---
title: "Infostealer, hjälp med hijackthis logg..."
type: "forum-thread"
url: "https://www.webforum.nu/amne/datasakerhet/178650-infostealer-hjälp-med-hijackthis-logg"
topic: "Datasäkerhet"
topic_url: "https://www.webforum.nu/amne/datasakerhet"
author: "hannuman"
published: "2009-05-22T17:06:00.000Z"
updated: "2009-05-23T19:51:17.000Z"
replies: 2
views: 637
page: 1
pages: 1
language: "sv-SE"
site: "webForum — webforum.nu"
rights: "Upphovsrätten till varje inlägg tillhör dess författare."
attribution: "Citera som: webForum, https://www.webforum.nu/amne/datasakerhet/178650-infostealer-hjälp-med-hijackthis-logg"
---

# Infostealer, hjälp med hijackthis logg...

## #1 — hannuman, 2009-05-22T17:06Z

Har fått ett par trojaner och läskiga infostealer. Tipsades om hijackthis och hoppas nu att någon kan hjälpa mig med loggen samt om ni hittar övrigt trams som inte behövs:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:04:28, on 2009-05-22
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\\WINDOWS\\System32\\smss.exe
C:\\WINDOWS\\system32\\winlogon.exe
C:\\WINDOWS\\system32\\services.exe
C:\\WINDOWS\\system32\\lsass.exe
C:\\WINDOWS\\system32\\svchost.exe
C:\\WINDOWS\\System32\\svchost.exe
C:\\WINDOWS\\Explorer.EXE
C:\\Program\\Delade filer\\Symantec Shared\\ccSetMgr.exe
C:\\Program\\Delade filer\\Symantec Shared\\ccEvtMgr.exe
C:\\Program\\Delade filer\\Symantec Shared\\SNDSrvc.exe
C:\\Program\\Delade filer\\Symantec Shared\\SPBBC\\SPBBCSvc.exe
C:\\Program\\Delade filer\\Symantec Shared\\CCPD-LC\\symlcsvc.exe
C:\\WINDOWS\\system32\\spoolsv.exe
C:\\Program\\Juniper Networks\\Common Files\\dsNcService.exe
C:\\Program\\Delade filer\\GtFlashSwitch\\GtFlashSwitch.exe
C:\\Program\\Java\\jre6\\bin\\jqs.exe
C:\\Program\\Delade filer\\LightScribe\\LSSrvc.exe
C:\\Program\\Norton AntiVirus\\navapsvc.exe
C:\\Program\\Norton AntiVirus\\IWP\\NPFMntor.exe
C:\\Program\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe
C:\\Program\\hpq\\HP Wireless Assistant\\HP Wireless Assistant.exe
C:\\Program\\Delade filer\\Symantec Shared\\ccApp.exe
C:\\Program\\Java\\jre6\\bin\\jusched.exe
C:\\WINDOWS\\system32\\ctfmon.exe
C:\\Program\\SUPERAntiSpyware\\SUPERAntiSpyware.exe
C:\\Program\\HPQ\\SHARED\\HPQWMI.exe
C:\\WINDOWS\\System32\\svchost.exe
C:\\Program\\Delade filer\\Symantec Shared\\Security Console\\NSCSRVCE.EXE
C:\\Program\\Mozilla Firefox\\firefox.exe
C:\\Program\\Trend Micro\\HijackThis\\Rensa.exe

R0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Main,Start Page = <http://www.hp.com/>
R1 - HKLM\\Software\\Microsoft\\Internet Explorer\\Main,Default_Page_URL = <http://www.hp.com>
R0 - HKLM\\Software\\Microsoft\\Internet Explorer\\Search,SearchAssistant = 
R1 - HKCU\\Software\\Microsoft\\Internet Connection Wizard,ShellNext = <http://www.hp.com/>
R0 - HKCU\\Software\\Microsoft\\Internet Explorer\\Toolbar,LinksFolderName = Länkar
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\\Program\\Adobe\\Acrobat 7.0\\ActiveX\\AcroIEHelper.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\\Program\\Norton AntiVirus\\NavShExt.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\\Program\\Java\\jre6\\bin\\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\\Program\\Java\\jre6\\lib\\deploy\\jqs\\ie\\jqs_plugin.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\\Program\\Norton AntiVirus\\NavShExt.dll
O4 - HKLM\\..\\Run: \[ATIPTA\] "C:\\Program\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
O4 - HKLM\\..\\Run: \[hpWirelessAssistant\] C:\\Program\\hpq\\HP Wireless Assistant\\HP Wireless Assistant.exe
O4 - HKLM\\..\\Run: \[LSBWatcher\] c:\\hp\\drivers\\hplsbwatcher\\lsburnwatcher.exe
O4 - HKLM\\..\\Run: \[Cpqset\] C:\\Program\\HPQ\\Default Settings\\cpqset.exe
O4 - HKLM\\..\\Run: \[QuickTime Task\] "C:\\Program\\QuickTime\\qttask.exe" -atboottime
O4 - HKLM\\..\\Run: \[ccApp\] "C:\\Program\\Delade filer\\Symantec Shared\\ccApp.exe"
O4 - HKLM\\..\\Run: \[SunJavaUpdateSched\] "C:\\Program\\Java\\jre6\\bin\\jusched.exe"
O4 - HKLM\\..\\Run: \[Net iD\] "C:\\Program\\Net iD\\iid.exe"
O4 - HKCU\\..\\Run: \[CTFMON.EXE\] C:\\WINDOWS\\system32\\ctfmon.exe
O4 - HKCU\\..\\Run: \[updateMgr\] "C:\\Program\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\\..\\Run: \[SUPERAntiSpyware\] C:\\Program\\SUPERAntiSpyware\\SUPERAntiSpyware.exe
O4 - HKUS\\S-1-5-19\\..\\Run: \[CTFMON.EXE\] C:\\WINDOWS\\system32\\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\\S-1-5-20\\..\\Run: \[CTFMON.EXE\] C:\\WINDOWS\\system32\\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\\S-1-5-18\\..\\Run: \[CTFMON.EXE\] C:\\WINDOWS\\system32\\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\\.DEFAULT\\..\\Run: \[CTFMON.EXE\] C:\\WINDOWS\\system32\\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\\Program\\MICROS\~2\\OFFICE11\\EXCEL.EXE/3000
O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\\Program\\MICROS\~2\\OFFICE11\\REFIEBAR.DLL
O9 - Extra button: bet365 Poker - {B1BA4A3F-1C95-497b-9F82-F8DA4A5C89DD} - C:\\Microgaming\\Poker\\bet365MPP\\MPPoker.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\\Poker\\Partypoker\\PartyPoker\\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\\Poker\\Partypoker\\PartyPoker\\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program\\Messenger\\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\\Program\\Messenger\\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O15 - Trusted Zone: <http://www.film2home.se>
O20 - Winlogon Notify: !SASWinLogon - C:\\Program\\SUPERAntiSpyware\\SASWINLO.dll
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\\Program\\Delade filer\\Symantec Shared\\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\\Program\\Delade filer\\Symantec Shared\\ccSetMgr.exe
O23 - Service: Juniper Network Connect Service (dsNcService) - Juniper Networks - C:\\Program\\Juniper Networks\\Common Files\\dsNcService.exe
O23 - Service: GtFlashSwitch - OptionNV - C:\\Program\\Delade filer\\GtFlashSwitch\\GtFlashSwitch.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\\Program\\HPQ\\SHARED\\HPQWMI.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\\Program\\Java\\jre6\\bin\\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\\Program\\Delade filer\\LightScribe\\LSSrvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\\Program\\Norton AntiVirus\\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\\Program\\Norton AntiVirus\\IWP\\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\\Program\\Delade filer\\Symantec Shared\\Security Console\\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\\Program\\Norton AntiVirus\\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\\Program\\Delade filer\\Symantec Shared\\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\\Program\\Delade filer\\Symantec Shared\\SPBBC\\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\\Program\\Delade filer\\Symantec Shared\\CCPD-LC\\symlcsvc.exe

\--
End of file - 7019 bytes

Permalänk: https://www.webforum.nu/p/178650

## #2 — LoLo, 2009-05-22T23:26Z

Jupp, lsass.exe, är en trojan, en såkallad downloader, som laddar ner andra små trevliga malware/spyware etc.. Men! Gör inget, lsass.exe kan också vara en viktig *Windows Process*. Mer om den lilla luringen här: <http://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service>
<http://www.liutilities.com/products/wintaskspro/processlibrary/lsass/>
Då jag inte vågar pilla i andras loggar rådes du posta din logg på ett annat forum, som många andra på wF gjort! 
Here:

<http://www.geekstogo.com/forum/Malware-Spyware-Cleaning-Guide-t2852.html>

Permalänk: https://www.webforum.nu/p/2185559

## #3 — hannuman, 2009-05-23T19:51Z

Tusen tack, jag provar lyckan i ett annat forum:)

Permalänk: https://www.webforum.nu/p/2185611

---

Tråden på webben: https://www.webforum.nu/amne/datasakerhet/178650-infostealer-hjälp-med-hijackthis-logg