infisert med politiet crime unit virus

[glen]

hei

Jeg er smittet med dette viruset (politiet crime unit...) har bærbar PC startet opp i sikkermodus og restaurere punkt gjort og kan nå rygg arbeider. Nylig hadde jeg skjermen tilbake igjen, har gjort så tilbake restaurere punkt, men jeg tror viruset ikke er der ennå. Hvis jeg finner han har ingenting å gjøre med skanner en mcafee full.
Til dette jeg har skanning gjort med hijackthis, og dette er en logg. Forhåpentligvis noen kan meg.

Logfile av Trend Micro HijackThis v2.0.4
Scan lagret på 19: 55: 25, på 24/09/2012
Plattform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v 8.00 (8.00.6001.19088)
Boot modus: normalt

Running prosesser:
C:/Windows/System32/DWM.exe
Exe C:/Windows/system32/taskeng
C:/Windows/Explorer. EXE
C:/Program filer/Windows Defender / exe MSASCui.
C:/Program filer/ATI Technologies/ATI.ESS/kjerne-statisk/mor exe
C:/Program filer/CyberLink/PowerDVD/exe PDVDServ.
C:/Program filer/felles filer/Java/Java Update/jusched.exe
C:/Program Files/McAfee.com/Agent/mcagent.exe
C:/Program filer/Microsoft Office/Office12/groovemonitor.exe
C:/Program filer/felles Files/Adobe/ARM/1.0/AdobeARM. exe
C:/Program filer/iTunes/iTunesHelper exe
C:/Program filer/Windows Sidepanel/sidebar exe
C:/Program filer/TOSHIBA/TOSCDSPD/TOSCDSPD exe
C:/Program filer/Windows Live/Messenger/Msnmsgr.exe
C:/Program filer/felles filer/Apple/Internett tjenester/ubd exe
C:/Program filer/Skype/telefon/Skype. exe
C:/Program filer/Toshiba/Toshiba Bluetooth-stakken / exe TosBtMng.
C:/Program Files/OpenOffice.org 3/program/soffice exe
C:/Program Files/OpenOffice.org 3/program/soffice bin
C:/Program filer/Toshiba/Toshiba Bluetooth-stakken / exe TosA2dp.
C:/Program filer/Toshiba/Toshiba Bluetooth-stakken / exe TosBtHid.
C:/Program filer/felles filer/Apple/Apple Application Support/distnoted exe
C:/Program filer/Toshiba/Toshiba Bluetooth-stakken / exe TosBtHsp.
C:/Program filer/ATI Technologies/ATI.ESS/kjerne-statisk/CCC exe
C:/Program filer/Windows Live/kontakter/exe wlcomm.
C:/Program filer/Toshiba/Toshiba Bluetooth-stakken / exe TosAVRC.
C:/Windows/System32/wuauclt.exe
C:/Program filer/Toshiba/Toshiba Bluetooth-stakken / exe tosOBEX.
C:/Program filer/TOSHIBA/Toshiba Bluetooth-stakken / exe TosBtProc.
C:/Program filer/Internett Explorer/Iexplore.exe
C:/Program filer/Internett Explorer/Iexplore.exe
C:/Program filer/Internett Explorer/Iexplore.exe
C:/brukernes/bruker/AppData/lokal/Temp/midlertidige Internett-filer/innhold. IE5/W83Y5ROW/HijackThis [1] exe

R1-HKCU/programvare/Microsoft/Internett Explorer/Main, søkeside = Bing
R0-HKCU/programvare/Microsoft/Internett Explorer/Main, startsiden = Google
R1-HKLM/programvare/Microsoft/Internett Explorer/Main, Default_Page_URL = MSN Hotmail. fr, Messenger, Skype, Actualité, Sport, folk, Femmes-MSN-Frankrike
R1-HKLM/programvare/Microsoft/Internett Explorer/Main, Default_Search_URL = Bing
R1-HKLM/programvare/Microsoft/Internett Explorer/Main søkeside = Bing
R0-HKLM/programvare/Microsoft/Internett Explorer/Main, startsiden = MSN Hotmail. fr, Messenger, Skype, Actualité, Sport, folk, Femmes-MSN-Frankrike
R0-HKLM/programvare/Microsoft/Internett Explorer/søk, SearchAssistant =
R0-HKLM/programvare/Microsoft/Internett Explorer/søk, CustomizeSearch =
R1-HKCU/programvare/Microsoft/Windows/CurrentVersion/Int Ethernet-porter innstillinger, ProxyOverride = * .local
R0-HKCU/programvare/Microsoft/Internet Explorer/Toolbar, LinksFolderName =
R3-URLSearchHook: McAfee SiteAdvisor Toolbar-{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064}-c:/PROGRA ~ 1/mcafee/SITEAD ~ 1/mcieplg-dll
O1-verter::: 1 localhost
O2-BHO: AcroIEHelperStub-{18DF081C-E8AD-4283-A596-FA578C2EBDC3}-C:/Program filer/felles filer/Adobe/Acrobat/ActiveX DLL /-AcroIEHelperShim.
O2-BHO: Babylon verktøylinjen helper-{2EECD738-5844-4a99-B4B6-146BF802613B}-(no fil)
O2-BHO: (ingen name)-{5C255C8A-E604-49b4-9D64-90988571CECB}-(no fil)
O2-BHO: Groove GFS nettleser Helper-{72853161-30C5-4D22-B7F9-0BBC1D38A37E}-C:/Program filer/Microsoft Office/kontor/GrooveShellExtensions. dll
O2-BHO: Windows Live signere up-Help-{9030D464-4C02-4ABF-8ECC-5164760863C6}-C:/Program filer/felles filer/Microsoft delt/Windows Live / dll WindowsLiveLogin.
O2-BHO: SkypeIEPluginBHO-{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}-C:/Program filer/Skype/verktøylinjer/Internet Explorer / dll skypeieplugin.
O2-BHO: McAfee SiteAdvisor BHO-{B164E929-A1B6-4A06-B104-2CD0E90A88FF}-c:/PROGRA ~ 1/mcafee/SITEAD ~ 1/mcieplg-dll
O2-BHO: Java plug-in 2 SSV Helper-{DBC80044-A445-435b-BC74-9C25C1C588A9}-C:/Program filer/Java/jre6/bin/jp2ssv dll
O2-BHO: Windows Live Toolbar Helper-{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}-C:/Program filer/Windows Live/Toolbar/dll wltcore.
O3-verktøylinjen: McAfee SiteAdvisor Toolbar-{0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064}-c:/PROGRA ~ 1/mcafee/SITEAD ~ 1/mcieplg-dll
O3-verktøylinjen: & Windows Live Toolbar-{21FA44EF-376D-4D53-9B0F-8A89D3229068}-C:/Program filer/Windows Live/verktøylinjen/dll wltcore.
O3-verktøylinjen: (ingen name)-{D0F4A166-B8D4-48b8-9D63-80849FE137CB}-(no fil)
O4-HKLM /.../ Run: [Windows Defender] / Windows Defender % ProgramFiles%/MSASCui exe-Skjul
O4-HKLM /.../ Run: [StartCCC] c:/Program Files / "/ ATI Technologies ATI.ACE/kjerne-statisk / CLIStart. exe "MSRun
O4-HKLM /.../ Run: [ITSecMng] % Toshiba-stakken for ProgramFiles%/TOSHIBA/Bluetooth / ItSecMng. exe/start
O4-HKLM /.../ Run: [RemoteControl] "c:/Program filer/CyberLink/PowerDVD/exe PDVDServ."
O4-HKLM /.../ Run: [LanguageShortcut] "c:/Program Files/CyberLink/PowerDVD/språk/språk exe"
O4-HKLM /.../ Run: [SunJavaUpdateSched] "c:/Program Files/felles filer/Java/Java-Update/jusched.exe"
O4-HKLM /.../ Run: [mcui_exe] "c:/Program Files/McAfee.com/Agent/mcagent.exe"/runkey
O4-HKLM /.../ Run: [AppleSyncNotifier] C:/Program filer/felles filer/Apple/mobil enhet støtte/AppleSyncNotifier exe
O4-HKLM /.../ Run: [APSDaemon] "c:/Program Files/felles filer/Apple/Apple-programmet støtter / exe APSDaemon."
O4-HKLM /.../ Run: [Groovemonitor] "c:/Program filer/Microsoft Office/kontor groovemonitor.exe/"
O4-HKLM /.../ Run: [Adobe Leseren Fart Launcher] "c:/Program Files/Adobe/Reader 9.0/Reader/Reader_sl. exe"
O4-HKLM /.../ Run: [Adobe ARM] "c:/Program Files/felles exe Files/Adobe/ARM/1.0/AdobeARM."
O4-HKLM /.../ Run: [ITunesHelper] "c:/Program filer/iTunes/iTunesHelper exe"
O4-HKLM /.../ Run: [QuickTime oppgave] "c:/Program filer/QuickTime/exe QTTask."-atboottime
O4-HKLM /.../ Run: [Sidebar] C:/Program filer/Windows Sidepanel / sidepanelet. exe/Autorun
O4-HKLM /.../ Run: [TOSCDSPD] C:/Program filer/TOSHIBA/TOSCDSPD/toscdspd exe
O4-HKLM /.../ Run: [msnmsgr] "c:/Program Files/Windows Live/Messenger/Msnmsgr.exe" / bakgrunn
O4-HKLM /.../ Run: [MobileDocuments] c:/Program Files/felles filer/Apple/Internet Services/ubd exe
O4-HKLM /.../ Run: [Skype] "c:/Program filer/Skype/telefon/Skype. exe" / minimert/regrun
O4-oppstart: ctfmon. lnk = C:/Windows/System32/Rundll32.exe
O4-oppstart: OpenOffice.org 3.2. lnk = C:/Program Files/OpenOffice.org 3/program/quickstart exe
O4-Global oppstart: Ink = Bluetooth Manager?
O8-Ekstra sammenheng menyelement: Legg til Google bilder Screensa & ver-res://C:/Windows/system32/GPhotos.scr/200
O8-Ekstra sammenheng menyelement: E & xporteren til Microsoft Excel-res: / / C:/PROGRA ~ 1/MIKROER ~ 2/kontor/EXCEL.EXE/3000
O9-ekstra knappen: send til OneNote-{2670000A-7350-4f3c-8081-5663EE0C6C49}-c:/PROGRA ~ 1 MIKROER ~ 2 Office12/ONBttnIE.//dll
O9-ekstra 'Verktøy'-MenuItem: {2670000A-7350-4f3c-8081-5663EE0C6C49}-Verz & enden til OneNote-c:/PROGRA ~ 1 MIKROER ~ 2 Office12/ONBttnIE.//dll
O9-ekstra knappen: Skype-{898EA8C8-E7FF-479B-8935-AEC46303B9E5}-Click å ringe C:/Program filer/Skype/verktøylinjer/Internet Explorer / dll skypeieplugin.
O9-ekstra 'Verktøy'-MenuItem: Skype-Klikk for å Call-{898EA8C8-E7FF-479B-8935-AEC46303B9E5}-C:/Program filer/Skype/verktøylinjer/Internet Explorer / dll skypeieplugin.
O9-ekstra knappen: Research-{92780B25-18CC-41C8-B9BE-3C9C571A8263}-c:/PROGRA ~ 1 MIKROER ~ 2 kontor REFIEBAR.///DLL
O16-DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} (JordanUploader Class)- http://Foto.Hema.be/IPS-opdata/Layou...CTS/Jordan.cab
O16-DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object)- https://fpdownload.Macromedia.com/GE...sh/swflash.cab
O16-DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7}- http://platformdl.Adobe.com/NOS/getPlusPlus/1.6/GP.cab
O18-protokoll: dssrequest-{5513F07E-936B-4E52-9B00-067394E91CC5}-c:/PROGRA ~ 1/mcafee/SITEAD ~ 1/mcieplg-dll
O18-protokoll: grooveLocalGWS-{88FED34C-F0CA-4636-A375-3CB6248B04CD}-C:/Program filer/Microsoft Office/kontor/dll GrooveSystemServices.-
O18-protokoll: sacore-{5513F07E-936B-4E52-9B00-067394E91CC5}-c:/PROGRA ~ 1/mcafee/SITEAD ~ 1/mcieplg-dll
O18-protokoll: skype-ie-addon-data-{91774881-D725-4E58-B298-07617B9B86A8}-C:/Program filer/Skype/verktøylinjer/Internet Explorer / dll skypeieplugin.
O18-protokoll: skype4com-{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D}-c:/PROGRA ~ 1 felles ~ 1 Skype SKYPE4 ~ / / / 1. DLL
O18-Filter: application/x-mfe-ipt-{3EF5086B-5478-4598-A054-786C45D75692}-c:/progra ~ 1/mcafee/msc/dll mcsniepl.
Ø20-AppInit_DLLs: c:/progra ~ 2 ~ 1/bla/22643 ~ 1,41 / {16cdf ~ 1 ~ 1/bla. DLL
O22-SharedTaskScheduler: Komponentkategorier buffer daemon-{8C7461EF-2B13-11d2-BE35-3078302C2030}-C:/Windows/system32/Browseui.dll
O23-Service: McAfee Application Installer Cleanup (0219061348494335) (0219061348494335mcinstcleanup)-Ukjent eier-C:/Windows/TEMP/021906 ~ 1. EXE (fil mangler)
O23-Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc)-Adobe Systems Incorporated-C:/Windows/system32/Macromed/Flash/FlashPlayerUpda teService exe
O23-Service: Apple Mobile Device-Apple Inc.-c:/Program filer/felles filer/Apple/mobil enhet Support/applemobiledeviceservice.exe
O23-Service: Ati ekstern hendelse Utility-ATI Technologies Inc.-C:/Windows/system32/Ati2evxx exe
O23-Service: Bonjour service (Bonjour Service) - Apple Inc. - c:/Program Files/Bonjour/mDNSResponder.exe
O23-Service: Nettleser Manager-Ukjent eier-c:/ProgramData/nettleser Manager/2.2.643.41/{16cdff19-861d-48e3-a751-d99a27784753}/browsemngr. exe
O23-Service: Google Update-tjenesten (gupdate) (gupdate)-Google Inc.-c:/Program Files/Google/Update/googleupdate.exe
O23-Service: Google Update-tjenesten (gupdatem) (gupdatem)-Google Inc.-c:/Program Files/Google/Update/googleupdate.exe
O23-Service: Google Updater tjenesten (gusvc)-Google-c:/Program Files/Google/felles/Google Updater / exe GoogleUpdaterService.
O23-Service: iPod-tjenesten (iPod Service)-Apple Inc.-c:/Program filer/iPod/bin/iPodService exe
O23-Service: McAfee SiteAdvisor Service-McAfee, Inc.-c:/Program filer/felles filer/Mcafee/McSvcHost/exe McSvHost.
O23-Service: McAfee Personal Firewall-tjenesten (McMPFSvc) - McAfee, Inc. - c:/Program filer/felles filer/Mcafee/McSvcHost/exe McSvHost.
O23-Service: McAfee tjenester (mcmscsvc) - McAfee, Inc. - c:/Program filer/felles filer/Mcafee/McSvcHost/exe McSvHost.
O23-Service: McAfee VirusScan hallomann (McNaiAnn) - McAfee, Inc. - c:/Program filer/felles filer/Mcafee/McSvcHost/exe McSvHost.
O23-Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:/Program filer/felles filer/Mcafee/McSvcHost/exe McSvHost.
O23-Service: McAfee skanner (McODS)-McAfee, Inc.-c:/Program filer/McAfee/VirusScan/mcods exe
O23-Service: McAfee Proxy-tjeneste (McProxy) - McAfee, Inc. - c:/Program filer/felles filer/Mcafee/McSvcHost/exe McSvHost.
O23-Service: McAfee McShield (McShield) - McAfee, Inc. - c:/Program filer/felles filer/McAfee/SystemCore / / mcshield exe
O23-Service: McAfee Firewall Core-tjenesten (mfefire) - McAfee, Inc. - c:/Program filer/felles filer/McAfee/SystemCore / / mfefire exe
O23-Service: McAfee validering stoler sikringen Service (mfevtp) - McAfee, Inc. - c:/Program filer/felles filer/McAfee/SystemCore/exe mfevtps.
O23-Service: 1% (MOBKbackup) - McAfee, Inc. - c:/Program filer/McAfee Online Backup / exe MOBKbackup.
O23-Service: McAfee anti-spam-tjenesten (MSK80Service) - McAfee, Inc. - c:/Program filer/felles filer/Mcafee/McSvcHost/exe McSvHost.
O23-Service: Nero BackItUp Scheduler 4.0-Nero AG-c:/Program filer/felles filer/Nero/Nero Oppbakking 4/NBService exe
O23-Service: O2Micro Flash minne kort tjeneste (o2flash)-O2Micro International-c:/Program Files/O2Micro Flash Memory Card sjåfør / exe o2flash.
O23-Service: CyberLink RichVideo Service (CRVS) (RichVideo)-Ukjent eier-C:/Program Files/Cyberlink/delt filer/RichVideo exe
O23-Service: Skype Updater (Skype oppdatering)-Skype teknologier-c:/Program filer/Skype/Updater/Updater exe
O23-Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - c:/Program filer/TOSHIBA/TOSHIBA DVD spilleren / exe TNaviSrv.
O23-Service: TOSHIBA Bluetooth Service-TOSHIBA CORPORATION-c:/Program filer/Toshiba/Toshiba Bluetooth-stakken / exe TosBtSrv.
O23-Service: XAudioService-Conexant systemer, Inc.-C:/Windows/system32/DRIVERS/xaudio exe

--
Slutten av filen 12571 byte

[Stefan]

Hei Glen,
skanne med MalwareBytes AntiMalware, dette finne de fleste varianter av dette viruset. Før du går å gjøre en oppdatering med MBAM scan først.
Jeg skulle gjerne høre fra deg om det var vellykket.

[glen]

Hei stefan

Takk for din kommentar, har nå skanne med MBAM og fant dette: trojan.ransom.gen, er plassert i karantene, normalt ville ha fjernet dette nå enn?
Eller gjøre jeg fjerne den fra karantene her også?

grtz

Malwarebytes Anti-Malware 1.65.0.1400
Malwarebytes anti-malware nedlasting: gratis

Databaseversjon: v 2012.09.25.04

Windows Vista Service Pack 1 x 86 NTFS
Internet Explorer 8.0.6001.19088
bruker:: GLEN [administrator]

25/09/2012 8: 29: 02
mbam-Logg-2012-09-25 (08-29-02) txt

Skanne type: hastig avsøke
Aktivert skannealternativer: minne | Oppstartselementene | Register | Filer og mapper | Heuristikk ekstra | Heuristikk/Shuriken | DUKKE | PUM
Deaktivert søkealternativer: P2P
Objekter som er skannet: 200226
Spilletid: 8 minutter/minutter, 27 sekund (s)

Minneprosesser oppdaget: 0
(Ingen skadelige elementer funnet)

Minnemoduler oppdaget: 0
(Ingen skadelige elementer funnet)

Registernøkler som er oppdaget: 0
(Ingen skadelige elementer funnet)

Registerverdiene oppdaget: 0
(Ingen skadelige elementer funnet)

Registerdata oppdaget: 0
(Ingen skadelige elementer funnet)

Mapper oppdaget: 0
(Ingen skadelige elementer funnet)

Filer som oppdages: 1
C:/brukernes/bruker/AppData/Roaming/Microsoft/Windows/St kunst meny/programmer/oppstart/ctfmon Ink (Trojan.Ransom.Gen)-> karantene og slettet.

(slutten)

[Stefan]

Trojan.Ransom.gen er faktisk viruset, så hva han har funnet. Eller også helt fjernet vi kan gjøre med combofix.
Vær oppmerksom på at først lese like godt hvordan du bruke combofix.

[Stefan]

Løst, derfor lukket.