Windows uppdateringar fungerar inte

3 sidor
1
2
3
→

Du kan inte starta en ny tråd
Du kan inte svara i tråden

#1
attigrib

Användare

Grupp: Medlemmar
Inlägg: 56
Gick med: 2009-11-10

Skrivet 02 okt 2011, 12:44

Behöver hjälp att lösa ett problem med windows uppdateringarna. Det går inte att installera viktiga uppdateringar längre. Felkod 646 anges. jag har gått till hjälpen och försökt med att åtgärda problemet automatiskt (Fix It) och jag har också försökt att åtgärda problemet manuellt efter beskrivningen att kolla registernycklarna. Registren är ok och ser ut som de ska enligt beskrivningen i Windows hjälp. Datorn är otroligt seg och långsam och jag misstänker att jag har fått in något spionprogram eller annat som inta ska vara där. Tacksam för hjälp.

#2
Cecilia

Beroende

Grupp: Huvudmoderator
Inlägg: 76 578
Gick med: 2003-05-06
Ort:Stockholm

Skrivet 02 okt 2011, 16:43

Förutom skadliga program kan en dålig hårddisk ge upphov till att allt som rör hårddisken går mycket långsamt och det brukar upplevas som en seg dator. Det är därför viktigt att du har säkerhetskopior på alla viktiga filer eftersom det är möjligt att Windows kommer att vägra fungera.

Följ anvisningarna i tråden Till dig med virus eller andra skadliga program i datorn så gott det går.

#3
attigrib

Användare

Grupp: Medlemmar
Inlägg: 56
Gick med: 2009-11-10

Skrivet 02 okt 2011, 18:37

Har försökt att ladda ner filen dds, men det verkar vara något fel på länken... Har gåt direkt till deras sida
http://www.bleepingc.../anti-virus/dds
men filen laddas inte ner... Finns det någon annan väg att gå?

#4
Mats H

Mats H

Grupp: Medlemmar
Inlägg: 3 852
Gick med: 2010-03-13

Skrivet 02 okt 2011, 20:28

Hej,
kanske du ska ta och prova i Felsäkert Läge med nätverk. Starta om datorn och under uppstarten tryck på F8 upprepade gånger, välj sedan Felsäkert Läge med nätverk. I annat fall kan du ju prova med att använda eller ladda ned Malwarebytes här:
Malwarebytes' Anti-Malware
kör en snabbskanner och klistra in loggen här i din tråd. Loggen finns att hitta under fliken Loggar om den inte öppnas automatiskt-
Mvh
Mats H

#5
Cecilia

Beroende

Grupp: Huvudmoderator
Inlägg: 76 578
Gick med: 2003-05-06
Ort:Stockholm

Skrivet 02 okt 2011, 21:46

Ett alternativ till DDS är OTL. Spara OTL på Skrivbordet.
http://oldtimer.geekstogo.com/OTL.exe
Stäng alla program.
Kör OTL.

Under Output högt upp så välj Minimal Output.
Bocka för LOP Check och Purity Check.
Tryck på Run Scan och låt programmet köra ostört.

När det är klart så skapas två loggfiler på Skrivbordet, OTL.txt och Extras.txt. I ditt svar klistrar du in loggen OTL.txt. Medan du bifogar Extras.txt som en fil.

#6
attigrib

Användare

Grupp: Medlemmar
Inlägg: 56
Gick med: 2009-11-10

Skrivet 03 okt 2011, 18:12

Här kommer resultatet av skanningen med OTL:

OTL logfile created on: 2011-10-03 12:07:50 - Run 1
OTL by OldTimer - Version 3.2.29.1 Folder = C:\Users\Birgitta\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 0000041D | Country: Sverige | Language: SVE | Date Format: yyyy-MM-dd

1,87 Gb Total Physical Memory | 1,18 Gb Available Physical Memory | 62,77% Memory free
3,99 Gb Paging File | 2,62 Gb Available in Paging File | 65,74% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 284,41 Gb Total Space | 152,91 Gb Free Space | 53,76% Space Free | Partition Type: NTFS
Drive D: | 13,68 Gb Total Space | 1,91 Gb Free Space | 13,95% Space Free | Partition Type: NTFS
Drive K: | 465,64 Gb Total Space | 319,55 Gb Free Space | 68,63% Space Free | Partition Type: FAT32

Computer Name: LARSSONSDATOR | User Name: Birgitta | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Birgitta\Downloads\OTL.exe (OldTimer Tools)
PRC - c:\Program\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
PRC - C:\Program\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Program\IObit\Advanced SystemCare 4\PMonitor.exe (IObit)
PRC - C:\Program\IObit\Advanced SystemCare 4\ASCService.exe (IObit)
PRC - C:\Program\Secunia\PSI\sua.exe (Secunia)
PRC - C:\Program\Secunia\PSI\psia.exe (Secunia)
PRC - C:\Users\Birgitta\Forefront UAG Remote Access Agent\portalthomascookse\tcneportal1\uagqecsvc.exe (Microsoft Â® Corporation)
PRC - C:\Program\Emsisoft Anti-Malware\a2service.exe (Emsi Software GmbH)
PRC - C:\Program\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
PRC - C:\Program\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corp.)
PRC - C:\Program\Telia\Supportassistenten\bin\tgsrvc.exe (SupportSoft, Inc.)
PRC - C:\Program\Telia\Supportassistenten\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\Program\Norton Internet Security\Engine\17.8.0.5\ccsvchst.exe (Symantec Corporation)
PRC - C:\Program\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program\Microsoft Office\Office12\GrooveMonitor.exe (Microsoft Corporation)
PRC - C:\Program\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Program\Windows Media Player\wmpnscfg.exe (Microsoft Corporation)
PRC - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE (SEIKO EPSON CORPORATION)
PRC - C:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
PRC - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE (SEIKO EPSON CORPORATION)
PRC - C:\Windows\V0220Mon.exe (Creative Technology Ltd.)

========== Modules (No Company Name) ==========

MOD - C:\Program\IObit\Advanced SystemCare 4\ASCv4ExtMenu.dll ()
MOD - C:\Program\IObit\Advanced SystemCare 4\madexcept_.bpl ()
MOD - C:\Program\IObit\Advanced SystemCare 4\madbasic_.bpl ()
MOD - C:\Program\IObit\Advanced SystemCare 4\maddisAsm_.bpl ()
MOD - C:\Program\IZArc\IZArcCM.dll ()
MOD - C:\Program\Common Files\Apple\Apple Application Support\zlib1.dll ()

========== Win32 Services (SafeList) ==========

SRV - (McAfee SiteAdvisor Service) -- c:\Program\McAfee\SiteAdvisor\McSACore.exe (McAfee, Inc.)
SRV - (AdobeARMservice) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (AdvancedSystemCareService) -- C:\Program\IObit\Advanced SystemCare 4\ASCService.exe (IObit)
SRV - (Secunia Update Agent) -- C:\Program Files\Secunia\PSI\sua.exe (Secunia)
SRV - (Secunia PSI Agent) -- C:\Program Files\Secunia\PSI\PSIA.exe (Secunia)
SRV - (uagqecsvc) -- C:\Users\Birgitta\Forefront UAG Remote Access Agent\portalthomascookse\tcneportal1\uagqecsvc.exe (Microsoft Â® Corporation)
SRV - (a2AntiMalware) -- C:\Program Files\Emsisoft Anti-Malware\a2service.exe (Emsi Software GmbH)
SRV - (tgsrvc_teliada) SupportSoft Repair Service (teliada) -- C:\Program Files\Telia\Supportassistenten\bin\tgsrvc.exe (SupportSoft, Inc.)
SRV - (sprtsvc_teliada) SupportSoft Sprocket Service (teliada) -- C:\Program Files\Telia\Supportassistenten\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (AutoStore) -- C:\Program Files\Storegate\Autostore\AutoStoreSvc.exe (Storegate AB)
SRV - (NIS) -- C:\Program Files\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe (Symantec Corporation)
SRV - (ServiceLayer) -- C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (SBSDWSCService) -- C:\Program\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (SupportSoft RemoteAssist) -- C:\Program\Common Files\supportsoft\bin\ssrc.exe (SupportSoft, Inc.)
SRV - (ezSharedSvc) -- C:\Windows\System32\ezsvc7.dll (EasyBits Sofware AS)
SRV - (WinDefend) -- C:\Program\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (EPSON_EB_RPCV4_01) EPSON V5 Service4(01) -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40ST7.EXE (SEIKO EPSON CORPORATION)
SRV - (EPSON_PM_RPCV4_01) EPSON V3 Service4(01) -- C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE (SEIKO EPSON CORPORATION)

========== Driver Services (SafeList) ==========

DRV - (BHDrvx86) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\BASHDefs\20110920.001\BHDrvx86.sys (Symantec Corporation)
DRV - (IDSVix86) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\IPSDefs\20110930.030\IDSvix86.sys (Symantec Corporation)
DRV - (NAVEX15) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\VirusDefs\20111001.004\NAVEX15.SYS (Symantec Corporation)
DRV - (NAVENG) -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\VirusDefs\20111001.004\NAVENG.SYS (Symantec Corporation)
DRV - (EraserUtilRebootDrv) -- C:\Program\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (eeCtrl) -- C:\Program\Common Files\Symantec Shared\EENGINE\eeCtrl.sys (Symantec Corporation)
DRV - (a2acc) -- C:\Program\Emsisoft Anti-Malware\a2accx86.sys (Emsi Software GmbH)
DRV - (seehcri) -- C:\Windows\System32\drivers\seehcri.sys (Sony Ericsson Mobile Communications)
DRV - (ggsemc) -- C:\Windows\System32\drivers\ggsemc.sys (Sony Ericsson Mobile Communications)
DRV - (ggflt) -- C:\Windows\System32\drivers\ggflt.sys (Sony Ericsson Mobile Communications)
DRV - (PSI) -- C:\Windows\System32\drivers\psi_mf.sys (Secunia)
DRV - (SymEvent) -- C:\Windows\System32\drivers\SYMEVENT.SYS (Symantec Corporation)
DRV - (NVNET) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (UsbserFilt) -- C:\Windows\System32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) -- C:\Windows\System32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\Windows\System32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\Windows\System32\drivers\ccdcmb.sys (Nokia)
DRV - (SASKUTIL) -- C:\Program\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SYMTDIv) -- C:\Windows\System32\Drivers\NIS\1108000.005\SYMTDIV.SYS (Symantec Corporation)
DRV - (SymIRON) -- C:\Windows\system32\drivers\NIS\1108000.005\Ironx86.SYS (Symantec Corporation)
DRV - (SymEFA) -- C:\Windows\system32\drivers\NIS\1108000.005\SYMEFA.SYS (Symantec Corporation)
DRV - (SRTSP) -- C:\Windows\System32\Drivers\NIS\1108000.005\SRTSP.SYS (Symantec Corporation)
DRV - (SRTSPX) Symantec Real Time Storage Protection (PEL) -- C:\Windows\system32\drivers\NIS\1108000.005\SRTSPX.SYS (Symantec Corporation)
DRV - (ccHP) -- C:\Windows\system32\drivers\NIS\1108000.005\ccHPx86.sys (Symantec Corporation)
DRV - (SASDIFSV) -- C:\Program\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SymDS) -- C:\Windows\system32\drivers\NIS\1108000.005\SYMDS.SYS (Symantec Corporation)
DRV - (pavboot) -- C:\Windows\system32\drivers\pavboot.sys (Panda Security, S.L.)
DRV - (sptd) -- C:\Windows\System32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (pccsmcfd) -- C:\Windows\System32\drivers\pccsmcfd.sys (Nokia)
DRV - (nvstor32) -- C:\Windows\system32\drivers\nvstor32.sys (NVIDIA Corporation)
DRV - (nvrd32) -- C:\Windows\system32\drivers\nvrd32.sys (NVIDIA Corporation)
DRV - (PCD5SRVC{BD6912E3-AC9D80E8-05040000}) -- C:\Program\PC-Doctor for Windows\pcd5srvc.pkms (PC-Doctor, Inc.)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (nvsmu) -- C:\Windows\system32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (SCDEmu) -- C:\Windows\System32\drivers\scdemu.sys (PowerISO Computing, Inc.)
DRV - (Ph3xIB32) -- C:\Windows\System32\drivers\Ph3xIB32.sys (Philips Semiconductors GmbH)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvm60x32.sys (NVIDIA Corporation)
DRV - (V0220Dev) -- C:\Windows\System32\drivers\V0220Dev.sys (Creative Technology Ltd.)
DRV - (V0220Vfx) -- C:\Windows\System32\drivers\V0220Vfx.sys (EyePower Games Pte. Ltd.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
IE - HKLM\..\URLSearchHook: {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program\Freecorder\tbFre1.dll (Conduit Ltd.)

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.lindenytt.com/
IE - HKCU\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/SAFFPlugin: C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandasecurity.com/activescan: C:\Program Files\Panda Security\ActiveScan 2.0\npwrapper.dll (Panda Security)
FF - HKLM\Software\MozillaPlugins\@se.nexus/Personal: C:\Program Files\Personal\bin\np_prsnl.dll (Technology Nexus AB)
FF - HKLM\Software\MozillaPlugins\@SonyCreativeSoftware.com/Media Go,version=1.0: C:\Program Files\Sony\Media Go\npmediago.dll (Sony Media Software and Services Inc)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@facebook.com/FBPlugin,version=1.0.3: C:\Users\Birgitta\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll ( )

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\ekort@orbiscom: C:\Program Files\ekort File not found
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\IPSFFPlgn\ [2011-07-20 20:48:57 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\coFFPlgn_2010_9_0_6 [2011-10-02 11:15:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{4ED1F68A-5463-4931-9384-8FFF5ED91D92}: C:\Program Files\McAfee\SiteAdvisor [2011-10-02 11:18:32 | 000,000,000 | ---D | M]

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.58\gcswf32.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.7 (Enabled) = C:\Program Files\QuickTime\plugins\npqtplugin7.dll
CHR - plugin: Java Deployment Toolkit 6.0.260.3 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll
CHR - plugin: Java™ Platform SE 6 U26 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll
CHR - plugin: Microsoft Office Live Plug-in for Firefox (Enabled) = C:\Program Files\Microsoft\Office Live\npOLW.dll
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.58\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\15.0.874.58\pdf.dll
CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Users\Birgitta\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.31.137.7_0\McChPlg.dll
CHR - plugin: McAfee SiteAdvisor (Enabled) = C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Picasa (Enabled) = C:\Program Files\Google\Picasa3\npPicasa3.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll
CHR - plugin: Panda ActiveScan 2.0 (Enabled) = C:\Program Files\Panda Security\ActiveScan 2.0\npwrapper.dll
CHR - plugin: Nexus Personal (Enabled) = C:\Program Files\Personal\bin\np_prsnl.dll
CHR - plugin: Media Go Detector (Enabled) = C:\Program Files\Sony\Media Go\npmediago.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Facebook Plugin (Enabled) = C:\Users\Birgitta\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: SiteAdvisor = C:\Users\Birgitta\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.40.135.1_0\

O1 HOSTS File: ([2010-09-01 10:10:50 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Freecorder Toolbar) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program\Freecorder\tbFre1.dll (Conduit Ltd.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Symantec NCO BHO) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program\Norton Internet Security\Engine\17.8.0.5\coIEplg.dll (Symantec Corporation)
O2 - BHO: (Symantec Intrusion Prevention) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program\Norton Internet Security\Engine\17.8.0.5\ipsbho.dll (Symantec Corporation)
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (e-kort Helper Class) - {9065E913-4F23-4B47-9B5D-B055D32DB1F3} - C:\Program\ekort\EKortHelper.dll ()
O2 - BHO: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O3 - HKLM\..\Toolbar: (Freecorder Toolbar) - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program\Freecorder\tbFre1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program\Norton Internet Security\Engine\17.8.0.5\coIEplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (e-kort Toolbar) - {8DB2B2E8-579F-48A8-A496-18FEFCF8F4DF} - C:\Program\ekort\EKortToolbar.dll ()
O3 - HKLM\..\Toolbar: (Easy Photo Print) - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Freecorder Toolbar) - {1392B8D2-5C05-419F-A8F6-B9F15A596612} - C:\Program\Freecorder\tbFre1.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program\Norton Internet Security\Engine\17.8.0.5\coIEplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [DVDAgent] c:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe (CyberLink Corp.)
O4 - HKLM..\Run: [HP Health Check Scheduler] c:\Program\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe (Hewlett-Packard)
O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [SunJavaUpdateReg] C:\Windows\System32\jureg.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [V0220Mon.exe] C:\Windows\V0220Mon.exe (Creative Technology Ltd.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - Startup: C:\Users\Birgitta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisallowCpl = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowCpl: Välkomstcenter = Välkomstcenter
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowCpl: Personer i närheten = Personer i närheten
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowCpl: Hjälpmedelscenter = Hjälpmedelscenter
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\DisallowCpl: Föräldrakontroll = Föräldrakontroll
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html File not found
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Program\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} http://kitchenplanne...yerAX_Win32.cab (20-20 3D Viewer)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} http://download.bitd...can8/oscan8.cab (BDSCANONLINE Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Value error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8C54087E-129B-4453-B6F4-44256F2C4669}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: K:\Digitalfoton\2011\07 Juli\P1040645.JPG
O24 - Desktop BackupWallPaper: K:\Digitalfoton\2011\07 Juli\P1040645.JPG
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008-08-15 19:24:05 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011-10-02 19:39:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2011-10-02 19:39:29 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT

========== Files - Modified Within 30 Days ==========

[2011-10-03 12:15:35 | 000,000,978 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011-10-03 12:06:00 | 000,000,982 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011-10-03 12:00:10 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011-10-03 03:01:05 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011-10-03 03:01:05 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011-10-02 19:39:51 | 000,000,919 | ---- | M] () -- C:\Users\Birgitta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2011-10-02 19:39:35 | 000,000,739 | ---- | M] () -- C:\Users\Birgitta\Desktop\NTREGOPT.lnk
[2011-10-02 19:39:35 | 000,000,720 | ---- | M] () -- C:\Users\Birgitta\Desktop\ERUNT.lnk
[2011-10-02 13:45:45 | 000,020,958 | ---- | M] () -- C:\Users\Birgitta\Documents\Lord.ods
[2011-10-02 11:45:44 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011-10-02 11:12:59 | 2011,627,520 | -HS- | M] () -- C:\hiberfil.sys
[2011-09-24 03:00:22 | 000,000,672 | ---- | M] () -- C:\Windows\tasks\Norton Internet Security - Kör fullständig systemsökning - Admin.job
[2011-09-21 19:40:49 | 000,143,806 | ---- | M] () -- C:\Users\Birgitta\Desktop\Räkningar sept.xps
[2011-09-21 19:18:42 | 000,000,334 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForBirgitta.job
[2011-09-11 19:18:09 | 000,018,435 | ---- | M] () -- C:\Users\Birgitta\Desktop\Tjejernas Skulder.ods

========== Files Created - No Company Name ==========

[2011-10-02 19:39:51 | 000,000,919 | ---- | C] () -- C:\Users\Birgitta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2011-10-02 19:39:35 | 000,000,739 | ---- | C] () -- C:\Users\Birgitta\Desktop\NTREGOPT.lnk
[2011-10-02 19:39:34 | 000,000,720 | ---- | C] () -- C:\Users\Birgitta\Desktop\ERUNT.lnk
[2011-09-21 19:40:44 | 000,143,806 | ---- | C] () -- C:\Users\Birgitta\Desktop\Räkningar sept.xps
[2010-12-29 21:19:22 | 000,011,164 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2010-08-30 11:27:16 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2010-08-30 11:27:16 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010-06-30 00:12:16 | 000,013,312 | ---- | C] () -- C:\Windows\LPRES.DLL
[2010-03-22 17:55:41 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2010-01-29 23:03:21 | 000,000,801 | ---- | C] () -- C:\Windows\ScanSpyware.INI
[2009-12-26 01:03:13 | 000,000,178 | ---- | C] () -- C:\Windows\BACKPACK.INI
[2009-12-26 01:03:04 | 000,030,464 | ---- | C] () -- C:\Windows\macromix.dll
[2009-09-03 19:22:25 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009-09-03 19:22:24 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009-08-03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2009-08-03 15:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
[2009-08-01 19:44:27 | 000,007,728 | ---- | C] () -- C:\Users\Birgitta\AppData\Local\d3d9caps.dat
[2009-03-20 11:09:33 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009-03-18 15:43:40 | 000,145,920 | ---- | C] () -- C:\Windows\System32\OBroker.exe
[2009-02-24 14:26:10 | 000,399,360 | ---- | C] () -- C:\Windows\System32\Smab.dll
[2009-02-24 14:26:09 | 000,066,560 | ---- | C] () -- C:\Windows\MOTA113.exe
[2009-02-24 14:26:09 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2009-02-24 14:26:08 | 000,502,784 | ---- | C] () -- C:\Windows\x2.64.exe
[2009-02-24 14:26:08 | 000,240,128 | ---- | C] () -- C:\Windows\System32\x.264.exe
[2009-02-24 14:26:08 | 000,217,073 | ---- | C] () -- C:\Windows\meta4.exe
[2009-02-24 14:25:31 | 000,027,648 | -HS- | C] () -- C:\Windows\System32\Smab0.dll
[2009-02-19 21:41:49 | 000,000,016 | ---- | C] () -- C:\Windows\popcinfo.dat
[2009-02-17 16:01:10 | 000,041,984 | ---- | C] () -- C:\Users\Birgitta\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-02-15 18:45:51 | 000,000,000 | ---- | C] () -- C:\Users\Birgitta\AppData\Roaming\wklnhst.dat
[2009-02-12 20:48:28 | 000,168,448 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2009-02-12 20:48:26 | 000,795,648 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2009-02-12 20:48:26 | 000,130,048 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2009-02-12 20:48:25 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll
[2009-02-12 20:48:23 | 000,067,584 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009-02-12 19:55:08 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
[2009-02-12 19:55:07 | 000,111,932 | ---- | C] () -- C:\Windows\System32\EPPICPrinterDB.dat
[2009-02-12 19:55:07 | 000,031,053 | ---- | C] () -- C:\Windows\System32\EPPICPattern131.dat
[2009-02-12 19:55:07 | 000,027,417 | ---- | C] () -- C:\Windows\System32\EPPICPattern121.dat
[2009-02-12 19:55:07 | 000,026,154 | ---- | C] () -- C:\Windows\System32\EPPICPattern1.dat
[2009-02-12 19:55:07 | 000,024,903 | ---- | C] () -- C:\Windows\System32\EPPICPattern3.dat
[2009-02-12 19:55:07 | 000,021,390 | ---- | C] () -- C:\Windows\System32\EPPICPattern5.dat
[2009-02-12 19:55:07 | 000,020,148 | ---- | C] () -- C:\Windows\System32\EPPICPattern2.dat
[2009-02-12 19:55:07 | 000,011,811 | ---- | C] () -- C:\Windows\System32\EPPICPattern4.dat
[2009-02-12 19:55:07 | 000,004,943 | ---- | C] () -- C:\Windows\System32\EPPICPattern6.dat
[2009-02-12 19:55:07 | 000,001,146 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_DU.dat
[2009-02-12 19:55:07 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_PT.dat
[2009-02-12 19:55:07 | 000,001,139 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_BP.dat
[2009-02-12 19:55:07 | 000,001,136 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_ES.dat
[2009-02-12 19:55:07 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_FR.dat
[2009-02-12 19:55:07 | 000,001,129 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_CF.dat
[2009-02-12 19:55:07 | 000,001,120 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_IT.dat
[2009-02-12 19:55:07 | 000,001,107 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_GE.dat
[2009-02-12 19:55:07 | 000,001,104 | ---- | C] () -- C:\Windows\System32\EPPICPresetData_EN.dat
[2009-02-12 19:50:56 | 000,000,026 | ---- | C] () -- C:\Windows\CDESX100EXPORT.ini
[2009-01-05 15:44:10 | 000,053,248 | ---- | C] () -- C:\Windows\bdoscandel.exe
[2009-01-05 15:44:10 | 000,000,453 | ---- | C] () -- C:\Windows\bdoscandellang.ini
[2008-08-16 04:32:42 | 000,605,924 | ---- | C] () -- C:\Windows\System32\perfh01D.dat
[2008-08-16 04:32:42 | 000,290,490 | ---- | C] () -- C:\Windows\System32\perfi01D.dat
[2008-08-16 04:32:42 | 000,120,600 | ---- | C] () -- C:\Windows\System32\perfc01D.dat
[2008-08-16 04:32:42 | 000,035,978 | ---- | C] () -- C:\Windows\System32\perfd01D.dat
[2008-08-15 19:35:56 | 000,000,428 | ---- | C] () -- C:\Windows\System32\ezdigsgn.dat
[2008-08-15 19:25:06 | 000,108,888 | ---- | C] () -- C:\Windows\hpqins13.dat
[2008-08-15 19:05:02 | 000,327,680 | ---- | C] () -- C:\Windows\System32\pythoncom25.dll
[2008-08-15 19:05:02 | 000,102,400 | ---- | C] () -- C:\Windows\System32\pywintypes25.dll
[2006-11-02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006-11-02 14:47:37 | 000,436,624 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006-11-02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006-11-02 12:33:01 | 000,595,306 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006-11-02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006-11-02 12:33:01 | 000,104,442 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006-11-02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006-11-02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006-11-02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006-11-02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006-11-02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006-11-02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

========== LOP Check ==========

[2009-12-19 20:57:31 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\AnvSoft
[2010-11-28 21:35:54 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\Canneverbe Limited
[2009-03-03 12:43:57 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\EPSON
[2011-03-28 21:33:42 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\f-secure
[2010-06-06 11:42:58 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\Facebook
[2011-07-03 21:16:42 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\IObit
[2011-07-31 17:42:15 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\LimeWire
[2010-05-09 20:30:59 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\Nokia
[2009-02-12 20:58:25 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\OpenOffice.org
[2010-01-17 21:20:10 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\Panasonic
[2010-05-09 20:55:58 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\PC Suite
[2009-02-20 11:53:02 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\Personal
[2010-08-22 20:37:07 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\ScanSpyware
[2010-12-13 20:12:51 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\Sony
[2011-08-07 14:23:58 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\Spotify
[2009-02-15 18:45:52 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\Template
[2010-08-31 13:12:32 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\Tific
[2011-07-02 13:49:58 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\TweakNow PowerPack 2011
[2010-09-02 13:53:25 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\TweakNow RegCleaner
[2011-07-02 13:50:27 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\TweakNow RegCleaner 2011
[2010-08-31 18:39:25 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\Uniblue
[2009-02-13 10:03:44 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\WildTangent
[2009-02-28 11:48:47 | 000,000,000 | ---D | M] -- C:\Users\Birgitta\AppData\Roaming\WinBatch
[2011-09-24 07:58:28 | 000,032,574 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\ProgramData\Temp:5C321E34
@Alternate Data Stream - 941 bytes -> C:\Users\Birgitta\Documents\Aktuellt värde, Värdebevakaren.eml:OECustomProperty
@Alternate Data Stream - 368 bytes -> C:\Users\Birgitta\AppData\Local\desktop.ini:722b2b1c349a06abf0e866180e5a7e63

< End of report >

Bifogade filer

Extras.Txt (72,86Kb)
Antal nedladdningar: 4

#7
attigrib

Användare

Grupp: Medlemmar
Inlägg: 56
Gick med: 2009-11-10

Skrivet 03 okt 2011, 18:50

Och här kommer loggen från malwarebytes:

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Databasversion: 7856

Windows 6.0.6002 Service Pack 2
Internet Explorer 9.0.8112.16421

2011-10-03 19:32:44
mbam-log-2011-10-03 (19-32-44).txt

Skanningstyp: Snabbskanning
Antal skannade objekt: 253479
Förfluten tid: 9 minut(er), 6 sekund(er)

Infekterade minnesprocesser: 0
Infekterade minnesmoduler: 0
Infekterade registernycklar: 0
Infekterade registervärden: 0
Infekterade registerdataposter: 0
Infekterade mappar: 0
Infekterade filer: 0

Infekterade minnesprocesser:
(Inga skadliga poster hittades)

Infekterade minnesmoduler:
(Inga skadliga poster hittades)

Infekterade registernycklar:
(Inga skadliga poster hittades)

Infekterade registervärden:
(Inga skadliga poster hittades)

Infekterade registerdataposter:
(Inga skadliga poster hittades)

Infekterade mappar:
(Inga skadliga poster hittades)

Infekterade filer:
(Inga skadliga poster hittades)

#8
Mats H

Mats H

Grupp: Medlemmar
Inlägg: 3 852
Gick med: 2010-03-13

Skrivet 03 okt 2011, 21:34

Hej,
avinstallera detta program:
Kontrollpanelen\Program
C:\Program\Freecorder\tbFre1.dll (Conduit Ltd.)

Prova sedan att återställa ändringar från detta program eller Windows till en tidpunkt före dess installation
C:\Program\IObit\Advanced SystemCare 4\ASCv

Ta bort/inaktivera, följande PLug-ins:
C:\Program Files\McAfee\SiteAdvisor\npmcffplg32.dll
C:\Program Files\Panda Security\ActiveScan 2.0\npwrapper.dll

Ladda upp följande: C:\Windows\MOTA113.exe, på Virus Total, hittas här:
http://www.virustotal.com/index.html
Tryck på Bläddraknappen och hitta filen, tryck sedan Send File.
Posta svarslänken här i din tråd, "färdiganalyserad".

Mvh
Mats H

Inlägget är redigerat av Mats H: 03 okt 2011, 21:36.

#9
Cecilia

Beroende

Grupp: Huvudmoderator
Inlägg: 76 578
Gick med: 2003-05-06
Ort:Stockholm

Skrivet 03 okt 2011, 21:35

Registerstädningsprogram och liknande som dessa:
Advanced SystemCare 4
CCleaner
TweakNow PowerPack 2011 SP2
TweakNow RegCleaner 2011
orsakar ofta problem, t ex att Windows-uppdateringen slutar att fungera därför att de har tagit bort något som borde vara kvar. Men avinstallera inte programmen utan se om du kan återställa alla ändringar de har gjort sedan Windows-uppdateringen fungerade senast.

#10
attigrib

Användare

Grupp: Medlemmar
Inlägg: 56
Gick med: 2009-11-10

Skrivet 06 okt 2011, 19:41

Nu har jag följt stegen som Mats har beskrivit ovan. Tyvärr kan jag inte komma åt återställningspunkter längre bort än i augusti. De angivna programmen som kan ställa till det har funnits längre tid på datorn. Därför har jag inte gjort någon återställning. Ska jag ändå göra det så långt jag kan?

Här kommer svarslänken till virustotal:
http://www.virustota...98c6-1317925437

Mvh
Birgitta

#11
attigrib

Användare

Grupp: Medlemmar
Inlägg: 56
Gick med: 2009-11-10

Skrivet 06 okt 2011, 20:42

Ett felmeddelande kom upp vid omstart av datorn efter de åtgärder jag gjorde ovan. Bifogar fil.
Ett annat felmeddelande som har kommit upp under en tid gäller Add-In, bifogar fil för detta också.

Bifogade filer

ERU.docx (36,45Kb)
Antal nedladdningar: 4
Add-In.docx (39,98Kb)
Antal nedladdningar: 4

Inlägget är redigerat av attigrib: 06 okt 2011, 20:45.

#12
Cecilia

Beroende

Grupp: Huvudmoderator
Inlägg: 76 578
Gick med: 2003-05-06
Ort:Stockholm

Skrivet 06 okt 2011, 23:06

1.
Förstår jag dig rätt att det inte finns någon backup eller ångra-funktion inne i de 4 programmen?
Att göra en systemåterställning så långt tillbaka i tiden kan leda till andra konstigheter.
När slutade uppdateringarna att fungera?

2.
Första felmeddelandet handlar om att ERDNT inte fungerar ordentligt och det andra är:
"Microsoft Office Live Add-in Sign-in har slutat att fungera".

3.
Spara Gmer på Skrivbordet från:
http://www2.gmer.net/download.php
Den har ett slumpmässigt namn så notera vad programmet sparas som.

Dra ur internetanslutningen.
Stäng alla program, även antivirusprogram och brandvägg.
Starta det nedladdade programmet.
En första snabbskanning startar.
Om det kommer upp en WARNING som nämner ROOTKIT och frågar om "fully scan" så välj Nej/No. Spara loggen och klistra in i ditt svar. Gör inte mer.

Om frågan inte kommer så välj fliken Rootkit/Malware, kontrollera att allt är förbockat till höger utom IAT/EAT, Files, Show All och andra partitioner än C:\. Tryck på Scan. Låt datorn stå ifred medan Gmer håller på och det kan ta några timmar.
Tryck på Save och spara resultatet på Skrivbordet.
Sätt igång antivirusprogram och brandvägg innan du ansluter till internet.
Klistra in resultatet i ditt svar.

4.
Skanna datorn online på http://www.eset.com/onlinescan/
För att inte skannern ska ta för lång tid på sig stäng av ditt antivirusprogram under tiden.

Avbocka alternativet Remove found threats
Bocka för Scan Archives

Klicka på Advanced Settings
Bocka för:
Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology

Klicka på Scan

När skanningen är klar skapas loggfilen C:\Program\Eset\Eset Online Scanner\log.txt. Öppna den i Anteckningar och klistra sedan in innehållet i ditt svar.

#13
attigrib

Användare

Grupp: Medlemmar
Inlägg: 56
Gick med: 2009-11-10

Skrivet 07 okt 2011, 11:46

Svar på din fråga 1 Cecilia:
Jag trodde att återställning menades systemåterställning. Jag har nu tittat i de olika programmen du angav i inlägg #9. Det enda program jag kunde återställa i var Advanced System Care. Det har jag gjort nu. Återställningen som fanns var till den 3 juli och det kan nog vara där någonstans som uppdateringarna började krångla.
Din fråga 2:
Hur kommer jag tillrätta med dessa felmeddelanden. De beror väl på någonting?

Jag ska följa de andra stegen du skrev och återkommer med svar.

Tack så länge

#14
Cecilia

Beroende

Grupp: Huvudmoderator
Inlägg: 76 578
Gick med: 2003-05-06
Ort:Stockholm

Skrivet 07 okt 2011, 11:51

Meddelandet med ERDNT hänger ihop med ERUNT som du installerade i samband med att du försökte med DDS, och det fixar vi när uppdateringarna väl är igång och du inte behöver ERUNT längre.

#15
attigrib

Användare

Grupp: Medlemmar
Inlägg: 56
Gick med: 2009-11-10

Skrivet 07 okt 2011, 12:01

Här kommer loggen från Gmer (jag fick upp WARNING om ROOTKIT)

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit quick scan 2011-10-07 12:57:58
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\0000005d Hitachi_ rev.GM3O
Running: m9bml94n (1).exe; Driver: C:\Users\Birgitta\AppData\Local\Temp\fwddikod.sys

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Filterhanteraren för Microsofts filsystem/Microsoft Corporation)
AttachedDevice \Driver\tdx \Device\Ip SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\tdx \Device\Tcp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\tdx \Device\Udp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice \Driver\tdx \Device\RawIp SYMTDIV.SYS (Network Dispatch Driver/Symantec Corporation)

---- Services - GMER 1.0.15 ----

Service C:\Program (*** hidden *** ) [AUTO] gupdate1c9ec1239f805e0 <-- ROOTKIT !!!
Service C:\Program (*** hidden *** ) [MANUAL] gupdatem <-- ROOTKIT !!!
Service C:\Program (*** hidden *** ) [AUTO] sprtsvc_teliada <-- ROOTKIT !!!
Service C:\Program (*** hidden *** ) [AUTO] tgsrvc_teliada <-- ROOTKIT !!!

---- EOF - GMER 1.0.15 ----

#16
Cecilia

Beroende

Grupp: Huvudmoderator
Inlägg: 76 578
Gick med: 2003-05-06
Ort:Stockholm

Skrivet 07 okt 2011, 12:09

Det där ser ut som falsklarm, men det döljer sig kanske något annat i datorn eftersom de pekas ut. Spara ComboFix på Skrivbordet: http://download.blee...Bs/ComboFix.exe

Stäng av alla program du ser inklusive antivirusprogram och antispionprogram, men lämna brandväggen på.
Hur? Se http://www.bleepingc...opic114351.html
Kör ComboFix och följ anvisningarna som visas.
Om det kommer upp en fråga om du vill installera återställningskonsolen så svara Ja.
Mer detaljerad vägledning finns på http://www.bleepingc...ix-ska-anvandas

VIKTIGT! Klicka inte på ComboFix-fönstret med musen när det körs eftersom så det kan hänga upp sig då.

När ComboFix är färdig ska en logg komma upp, klistra in den i ditt svar. Kontrollera att antivirusprogram mm är igång innan du ansluter till internet.

Om du får problem med att komma ut på internet:
Kontrollpanelen - Nätverksanslutningar
högerklicka på din internetanslutning och välj Reparera och/eller starta om datorn.

#17
attigrib

Användare

Grupp: Medlemmar
Inlägg: 56
Gick med: 2009-11-10

Skrivet 10 okt 2011, 16:51

Combo Fix logg här:

ComboFix 11-10-10.01 - Birgitta 2011-10-10 13:20:15.5.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.46.1053.18.1918.824 [GMT 2:00]
Körs från: c:\users\Birgitta\Downloads\ComboFix.exe
AV: Norton Internet Security *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
FW: Norton Internet Security *Enabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}
SP: Norton Internet Security *Disabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((( Filer skapade från 2011-09-10 till 2011-10-10 ))))))))))))))))))))))))))))))
.
.
2011-10-10 11:41 . 2011-10-10 11:41 -------- d-----w- c:\users\Sanna\AppData\Local\temp
2011-10-10 11:41 . 2011-10-10 11:41 -------- d-----w- c:\users\Public\AppData\Local\temp
2011-10-10 11:41 . 2011-10-10 11:41 -------- d-----w- c:\users\Elin\AppData\Local\temp
2011-10-10 11:41 . 2011-10-10 11:42 -------- d-----w- c:\users\Birgitta\AppData\Local\temp
2011-10-10 11:41 . 2011-10-10 11:41 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-10-10 11:41 . 2011-10-10 11:41 -------- d-----w- c:\users\Christer\AppData\Local\temp
2011-10-10 11:41 . 2011-10-10 11:41 -------- d-----w- c:\users\Admin\AppData\Local\temp
2011-10-09 17:52 . 2011-10-09 17:52 -------- d-----w- c:\users\Birgitta\AppData\Roaming\Complitly
2011-10-09 17:52 . 2011-10-09 17:52 -------- d-----w- c:\program files\Complitly
2011-10-09 17:51 . 2011-10-09 17:51 -------- d-----w- c:\program files\ConduitEngine
2011-10-09 17:51 . 2011-10-09 17:51 -------- d-----w- c:\users\Birgitta\AppData\Local\Conduit
2011-10-07 10:38 . 2011-10-07 10:38 -------- d-----w- c:\users\Birgitta\AppData\Roaming\TweakNow RegCleaner 2011
2011-10-07 10:37 . 2011-10-07 10:37 -------- d-----w- c:\users\Birgitta\AppData\Roaming\TweakNow PowerPack 2011
2011-10-02 17:39 . 2011-10-02 17:39 -------- d-----w- c:\program files\ERUNT
2011-09-11 11:19 . 2011-09-11 11:19 -------- d-----w- c:\users\Elin\AppData\Local\Windows Live
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-10-02 09:45 . 2011-05-18 19:29 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-08-31 15:00 . 2010-09-02 12:07 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-07-22 02:54 . 2011-08-10 01:06 1797632 ----a-w- c:\windows\system32\jscript9.dll
2011-07-22 02:48 . 2011-08-10 01:06 1126912 ----a-w- c:\windows\system32\wininet.dll
2011-07-22 02:44 . 2011-08-10 01:06 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2006-05-03 10:06 163328 --sh--r- c:\windows\System32\flvDX.dll
2007-02-21 11:47 31232 --sh--r- c:\windows\System32\msfDX.dll
2007-12-17 13:43 27648 --sh--w- c:\windows\System32\Smab0.dll
.
.
(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Not* tomma poster & legitima standardposter visas inte.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files\Freecorder\prxtbFree.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
2011-01-17 14:54 175912 ----a-w- c:\program files\Freecorder\prxtbFree.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-17 14:54 175912 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files\Freecorder\prxtbFree.dll" [2011-01-17 175912]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{1392B8D2-5C05-419F-A8F6-B9F15A596612}"= "c:\program files\Freecorder\prxtbFree.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 92704]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-02 75008]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"V0220Mon.exe"="c:\windows\V0220Mon.exe" [2006-06-28 32768]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2011-01-12 49208]
"SunJavaUpdateReg"="c:\windows\system32\jureg.exe" [2007-04-07 54936]
"DVDAgent"="c:\program files\Hewlett-Packard\Media\DVD\DVDAgent.exe" [2009-09-09 1148200]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-06-07 421160]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-07-05 421888]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]
"Freecorder FLV Service"="k:\musik\Elins musik\Limewire\FLVSrvc.exe" [2011-03-24 167936]
.
c:\users\Birgitta\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisallowCpl"= 1 (0x1)
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BankID säkerhetsprogram.lnk]
path=
backup=c:\windows\pss\BankID säkerhetsprogram.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Telia AutoStore.lnk]
path=
backup=c:\windows\pss\Telia AutoStore.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^Admin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]
path=
backup=c:\windows\pss\OpenOffice.org 3.0.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^Birgitta^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]
path=
backup=c:\windows\pss\OpenOffice.org 3.0.lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-06-06 10:55 937920 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\e-kort]
2008-12-11 12:14 377856 ----a-w- c:\progra~1\ekort\ekort.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPADVISOR]
2010-06-29 22:14 1689144 ----a-w- c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2011-06-07 15:51 421160 ----a-w- c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
2010-11-10 01:54 4240760 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2007-04-09 12:23 200704 ----a-w- c:\program files\PowerISO\PWRISOVM.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2011-07-05 16:36 421888 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2009-03-05 14:07 2260480 --sha-r- c:\program files\Spybot - Search & Destroy\TeaTimer.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2011-07-02 11:27 2424192 ----a-w- c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2009-10-29 21:54 39408 ----a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\V0220Cfg.exe]
2006-04-13 17:00 20480 ----a-w- c:\windows\V0220Cfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\V0220Mon.exe]
2006-06-28 17:01 32768 ----a-w- c:\windows\V0220Mon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1878330491-2714151332-3157387515-1001]
"EnableNotifications"=dword:00000001
"EnableNotificationsRef"=dword:00000001
.
R2 gupdate1c9ec1239f805e0;Tjänsten Google Update (gupdate1c9ec1239f805e0);c:\program files\Google\Update\GoogleUpdate.exe [2009-06-13 133104]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\mcsacore.exe [2011-08-10 94880]
R2 uagqecsvc;Microsoft Forefront UAG Quarantine Enforcement Client;c:\users\Birgitta\Forefront UAG Remote Access Agent\portalthomascookse\tcneportal1\uagqecsvc.exe [2010-11-03 149904]
R3 a2acc;a2acc;c:\program files\EMSISOFT ANTI-MALWARE\a2accx86.sys [2011-03-28 73728]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2010-12-13 13224]
R3 gupdatem;Tjänsten Google Update (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-06-13 133104]
R3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\KernExplorer.sys [x]
R3 PCD5SRVC{BD6912E3-AC9D80E8-05040000};PCD5SRVC{BD6912E3-AC9D80E8-05040000} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\PC-DOC~1\PCD5SRVC.pkms [2008-05-22 20640]
R3 Ph3xIB32;Philips 713x Inbox PCI TV Card;c:\windows\system32\DRIVERS\Ph3xIB32.sys [2007-04-03 1131136]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2009-06-15 682232]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-06-30 28552]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1108000.005\SYMDS.SYS [2010-02-04 328752]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1108000.005\SYMEFA.SYS [2010-04-22 173104]
S1 BHDrvx86;BHDrvx86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\BASHDefs\20110929.001\BHDrvx86.sys [2011-09-29 816760]
S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1108000.005\ccHPx86.sys [2010-02-26 501888]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.6.0.32\Definitions\IPSDefs\20111007.030\IDSvix86.sys [2011-08-22 368248]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2010-02-17 12872]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2010-05-10 67656]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1108000.005\Ironx86.SYS [2010-04-29 116784]
S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\NIS\1108000.005\SYMTDIV.SYS [2010-05-06 339504]
S2 a2AntiMalware;Emsisoft Anti-Malware 5.0 - Service;c:\program files\Emsisoft Anti-Malware\a2service.exe [2010-10-28 2806000]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]
S2 AdvancedSystemCareService;Advanced SystemCare Service;c:\program files\IObit\Advanced SystemCare 4\ASCService.exe [2011-05-28 353168]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2008-01-21 21504]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-08-31 366152]
S2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\17.8.0.5\ccSvcHst.exe [2010-02-26 126392]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files\Secunia\PSI\PSIA.exe [2011-01-05 988216]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files\Secunia\PSI\sua.exe [2011-01-05 399416]
S2 sprtsvc_teliada;SupportSoft Sprocket Service (teliada);c:\program files\Telia\Supportassistenten\bin\sprtsvc.exe [2010-05-10 206120]
S2 tgsrvc_teliada;SupportSoft Repair Service (teliada);c:\program files\Telia\Supportassistenten\bin\tgsrvc.exe [2010-05-10 185640]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2011-07-29 105592]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-08-31 22216]
S3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf.sys [2010-09-01 15544]
S3 seehcri;Sony Ericsson seehcri Device Driver;c:\windows\system32\DRIVERS\seehcri.sys [2010-12-13 27632]
S3 V0220Dev;Live! Cam Video IM;c:\windows\system32\DRIVERS\V0220Dev.sys [2006-06-29 146112]
S3 V0220Vfx;V0220Vfx;c:\windows\system32\DRIVERS\V0220Vfx.sys [2006-06-08 6272]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc
.
Innehåll i mappen 'Schemalagda aktiviteter':
.
2011-10-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-13 10:31]
.
2011-10-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-13 10:31]
.
2011-09-21 c:\windows\Tasks\HPCeeScheduleForBirgitta.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2008-08-15 18:03]
.
2011-10-07 c:\windows\Tasks\Norton Internet Security - Kör fullständig systemsökning - Admin.job
- c:\program files\Norton Internet Security\Engine\17.8.0.5\navw32.exe [2010-09-24 19:24]
.
.
------- Extra genomsökning -------
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1060933
uLocal Page =
mLocal Page =
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.1.1
.
- - - - FÖRÄLDRALÖSA POSTER SOM TAGITS BORT - - - -
.
Toolbar-Locked - (no file)
MSConfigStartUp-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-10 13:42
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LÅSTA REGISTERNYCKLAR ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLL'er som "laddats" under processer som körs ---------------------
.
- - - - - - - > 'Explorer.exe'(5904)
c:\users\Birgitta\AppData\Local\FLVService\lib\FLVSrvLib.dll
.
Sluttid: 2011-10-10 13:51:46
ComboFix-quarantined-files.txt 2011-10-10 11:51
.
Före genomsökningen: 162 724 179 968 byte ledigt
Efter genomsökningen: 163 241 492 480 byte ledigt
.
- - End Of File - - 082228BCBAFD920289F3146B5DF9F0D1

#18
Cecilia

Beroende

Grupp: Huvudmoderator
Inlägg: 76 578
Gick med: 2003-05-06
Ort:Stockholm

Skrivet 10 okt 2011, 17:09

Avinstallera de fyra registerstädningsprogrammen samt "Freecorder Toolbar" om du inte redan har gjort det.

Stäng av alla program du ser inklusive antivirusprogram och antispionprogram så att de inte krockar med OTL.
Hur? Se http://www.bleepingc...opic114351.html

Starta programmet OTL (i Vista/Windows7 högerklicka och välj Kör som administratör).
Kopiera alla raderna i rutan:

:OTL
@Alternate Data Stream - 95 bytes -> C:\ProgramData\Temp:5C321E34
@Alternate Data Stream - 368 bytes -> C:\Users\Birgitta\AppData\Local\desktop.ini:722b2b1c349a06abf0e866180e5a7e63
:Commands
[CREATERESTOREPOINT]
[EMPTYTEMP]
[REBOOT]

Klistra in dem i rutan Custom Scans/Fixes. Kontrollera att det ser exakt likadant ut, t ex när det gäller radbrytningar.
Tryck på Run Fix.
Om du blir tillfrågad om att starta om datorn så gör det.
Det kommer upp en logg i Anteckningar. Kopiera den och klistra in i ditt svar.

Om den inte kommer automatiskt så hittar du den i mappen c:\_OTL\Moved Files med ett namn som innehåller dagens datum och klockslaget för körningen.

Se till att aktivera antivirusprogram mm innan du ansluter datorn till internet.

Kör OTL som du gjorde första gången och klistra in loggen OTL.txt.

#19
attigrib

Användare

Grupp: Medlemmar
Inlägg: 56
Gick med: 2009-11-10

Skrivet 10 okt 2011, 20:20

Loggfil från ESET Online scanner:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6419
# api_version=3.0.2
# EOSSerial=0493a91b4bb372498b3a8d70cbcc9437
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-01-16 05:45:49
# local_time=2011-01-16 06:45:49 (+0100, Västeuropa, normaltid)
# country="Sweden"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 12222160 12222160 0 0
# compatibility_mode=3588 16777214 85 88 3127516 34705844 0 0
# compatibility_mode=5892 16776574 100 100 11873644 132658542 0 0
# compatibility_mode=8192 67108863 100 0 37192317 37192317 0 0
# scanned=319709
# found=3
# cleaned=3
# scan_time=30933
K:\Musik\Elins musik\Incomplete\T-3877629-Perry Farrell - Go All Way (Into the Twilight).mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan (cleaned - quarantined) 00000000000000000000000000000000 C
K:\Musik\Elins musik\Incomplete\T-3877629-Mutemath - Spotlight (Twilight Mix3).mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan (cleaned - quarantined) 00000000000000000000000000000000 C
K:\Musik\Elins musik\Incomplete\T-39456-Kingdom Come - Rather Be On My Own.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan (cleaned - quarantined) 00000000000000000000000000000000 C
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6528
# api_version=3.0.2
# EOSSerial=0493a91b4bb372498b3a8d70cbcc9437
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-10-10 07:14:40
# local_time=2011-10-10 09:14:40 (+0100, Västeuropa, sommartid)
# country="Sweden"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=512 16777215 100 0 35358670 35358670 0 0
# compatibility_mode=3588 16777214 85 88 7074605 57842354 0 0
# compatibility_mode=5892 16776574 100 100 35010154 155795052 0 0
# compatibility_mode=8192 67108863 100 0 60328827 60328827 0 0
# scanned=292943
# found=1
# cleaned=1
# scan_time=11756
C:\Users\Birgitta\Downloads\m-mp4-to-mp3-converter6.exe Win32/Toolbar.Zugo application (deleted - quarantined) 00000000000000000000000000000000 C

#20
Cecilia

Beroende

Grupp: Huvudmoderator
Inlägg: 76 578
Gick med: 2003-05-06
Ort:Stockholm

Skrivet 10 okt 2011, 23:06

Såg du mitt inlägg, nummer 18?

3 sidor
1
2
3
→

Du kan inte starta en ny tråd
Du kan inte svara i tråden