Hej Saaed

Vi skal bestemt ikke se hele den logfil fra dr. web det vil også forstyrre vores site, hvis så stor en fil bliver kopieret herind. Det er kun en lille del af loggen, som vi gerne vil se:

Klik så på Start->Søg, find filen drweb32w.log kopier det nederste af teksten herind,

startende med: Scan statistics.

Vejledning i billeder findes her:
http://fromsej.dk/Vejledninger/html/drweb.html

Du har installeret et fildelingsprg. som Shareaza Det vil vi anbefale at du afinstallere igen. Den letteste måde at blive inficeret på, er at installere fildelingsprg.

Og så har du lidt orm, så du skal have onlinescannet din maskine for vira her:

Bitdefender onlinescanner

Genstart, og kopier en frisk log herind til tjek.

Hej og tak fordi I gad og kigge på filerne.
Her er drweb logfilen.Jeg prøver at afinstallere fildelingen og scane online.
Hvad med det frygtelige lyd fra harddisken(boble boble)b. bliver den forsvundet?
på genhør
hej så længe

Scan statistics
——————————————————————————————————————-
Objects scanned: 83799
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 3
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 1332 Kb/s
Scan time: 00:51:18
——————————————————————————————————————-

=============================================================================
Total session statistics
=============================================================================
Objects scanned: 83881
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 3
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 1336 Kb/s
Scan time: 00:51:28
=============================================================================

Hej Saeed

Det ser ud til at der er fundet Adware programs, men jeg kan ikke se, at der skulle være gjort noget for at fjerne dem.

Hvis du ikke allerede har Ad-Aware, så hent og installer programmet. Opdater det straks efter installationen - inden du kører en scanning. Fjern alt hvad programmet finder. Programmet samt brugervejledning på dansk finder du her: Ad-Aware

Hej igen
Jeg gjorde alt hvad der blev bedt om
her er log filerne
Igen forsviner mine genveje ikoner fra skrive bord når pause skærm begynder.
Hvordan kan jeg kontakte bullgurds medarbejder. Jeg har 17 filer som ikke kan repereres.

Logfile of HijackThis v1.99.1
Scan saved at 17:28:12, on 26-11-2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\BullGuard Software\BullGuard\bullguard.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\cidaemon.exe
C:\WINDOWS\System32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings\Saeed\My Documents\Download filer\Hijackthis\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.spywarefri.dk/
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Radio; - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google; - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SpySweeper] “C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe” /startintray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe”  -osboot
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [HTML Help System] hhs.pif
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] “C:\Program Files\Logitech\Video\ManifestEngine.exe” boot
O4 - HKCU\..\Run: [Skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized
O4 - HKCU\..\Run: [Shareaza] “C:\Program Files\K-litePro\K-litePro.exe” -tray
O4 - HKCU\..\Run: [BullGuard] “C:\Program Files\BullGuard Software\BullGuard\bullguard.exe”
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Ulead Photo Express 3.0 SE Calendar Checker.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 3.0 SE\CalCheck.exe
O8 - Extra context menu item: &Google; Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search; in Dicfa.com - c:\dicfa\dicfasearch.htm
O8 - Extra context menu item: &Translate; English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra ‘Tools’ menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O16 - DPF: {029FDBA6-3547-11D7-AA4C-0050BF051A00} (Rawflow ICD Client) - http://downol.dr.dk/download/netradio/Rawflow.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{60E63665-C254-4C86-9957-A96248F56841}: NameServer = 213.150.135.211 195.58.103.21
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - “C:\PROGRA~1\MSNMES~1\msgrapp.dll” (file missing)
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: BullGuard LiveUpdate (BGLiveSvc) - BullGuard, Ltd. - C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: Msdebugsrv1 (Msdebugsrv) - Unknown owner - C:\WINDOWS\dbg32hlp.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

Scan statistics
——————————————————————————————————————-
Objects scanned: 83470
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 3
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 0
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 1336 Kb/s
Scan time: 00:50:49
——————————————————————————————————————-

C:\System Volume Information\_restore{61E54C37-38F9-49F7-9738-94C48BA20697}\RP43\A0034851.exe - deleted
C:\System Volume Information\_restore{61E54C37-38F9-49F7-9738-94C48BA20697}\RP44\A0034988.exe - deleted
C:\System Volume Information\_restore{61E54C37-38F9-49F7-9738-94C48BA20697}\RP61\A0102238.dll - deleted

=============================================================================
Total session statistics
=============================================================================
Objects scanned: 83552
Infected objects found: 0
Objects with modifications found: 0
Suspicious objects found: 0
Adware programs found: 3
Dialer programs found: 0
Joke programs found: 0
Riskware programs found: 0
Hacktool programs found: 0
Objects cured: 0
Objects deleted: 3
Objects renamed: 0
Objects moved: 0
Objects ignored: 0
Scan speed: 1340 Kb/s
Scan time: 00:50:58
=============================================================================

Du kan altid kontakte BullGuards support på support(at)bullguard.com eller chatte med dem herfra: http://www.bullguard.com/support/livechat.aspx men husk at have brugernavn (mailadresse) samt kode parat.

Tak
her kommer logfilen(bulluard), jeg kunne ikke finde den før.

Results after ROUND 1
___________________________________________________________

Scan started: Saturday, November 26, 2005 17:04:30
Scan duration: 0 days, 00 hours, 00 minutes, 04 seconds
Infections solved: 0
Infections left: 17
Viruses left: 1

——[  Files Still Infected ]——————

Virus: Trojan.Spy.ZangoCash
Status:  Disinfect Failed
  C:\azc.exe=>(RAR Sfx o)=>3swa3.exe
  C:\System Volume Information\_restore{61E54C37-38F9-49F7-9738-94C48BA20697}\RP38\A0020328.exe=>(RAR Sfx o)=>3swa3.exe
  C:\System Volume Information\_restore{61E54C37-38F9-49F7-9738-94C48BA20697}\RP38\A0021342.exe=>(RAR Sfx o)=>3swa3.exe
  C:\System Volume Information\_restore{61E54C37-38F9-49F7-9738-94C48BA20697}\RP38\A0022350.exe=>(RAR Sfx o)=>3swa3.exe
  C:\System Volume Information\_restore{61E54C37-38F9-49F7-9738-94C48BA20697}\RP38\A0023363.exe=>(RAR Sfx o)=>3swa3.exe
  C:\System Volume Information\_restore{61E54C37-38F9-49F7-9738-94C48BA20697}\RP42\A0025753.exe=>(RAR Sfx o)=>3swa3.exe
  C:\System Volume Information\_restore{61E54C37-38F9-49F7-9738-94C48BA20697}\RP43\A0026686.exe=>(RAR Sfx o)=>3swa3.exe
  C:\System Volume Information\_restore{61E54C37-38F9-49F7-9738-94C48BA20697}\RP43\A0027690.exe=>(RAR Sfx o)=>3swa3.exe
  C:\System Volume Information\_restore{61E54C37-38F9-49F7-9738-94C48BA20697}\RP43\A0028697.exe=>(RAR Sfx o)=>3swa3.exe
  C:\System Volume Information\_restore{61E54C37-38F9-49F7-9738-94C48BA20697}\RP43\A0028759.exe=>(RAR Sfx o)=>3swa3.exe
  C:\System Volume Information\_restore{61E54C37-38F9-49F7-9738-94C48BA20697}\RP43\A0028785.exe=>(RAR Sfx o)=>3swa3.exe
  C:\System Volume Information\_restore{61E54C37-38F9-49F7-9738-94C48BA20697}\RP43\A0031783.exe=>(RAR Sfx o)=>3swa3.exe
  C:\System Volume Information\_restore{61E54C37-38F9-49F7-9738-94C48BA20697}\RP43\A0032784.exe=>(RAR Sfx o)=>3swa3.exe
  C:\System Volume Information\_restore{61E54C37-38F9-49F7-9738-94C48BA20697}\RP43\A0033784.exe=>(RAR Sfx o)=>3swa3.exe
  C:\System Volume Information\_restore{61E54C37-38F9-49F7-9738-94C48BA20697}\RP43\A0034796.exe=>(RAR Sfx o)=>3swa3.exe
  C:\System Volume Information\_restore{61E54C37-38F9-49F7-9738-94C48BA20697}\RP43\A0034826.exe=>(RAR Sfx o)=>3swa3.exe
  C:\zcgc1.exe=>(RAR Sfx o)=>3swa3.exe

Deaktiver systemgendannelse, genstart og genaktiver den, så er Bullguardproblemet løst.
http://spywarefri.dk/virusscannere.htm#alle - Systemgendannelse.

Angående dine ikoner, hvad med bare at droppe brugen af pauseskærm?