Spyware skadad dator - PCHemma

Forum » Virusakuten » AntimalwareGuru hjälper dig! » Spyware skadad dator

Visa det senaste inlägget

Spyware skadad dator / av alexanderr

alexanderr Registrerad 2010-10-27 Poster: 6 Från N/A
	Rapportera #1 2010-10-27 kl 20:13
	Hejsan! Jag har råkat få ner något lite kraftigare virus än vanligt på min dator, vet dock inte var jag fått det från. Hursomhelst, en dag när jag satta på datorn (kör Win7) kom det 2 felmeddelande på en svart bakgrund. 1. (med "explorer.exe" som namn på rutan) Class not registered. 2. See the logfile 'C $:\$ windows\Guest.exe.log' for details. Min explorer.exe (d.v.s processen winlogon?) har alltså slutat att fungera. Jag satte direkt mitt Kaspersky Pure antivirus på att skanna datorn. Gjorde en stor genomsökning två gånger, hittade ca 12 smittade filer första gången och 4 nästa gång. Jag var inte helt nöjd med resultatet eftersom jag inte riktigt kunde förstå om kaspersky tog bort virusen eller inte...Så jag googlade lite. Då hittade jag ett tipps om Malwarebytes' Anti-Malware och laddade hem den. Körde en stor skann och hittade en massa smittade filer (98 stycken eller något). Programmet lade dem i karantän men jag bestämde mig efter att ha kollat en del på vilka filer det var att ta bort dem permanent (var filer som mywebsearch etc.). Jag märkte också att många av mina Register Keys var smittade, jag kan till exempel inte längre öppna mitt CD-uttag till datorn, då inget händer när jag trycker på knappen, vilket nog beror på det Malwarebyte säger om att HKEY_CLASSES_ROOT\regfile\shell\open\command\(def ault)- är smittad. Jag vet inte vad jag ska göra nu. Har fortfarande ingen explorer.exe och ingen bakgrund eller utforskare eller någonting. Måste använda Ctrl+Alt+Delete för att starta mina program. Hjälp!

alexanderr Registrerad 2010-10-27 Poster: 6 Från N/A
	Rapportera #2 2010-10-27 kl 20:15
	Om det skulle hjälpa såär här Malwares log efter den första virusskanningen (de andra gav inget resultat). Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Databasversion: 4964 Windows 6.1.7600 Internet Explorer 8.0.7600.16385 2010-10-27 19:17:13 mbam-log-2010-10-27 (19-17-13).txt Skanningstyp: Fullständig skanning (C $:\$ \|) Antal skannade objekt: 344699 Förfluten tid: 1 timme(ar), 25 minut(er), 49 sekund(er) Infekterade minnesprocesser: 1 Infekterade minnesmoduler: 2 Infekterade registernycklar: 26 Infekterade registervärden: 5 Infekterade registerdataposter: 2 Infekterade mappar: 12 Infekterade filer: 50 Infekterade minnesprocesser: C $:\$ Program Files (x86)\RelevantKnowledge\rlservice.exe (Adware.RelevantKnowledge) -> Unloaded process successfully. Infekterade minnesmoduler: C $:\$ Program Files (x86)\RelevantKnowledge\MSVCP71.DLL (Spyware.MarketScore) -> Delete on reboot. C $:\$ Program Files (x86)\RelevantKnowledge\MSVCR71.DLL (Spyware.MarketScore) -> Delete on reboot. Infekterade registernycklar: HKEY_CLASSES_ROOT\Interface\{3e1656ed-f60e-4597-b 6aa-b6a58e171495} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{6e74766c-4d93-4cc0-9 6d1-47b8e07ff9ca} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9 aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8 533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{de38c398-b328-4f4c-a 3ad-1b5e4ed93477} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7- 4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{1e0de227-5ce4-4ea3-ab0c- 8b03e1aa76bc} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-987 3-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{e47caee0-deea-464a-932 6-3f2801535a4d} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{f42228fb-e84e-479e-b92 2-fbbd096e792c} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-77 86eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-0 03d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d 6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-2 7e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7 a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-f f14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9 cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-77 86eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\ WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outl ook\Addins\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word \Addins\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully. Infekterade registervärden: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{00a6faf6-072e-44cf-8957- 5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\(default) (Adware.Hotbar) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3popularscreensavers (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur rentVersion\Internet Settings\User Agent\Post Platform\funwebproducts (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur rentVersion\Explorer\Associations\bak_application (Hijacker.Application) -> Quarantined and deleted successfully. Forts. följer

alexanderr Registrerad 2010-10-27 Poster: 6 Från N/A
	Rapportera #3 2010-10-27 kl 20:17
	Infekterade registerdataposter: HKEY_CLASSES_ROOT\regfile\shell\open\command\(def ault) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur rentVersion\Explorer\Associations\Application (Hijacker.Application) -> Bad: (http://www.helpmeopen.com/?n=app&ext=%s) Good: (http://shell.windows.com/fileassoc/%04x/xml/redi r.asp?Ext=%s) -> Quarantined and deleted successfully. Infekterade mappar: C $:\$ Program Files (x86)\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Avatar (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Game (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\icons (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Message (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Notifier (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\RelevantKnowledge (Spyware.MarketScore) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\RelevantKnowledge\components (Spyware.MarketScore) -> Quarantined and deleted successfully. C $:\$ ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge (Spyware.MarketScore) -> Quarantined and deleted successfully. forts. följer

alexanderr Registrerad 2010-10-27 Poster: 6 Från N/A
	Rapportera #4 2010-10-27 kl 20:17
	Infekterade filer: C $:\$ Program Files (x86)\RelevantKnowledge\rlservice.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\RelevantKnowledge\rlls.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\RelevantKnowledge\rlls64.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\RelevantKnowledge\rlph.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\RelevantKnowledge\rlxf.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\RelevantKnowledge\components\rlxg.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. C $:\$ System Volume Information\SystemRestore\FRStaging\Program Files (x86)\RelevantKnowledge\rlvknlg64.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. C $:\$ Users\Alexander\AppData\Local\Temp\CSM4450.tmp (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. C $:\$ Windows\Temp\ZWU3DCB.tmp\upgrade.exe (Adware.Dropper.Gen) -> Quarantined and deleted successfully. C $:\$ Windows\Temp\~os4B62.tmp\rlls64.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. C $:\$ Windows\Temp\~os4B62.tmp\rlph.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. C $:\$ Windows\Temp\~os4B62.tmp\rlservice.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. C $:\$ Windows\Temp\~os4B62.tmp\rlvknlg64.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. C $:\$ Windows\Temp\~os4B62.tmp\rlxf.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. C $:\$ Windows\Temp\~os4B62.tmp\rlxg.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. C $:\$ Windows\Temp\~os84AA.tmp\rlls.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. C $:\$ Windows\Temp\~os84AA.tmp\rlls64.dll (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. C $:\$ Windows\Temp\~os84AA.tmp\rlservice.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. C $:\$ Windows\Temp\~os84AA.tmp\rlvknlg64.exe (Adware.RelevantKnowledge) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Avatar\COMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Game\CHECKERS.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Game\CHESS.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Game\REVERSI.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\icons\CM.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\icons\MFC.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\icons\PSS.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\icons\SMILEY.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\icons\WB.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\icons\ZWINKY.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Message\COMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Notifier\COMMON.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Notifier\DOG.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Notifier\FISH.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Notifier\KUNGFU.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Notifier\LIFEGARD.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Notifier\MAID.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Notifier\MAILBOX.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Notifier\OPERA.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Notifier\ROBOT.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Notifier\SEDUCT.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Notifier\SURFER.F3S (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\RelevantKnowledge\install.rdf (Spyware.MarketScore) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\RelevantKnowledge\MSVCP71.DLL (Spyware.MarketScore) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\RelevantKnowledge\MSVCR71.DLL (Spyware.MarketScore) -> Quarantined and deleted successfully. C $:\$ Program Files (x86)\RelevantKnowledge\rloci.bin (Spyware.MarketScore) -> Quarantined and deleted successfully. C $:\$ ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\About RelevantKnowledge.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully. C $:\$ ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Privacy Policy and User License Agreement.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully. C $:\$ ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Support.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully. C $:\$ ProgramData\Microsoft\Windows\Start Menu\Programs\RelevantKnowledge\Uninstall Instructions.lnk (Spyware.MarketScore) -> Quarantined and deleted successfully.

alexanderr Registrerad 2010-10-27 Poster: 6 Från N/A
	Rapportera #5 2010-10-27 kl 20:18
	Sorry! alla :/ smileysar är vanliga "Kolon snestreck".

alexanderr Registrerad 2010-10-27 Poster: 6 Från N/A
	Rapportera #6 2010-10-27 kl 20:56
	Körde igenom datorn med PC Tools Registry Mechanic och hittade med den 270 fel. Kan dock inte fixa alla med gratisversionen av programmet och vågar inte använda mitt kreditkort när jag har ett möjligt kodläsarvirus på hårddisken $:\$

AntimalwareGuru Registrerad 2008-07-09 Poster: 595 Från N/A
	Rapportera #7 2010-10-30 kl 13:34
	Hjälper det inte att starta explorer.exe via aktivitetshanteren? testa starta i felsäkert läge och kör combofix där. spra filen på skrivbordet, posta logg som visas i slutet http://www.bleepingcomputer.com/combofix/se/hur-c ombofix-ska-anvandas scanna även fler ggr med malwarebytes uppdatera först.

Inte inloggad

Logga in Bli medlem

Läs mer

Senaste
Mest läst
Mest kommenterat

Programtips: Apple Safari 5.1.7 (programtips)
Programtips: Tweetdeck 1.4 (programtips)
LG:s första 4G-telefon med HD... (nyheter)
Programtips: Evernote 4.5.6 (programtips)
Programtips: Snapseed 1.1 (programtips)
HP storsatsar med 20 nya datorer (nyheter)
Stänger Microsoft ute Firefox... (nyheter)
Motorola Xoom 2 är här (artiklar)
Lenovo-datorer i miniformat (nyheter)
Dell satsar på Linux - igen (nyheter)

Kom in i diskussionen

Detta innehåll är skapat av PC Hemmas besökare

Test: HP Officejet 4500

1 kommentar

andy1n2: 695 kr är priset denna vecka i vår butik i lilla Köping

Forum

Detta innehåll är skapat av PC Hemmas medlemmar.

hittar inte andra datorer och min NAS i... (Nätverk)
Fick bra hjälp med datorproblem i Göteborg (Öppet forum)
Facebook - Hur gör man för att gå ur? (Övrigt)
Produktnyckel tll XP?? (Windows 95/98/Me/XP/Vista)
Grafikkort Sony Vaio (Grafik och ljud)
Skulle någon hjälpa mig bygga en gaming pc? (Datorer)
Irriterande!!!! Hjälp! (Datorer)
Registret (Öppet forum)
Trådlöst med Telia (Nätverk)
Datorn strular (Datorer)

Tester

Senaste
Mest läst
Mest kommenterat

Test: Intel Core i7-3770K
2012-04-24 20:54
Test: Samsung Galaxy SII LTE I9210
2012-04-23 18:47
Test: Western digital My Book Live duo
2012-04-19 09:36
Test: Compulab Fit-PC3-PRO W7
2012-04-18 13:26
Test: LaCie 5 Big Network V2
2012-04-12 14:46

Artikelkommentarer

Test: HP Officejet 4500
2012-05-11 10:15 Tester 1 kommentarer
Installera en webbkamera
2012-04-30 19:04 Guider 5 kommentarer
Pixma iP4950 - ny fotoskrivare från Canon
2012-04-25 21:03 Nyheter 2 kommentarer
Test: Asus P8Z68-V LX
2012-04-13 13:41 Tester 3 kommentarer
Sony avråder från Android 4
2012-04-07 11:23 Nyheter 9 kommentarer
Test: Apple Ipad
2012-04-06 21:32 Tester 4 kommentarer

© Egmont Tidskrifter