WINDOWS \ system32 \ xanyzwy.dll (Trojan.Vundo.H) -> Slet om genstart.

Registreringsdatabasenøgler Inficerede:
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Explorer \ Browser Helper Objects \ (936182df-5f7a-4d1e-a86f-a6d0f061e70a) (Trojan.Vundo.H) -> Slet om genstart.
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon \ Notify \ feuyhaok (Trojan.Vundo.H) -> Slet om genstart.
HKEY_CLASSES_ROOT \ CLSID \ (936182df-5f7a-4d1e-a86f-a6d0f061e70a) (Trojan.Vundo.H) -> Slet om genstart.
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Explorer \ Browser Helper Objects \ (0e8459fd-af07-48F1-8cd1-3884d15eaf47) (Trojan.Vundo.H) -> karantæne og slettet.
HKEY_CLASSES_ROOT \ CLSID \ (0e8459fd-af07-48F1-8cd1-3884d15eaf47) (Trojan.Vundo.H) -> karantæne og slettet.
HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ Curre ntVersion \ Ext \ Stats \ (0e8459fd-af07-48F1-8cd1-3884d15eaf47) (Trojan.Vundo.H) -> karantæne og slettet.
HKEY_LOCAL_MACHINE \ SYSTEM \ ControlSet001 \ Services \ b mbgzbpm (Trojan.Vundo.H) -> karantæne og slettet.
HKEY_LOCAL_MACHINE \ SYSTEM \ ControlSet002 \ Services \ b mbgzbpm (Trojan.Vundo.H) -> karantæne og slettet.
HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Servic es \ bmbgzbpm (Trojan.Vundo.H) -> karantæne og slettet.
HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ Curre ntVersion \ Ext \ Stats \ (936182df-5f7a-4d1e-a86f-a6d0f061e70a) (Trojan.Vundo.H) -> karantæne og slettet.
HKEY_CLASSES_ROOT \ CLSID \ (10c0b0c0-fc01-473b-8ebb-4376353f96e4) (Trojan.Agent) -> karantæne og slettet.
HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ Curre ntVersion \ Ext \ Stats \ (10c0b0c0-fc01-473b-8ebb-4376353f96e4) (Trojan.Agent) -> karantæne og slettet.
HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Explorer \ Browser Helper Objects \ (10c0b0c0-fc01-473b-8ebb-4376353f96e4) (Trojan.Agent) -> karantæne og slettet.

Registry Values Infected:
(Nr. ondsindede elementer opdaget)

Registry Data Items Infected:
HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ Curre ntVersion \ Policies \ System \ DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> karantæne og slettet.
HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ Curre ntVersion \ Policies \ System \ DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> karantæne og slettet.

Folders Infected:
C: \ WINDOWS \ system32 \ append.dll (Trojan.Agent) -> karantæne og slettet.
C: \ WINDOWS \ system32 \ xlib254.dll (Trojan.Agent) -> karantæne og slettet.

Files Infected:
c: \ WINDOWS \ system32 \ xanyzwy.dll (Trojan.Vundo.H) -> Slet om genstart.
C: \ WINDOWS \ system32 \ dwkljtof.dll (Trojan.Vundo.H) -> Slet om genstart.
C: \ WINDOWS \ system32 \ becbn.dll (Trojan.Agent) -> Slet om genstart.
c: \ WINDOWS \ system32 \ zfmhjbu.dll (Trojan.Vundo.H) -> Slet om genstart.
c: \ WINDOWS \ system32 \ bekbn.dll (Trojan.Agent) -> karantæne og slettet.
c: \ Windows \ System32 \ Drivers \ jcnfgawt.sys (Rootkit.Agent) -> Slet om genstart.
c: \ Windows \ System32 \ Drivers \ sjbxdggg.sys (Rootkit.Agent) -> Slet om genstart.





Logfile af Trend Micro HijackThis v2.0.2
Scan gemt kl 22:52:36 den 02/06/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Kørende processer:
C: \ Windows \ System32 \ smss.exe
C: \ Windows \ system32 \ csrss.exe
C: \ Windows \ system32 \ Winlogon.exe
C: \ Windows \ system32 \ Services.exe
C: \ Windows \ system32 \ Lsass.exe
C: \ Windows \ system32 \ Svchost.exe
C: \ Windows \ system32 \ Svchost.exe
C: \ Windows \ System32 \ Svchost.exe
C: \ Windows \ system32 \ Svchost.exe
C: \ Windows \ System32 \ Svchost.exe
C: \ Windows \ System32 \ Svchost.exe
C: \ Windows \ Explorer.EXE
C: \ Windows \ system32 \ Spoolsv.exe
C: \ Windows \ SOUNDMAN.EXE
C: \ Programmer \ ATI Technologies \ ATI.ACE \ cli.exe
C: \ PROGRA ~ 1 \ Agnitum \ OUTPOS ~ 1 \ op_mon.exe
C: \ Windows \ system32 \ carpserv.exe
C: \ PROGRA ~ 1 \ AVG \ AVG8 \ avgtray.exe
C: \ Programmer \ Java \ jre6 \ bin \ jusched.exe
C: \ Windows \ system32 \ Ctfmon.exe
C: \ PROGRA ~ 1 \ Agnitum \ OUTPOS ~ 1 \ acs.exe
C: \ Windows \ System32 \ astsrv.exe
C: \ PROGRA ~ 1 \ AVG \ AVG8 \ avgwdsvc.exe
C: \ Programmer \ Common Files \ Microsoft Shared \ VS7DEBUG \ MDM.EXE
C: \ Programmer \ Common Files \ Nero \ Nero BackItUp 4 \ NBService.exe
C: \ Windows \ system32 \ oodag.exe
C: \ PROGRA ~ 1 \ AVG \ AVG8 \ avgam.exe
C: \ PROGRA ~ 1 \ AVG \ AVG8 \ avgrsx.exe
C: \ PROGRA ~ 1 \ AVG \ AVG8 \ avgnsx.exe
C: \ Windows \ System32 \ Svchost.exe
C: \ Windows \ system32 \ wscntfy.exe
C: \ Windows \ System32 \ Svchost.exe
C: \ Programmer \ ATI Technologies \ ATI.ACE \ cli.exe
C: \ Programmer \ Common Files \ Microsoft Shared \ Source Engine \ Ose.exe
c: \ Programmer \ Fælles filer \ mozilla Shared \ firefox.exe
C: \ Programmer \ Mozilla Firefox \ firefox.exe
C: \ Programmer \ Trend Micro \ HijackThis \ HijackThis.exe

R0 - HKCU \ Software \ Microsoft \ Internet Explorer \ Main, Start Page = http://www.virginmedia.com/
R1 - HKLM \ Software \ Microsoft \ Internet Explorer \ Main, Default_Page_URL = http://www.tiny.com
R1 - HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Int ernet Settings, ProxyOverride = *. lokale
O2 - BHO: AcroIEHelperStub - (18DF081C-E8AD-4283-A596-FA578C2EBDC3) - C: \ Programmer \ Common Files \ Adobe \ Acrobat \ ActiveX \ AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - (3CA2F312-6F6E-4B53-A66E-4E65E497C8C0) - C: \ Programmer \ AVG \ AVG8 \ avgssie.dll
O2 - BHO: Click-to-Call BHO - (5C255C8A-E604-49b4-9D64-90988571CECB) - C: \ Programmer \ Windows Live \ Messenger \ wlchtc.dll
O2 - BHO: Groove GFS Browser Helper - (72853161-30C5-4D22-B7F9-0BBC1D38A37E) - C: \ Programmer \ Microsoft Office \ Office12 \ GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - (9030D464-4C02-4ABF-8ECC-5164760863C6) - C: \ Programmer \ Common Files \ Microsoft Shared \ Windows Live \ WindowsLiveLogin.dll
O2 - BHO: (no name) - (936182df-5f7a-4d1e-a86f-a6d0f061e70a) - C: \ Windows \ system32 \ xanyzwy.dll
O2 - BHO: Java ™ Plug-In 2 SSV Helper - (DBC80044-A445-435b-BC74-9C25C1C588A9) - C: \ Programmer \ Java \ jre6 \ bin \ jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - (E7E6F031-17CE-4C07-BC86-EABFE594F69C) - C: \ Programmer \ Java \ jre6 \ lib \ indsætte \ jqs \ dvs \ jqs_plugin.dll
O4 - HKLM \ .. \ Run: [ATIPTA] "C: \ Programmer \ ATI Technologies \ ATI Control Panel \ atiptaxx.exe"
O4 - HKLM \ .. \ Run: [PinnacleDriverCheck] C: \ WINDOWS \ System32 \ PSDrvCheck.exe
O4 - HKLM \ .. \ Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM \ .. \ Run: [NeroFilterCheck] C: \ WINDOWS \ system32 \ NeroCheck.exe
O4 - HKLM \ .. \ Run: [InCD] C: \ Programmer \ Ahead \ InCD \ InCD.exe
O4 - HKLM \ .. \ Run: [ATICCC] "C: \ Programmer \ ATI Technologies \ ATI.ACE \ cli.exe" runtime-Delay
O4 - HKLM \ .. \ Run: [OutpostMonitor] C: \ PROGRA ~ 1 \ Agnitum \ OUTPOS ~ 1 \ op_mon.exe / bakke / noservice
O4 - HKLM \ .. \ Run: [CARPService] carpserv.exe
O4 - HKLM \ .. \ Run: [AVG8_TRAY] C: \ PROGRA ~ 1 \ AVG \ AVG8 \ avgtray.exe
O4 - HKLM \ .. \ Run: [SunJavaUpdateSched] "C: \ Programmer \ Java \ jre6 \ bin \ jusched.exe"
O4 - HKLM \ .. \ RunServices: [RegisterDropHandler] C: \ PROGRA ~ 1 \ TEXTBR ~ 1.0 \ Bin \ REGIST ~ 1.EXE
O4 - HKCU \ .. \ Run: [Ctfmon.exe] C: \ Windows \ system32 \ Ctfmon.exe
O4 - HKUS \. DEFAULT \ .. \ Run: [Ctfmon.exe] C: \ WINDOWS \ System32 \ Ctfmon.exe (User 'Default user')
O8 - Extra sammenhæng menupunktet: E & ksporter til Microsoft Excel - res: / / C: \ PROGRA ~ 1 \ mikroer ~ 2 \ Office12 \ EXCEL.EXE/3000
O9 - Ekstra knap: Send til OneNote - (2670000A-7350-4f3c-8081-5663EE0C6C49) - C: \ PROGRA ~ 1 \ mikroer ~ 2 \ Office12 \ ONBttnIE.dll
O9 - Extra 'Tools' MENUITEM: S & ende til OneNote - (2670000A-7350-4f3c-8081-5663EE0C6C49) - C: \ PROGRA ~ 1 \ mikroer ~ 2 \ Office12 \ ONBttnIE.dll
O9 - Ekstra knap: Outpost Firewall Pro Quick Tune - (44627E97-789B-40d4-B5C2-58BD171129A1) - C: \ Programmer \ Agnitum \ Outpost Firewall Pro \ ie_bar.dll
O9 - Ekstra knap: Research - (92780B25-18CC-41C8-B9BE-3C9C571A8263) - C: \ PROGRA ~ 1 \ MIC273 ~ 1 \ Office12 \ REFIEBAR.DLL
O9 - Ekstra knap: Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Programmer \ Messenger \ msmsgs.exe
O9 - Extra 'Tools' MENUITEM: Windows Messenger - (FB5F1910-F110-11D2-BB9E-00C04F795683) - C: \ Programmer \ Messenger \ msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL = http://www.tiny.com
O18 - Protocol: grooveLocalGWS - (88FED34C-F0CA-4636-A375-3CB6248B04CD) - C: \ Programmer \ Microsoft Office \ Office12 \ GrooveSystemServices.dll
O18 - Protocol: linkscanner - (F274614C-63F8-47D5-A4D1-FBDDE494F8D1) - C: \ Programmer \ AVG \ AVG8 \ avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C: \ Windows \ System32 \ avgrsstx.dll
O20 - Winlogon Notify: feuyhaok - C: \ Windows \ System32 \ xanyzwy.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Ukendt ejer - C: \ Programmer \ Lavasoft \ Ad-Aware \ aawservice.exe (filen mangler)
O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd - C: \ PROGRA ~ 1 \ Agnitum \ OUTPOS ~ 1 \ acs.exe
O23 - Service: AST Service (astcc) - Nalpeiron Ltd - C: \ Windows \ System32 \ astsrv.exe
O23 - Service: Ati Genvejstast Poller - ATI Technologies Inc. - C: \ Windows \ System32 \ Ati2evxx.exe
O23 - Service: ATI Smart - Unknown ejer - C: \ WINDOWS \ system32 \ ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C: \ Programmer \ Common Files \ Autodesk Shared \ Service \ AdskScSrv.exe
O23 - Service: Autodesk Network Licensing Service - Autodesk, Inc. - C: \ Programmer \ Common Files \ Autodesk Shared \ Service \ AdskNetSrv.exe
O23 - Service: AVG8 vagthund (avg8wd) - AVG Technologies CZ, sro - C: \ PROGRA ~ 1 \ AVG \ AVG8 \ avgwdsvc.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown ejer - C: \ Windows \
O23 - Service: Bonjour Service - Ukendt ejer - C: \ Programmer \ Bonjour \ mDNSResponder.exe (filen mangler)
O23 - Service: EpsonBidirectionalService - Ukendt ejer - C: \ Programmer \ Common Files \ Epson \ EBAPI \ eEBSVC.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C: \ Programmer \ Common Files \ Macrovision Shared \ FLEXnet Publisher \ FNPLicensingService.exe
O23 - Service: gearsec - GEAR Software - C: \ Windows \ system32 \ gearsec.exe
O23 - Service: InstallDriver Tabel Manager (IDriverT) - Macrovision Corporation - C: \ Programmer \ Common Files \ InstallShield \ Driver \ 11 \ Intel 32 \ IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C: \ Programmer \ Ahead \ InCD \ InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C: \ Programmer \ iPod \ bin \ iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C: \ Programmer \ Java \ jre6 \ bin \ jqs.exe
O23 - Service: License Management Service ESD - element5 - C: \ Programmer \ Common Files \ element5 Shared \ Service \ Licence Manager ESD.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C: \ Programmer \ Common Files \ Nero \ Nero BackItUp 4 \ NBService.exe
O23 - Service: O & O Defrag - O & O Software GmbH - C: \ Windows \ system32 \ oodag.exe
O23 - Service: PC Tools Hjælpeansatte Service (sdauxservice) - PC Tools - C: \ Programmer \ Spyware Doctor \ pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdcoreservice) - PC Tools - C: \ Programmer \ Spyware Doctor \ pctsSvc.exe
O23 - Service: ThreatFire (threatfire) - PC Tools - C: \ Programmer \ Spyware Doctor \ TFEngine \ TFService.exe
O23 - Service: Automatiske opdateringer (wuauserv) - Ukendt ejer - C: \ Windows \

--
End of file - 7951 bytes


Enhver hjælpe venligst, computer er at blive tosset låsning Jobliste, browsingmønstre er en smerte med konstant pop-ups, nogle programmer er slået fra. Jeg tænker på en fuldstændig re-install. Men vil bare systemet stabilt til back-up filerne.

[evilfantasy]

Downloade DDS af subs og gemme den på dit skrivebord. Suppleant DDS download-link

Vista-brugere højreklikke på dds og vælge Kør som administrator (du vil modtage en UAC prompt, lad det)

* XP-brugere Dobbeltklik på dds at køre den.
* Hvis dit antivirus eller firewall forsøge at blokere DDS skal du lade den køre.
* Når du er færdig DDS vil åbne to (2) logfiler.

1) DDS.txt
2) Attach.txt

* Gem både logger på skrivebordet.
* Du kopiere og indsætte hele indholdet i både logfilerne i dit næste svar.

Bemærk: DDS vil instruere dig til at sende den Attach.txt log som en vedhæftet fil.
Vær venlig at sende det som du ville enhver anden log ved at kopiere og indsætte det i svaret.