[Daniel1001]

Hej Cecilia,

datorn låser sig fortfarande när jag jag kör Combofix med CFScript. Låsningen sker först efter det att återställningspunkt har skapats och texten om att detta inte bör ta mer än 10 minuter har kommit fram .

Under uppstart av Combofix kommer två rutor upp som varnar för att gå vidare på grund av Norton 360. Tidigare har du sagt att jag skall klicka mig vidare här och det funkar ju väl när jag kör Combofix utan CFScript.

Kan jag göra något mer för att får CFScript att funka med Combofix?

Innan jag kör CFScript/Combofix stänger jag av Avast och Malewarebytes. Något mer jag bör stänga av / inaktivera?

Bifogar igen DDS-loggen.

.

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by agare at 20:56:12 on 2012-04-10
Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.2046.1061 [GMT 2:00]
.
AV: Norton 360 *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Norton 360 *Enabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program\Ahead\InCD\InCDsrv.exe
svchost.exe
svchost.exe
C:\Program\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program\Delade filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program\Bonjour\mDNSResponder.exe
svchost.exe
C:\Program\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program\Delade filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program\WatchGuard\Mobile VPN\ncpclcfg.exe
C:\Program\WatchGuard\Mobile VPN\ncprwsnt.exe
C:\Program\WatchGuard\Mobile VPN\ncpsec.exe
C:\Program\PortWise\Access Client\AccessClient-Service.exe
C:\Program\WatchGuard\Mobile VPN\rwsrsu.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\sm56hlpr.exe
C:\Program\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program\Ahead\InCD\InCD.exe
C:\Program\Adobe\Photoshop Elements 4.0\apdproxy.exe
C:\Program\CyberLink\PowerDVD\PDVDServ.exe
C:\Program\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program\WatchGuard\Mobile VPN\NcpBudgetGui.exe
C:\Program\WatchGuard\Mobile VPN\ncpmon.exe
C:\Program\WatchGuard\Mobile VPN\rwsrsu.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program\Net iD\iid.exe
C:\Program\iTunes\iTunesHelper.exe
C:\Program\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program\Skype\Phone\Skype.exe
C:\Program\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program\Logitech\SetPoint\SetPoint.exe
C:\Program\Nike+ Utility\Nike+ Utility.exe
C:\Program\Windows Desktop Search\WindowsSearch.exe
C:\Program\iPod\bin\iPodService.exe
C:\Program\Delade filer\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program\ATI Technologies\ATI.ACE\cli.exe
C:\Program\ATI Technologies\ATI.ACE\cli.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.se/
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program\delade filer\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program\alwil software\avast5\aswWebRepIE.dll
BHO: Windows Live inloggningshjälpen: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program\delade filer\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program\google\googletoolbarnotifier\5.7.7227.1100\swg.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\program\micros~3\office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll
TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program\canon\easy-webprint\Toolband.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program\alwil software\avast5\aswWebRepIE.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program\google\google toolbar\GoogleToolbar_32.dll
uRun: [Skype] "c:\program\skype\\phone\Skype.exe" /nosplash /minimized
uRun: [NBJ] "c:\program\ahead\nero backitup\NBJ.exe"
uRun: [swg] "c:\program\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
mRun: [Genväg till egenskapssida för High Definition Audio] HDAShCut.exe
mRun: [ATICCC] "c:\program\ati technologies\ati.ace\cli.exe" runtime -Delay
mRun: [SMSERIAL] sm56hlpr.exe
mRun: [Google Quick Search Box] "c:\program\google\quick search box\GoogleQuickSearchBox.exe" /autorun
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [OpwareSE2] "c:\program\scansoft\omnipagese2.0\OpwareSE2.exe"
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [InCD] c:\program\ahead\incd\InCD.exe
mRun: [Adobe Photo Downloader] "c:\program\adobe\photoshop elements 4.0\apdproxy.exe"
mRun: [RemoteControl] c:\program\cyberlink\powerdvd\PDVDServ.exe
mRun: [Adobe Reader Speed Launcher] "c:\program\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [NcpBudgetGui] "c:\program\watchguard\mobile vpn\NcpBudgetGui.exe" -start
mRun: [NcpPopup] "c:\program\watchguard\mobile vpn\ncppopup.exe" noerrmsg
mRun: [NcpMonitor] "c:\program\watchguard\mobile vpn\ncpmon.exe" autorun
mRun: [NcpRsuGui] "c:\program\watchguard\mobile vpn\rwsrsu.exe" -gui
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [AppleSyncNotifier] c:\program\delade filer\apple\mobile device support\AppleSyncNotifier.exe
mRun: [Net iD] "c:\program\net id\iid.exe"
mRun: [QuickTime Task] "c:\program\quicktime\qttask.exe" -atboottime
mRun: [APSDaemon] "c:\program\delade filer\apple\apple application support\APSDaemon.exe"
mRun: [iTunesHelper] "c:\program\itunes\iTunesHelper.exe"
mRun: [Malwarebytes' Anti-Malware] "c:\program\malwarebytes' anti-malware\mbamgui.exe" /starttray
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\agare\start-~1\program\autost~1\adobeg~1.lnk - c:\program\delade filer\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\logite~1.lnk - c:\program\logitech\setpoint\SetPoint.exe
StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\nike_u~1.lnk - c:\program\nike+ utility\Nike+ Utility.exe
StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\window~1.lnk - c:\program\windows desktop search\WindowsSearch.exe
IE: E&xportera till Microsoft Excel - c:\program\micros~3\office14\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program\canon\easy-webprint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program\canon\easy-webprint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program\canon\easy-webprint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program\canon\easy-webprint\Resource.dll/RC_Print.html
IE: Ski&cka till OneNote - c:\program\micros~3\office14\ONBttnIE.dll/105
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program\microsoft office\office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program\microsoft office\office14\ONBttnIELinkedNotes.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\program\micros~3\office11\REFIEBAR.DLL
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {19D6A3D5-EA50-4C3B-88F0-79627C325570} - hxxps://www.one.com/static/controls/IlosoftMultipleImageUpload.dll
DPF: {3195CF7C-E9E2-49B2-8B61-14F285298E1C} - hxxps://outside.comhem.com/wa/AccessClientLoader.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1250792942406
DPF: {7ECB1A47-6647-4B2C-A8DA-675569C9FF15} - hxxp://www.fujidirekt.se/asp/_upload/activex/ImageUploader7.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{9A596260-169D-462F-92C0-EA1504C2796B} : DhcpNameServer = 192.168.1.1
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program\delade filer\microsoft shared\office14\MSOXMLMF.DLL
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program\delade~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: LBTWlgn - c:\program\delade filer\logishrd\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program\windows desktop search\MSNLNamespaceMgr.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\agare\application data\mozilla\firefox\profiles\33cdtdca.default\
FF - plugin: c:\program\canon\zoombrowser ex\program\NPCIG.dll
FF - plugin: c:\program\google\update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: c:\program\micros~3\office14\NPAUTHZ.DLL
FF - plugin: c:\program\micros~3\office14\NPSPWRAP.DLL
FF - plugin: c:\program\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program\mozilla firefox\plugins\npdjvu.dll
FF - plugin: c:\program\mozilla firefox\plugins\npiidplg.dll
FF - plugin: c:\program\mozilla firefox\plugins\npOGAPlugin.dll
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-7-15 612184]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2009-8-24 337880]
R1 waclient;Portwise Access Client Driver;c:\windows\system32\drivers\waclient.sys [2009-10-11 39552]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-8-24 20696]
R2 avast! Antivirus;avast! Antivirus;c:\program\alwil software\avast5\AvastSvc.exe [2010-7-29 44768]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2009-12-28 10384]
R2 MBAMService;MBAMService;c:\program\malwarebytes' anti-malware\mbamservice.exe [2009-8-24 652360]
R2 ncpclcfg;ncpclcfg;c:\program\watchguard\mobile vpn\ncpclcfg.exe [2009-11-16 86016]
R2 ncprwsnt;ncprwsnt;c:\program\watchguard\mobile vpn\NCPRWSNT.EXE [2009-11-16 1065480]
R2 NcpSec;NcpSec;c:\program\watchguard\mobile vpn\NCPSEC.EXE [2009-11-16 32768]
R2 pwClientService;PortWise Client Service;c:\program\portwise\access client\AccessClient-Service.exe [2011-4-26 177392]
R2 rwsrsu;RwsRsu;c:\program\watchguard\mobile vpn\rwsrsu.exe [2009-11-16 850432]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-8-24 20464]
R3 NcpFiltMP;NcpFiltMP;c:\windows\system32\drivers\ncpvaxp.sys [2009-11-16 79528]
S2 gupdate;Tjänsten Google Update (gupdate);c:\program\google\update\GoogleUpdate.exe [2010-2-11 135664]
S3 esgiguard;esgiguard;\??\c:\program\enigma software group\spyhunter\esgiguard.sys --> c:\program\enigma software group\spyhunter\esgiguard.sys [?]
S3 gupdatem;Tjänsten Google Update (gupdatem);c:\program\google\update\GoogleUpdate.exe [2010-2-11 135664]
S3 kwwalpgr;kwwalpgr;\??\c:\docume~1\agare\lokala~1\temp\kwwalpgr.sys --> c:\docume~1\agare\lokala~1\temp\kwwalpgr.sys [?]
S3 libusb0;LibUsb-Win32 - Kernel Driver 07/07/2009, 0.1.12.2;c:\windows\system32\drivers\libusb0.sys [2011-5-4 28160]
S3 MosIrUsb;MosIrUsb.sys;c:\windows\system32\drivers\MosIrUsb.sys [2004-4-14 20736]
S3 NcpFilt;Ncp Filter Service;c:\windows\system32\drivers\ncpvaxp.sys [2009-11-16 79528]
S3 ncpvaxp;NCP Secure Client Virtual Adapter Driver;c:\windows\system32\drivers\ncpvaxp.sys [2009-11-16 79528]
S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [2010-6-29 18432]
S3 osppsvc;Office Software Protection Platform;c:\program\delade filer\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
.
=============== Created Last 30 ================
.
2012-04-10 18:39:38 -------- d-s---w- C:\ComboFix
2012-04-08 19:53:55 98816 ----a-w- c:\windows\sed.exe
2012-04-08 19:53:55 518144 ----a-w- c:\windows\SWREG.exe
2012-04-08 19:53:55 256000 ----a-w- c:\windows\PEV.exe
2012-04-08 19:53:55 208896 ----a-w- c:\windows\MBR.exe
.
==================== Find3M ====================
.
2012-03-07 00:15:19 41184 ----a-w- c:\windows\avastSS.scr
2012-03-07 00:03:51 612184 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-02-06 18:45:59 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-03 09:57:40 1860096 ----a-w- c:\windows\system32\win32k.sys
2012-01-11 19:07:15 3072 ------w- c:\windows\system32\iacenc.dll
.
============= FINISH: 20:59:35,08 ===============

[Cecilia]

Då övergår vi till några andra program i stället.

1.
Spara RougueKiller på Skrivbordet.
http://www.sur-la-to...om/RogueKiller/
Stäng av alla program.

Kör RogueKiller. Om det inte går att köra så pröva flera gång, men om det fortfarande inte går så pröva med att döpa om programmet till winlogon.exe.

Vänta tills "Prescan" har avslutats.
Klicka på "Scan"-knappen uppe till höger.
Vänta tills skanningen är klar.
En rapport med ett namn som är likt "RKreport.txt" ska då ha skapats på Skrivbordet.
Klistra in innehållet i den i ditt svar.

2.
Spara OTL på Skrivbordet. http://oldtimer.geekstogo.com/OTL.exe
Stäng alla program.
Kör OTL (i Vista och Windows 7 högerklicka och Kör som administratör).
Välj "All users".

I rutan Custom scan klistra in följande rader (kolla att du verkligen får med alla raderna):

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
consrv.dll
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
C:\Windows\assembly\tmp\U\*.* /s
%Temp%\smtmp\1\*.*
%Temp%\smtmp\2\*.*
%Temp%\smtmp\3\*.*
%Temp%\smtmp\4\*.*
>C:\commands.txt echo list vol /raw /hide /c
/wait
>C:\DiskReport.txt diskpart /s C:\commands.txt /raw /hide /c
/wait
type c:\diskreport.txt /c
/wait
erase c:\commands.txt /hide /c
/wait
erase c:\diskreport.txt /hide /c
CREATERESTOREPOINT

Tryck på "Quick Scan"-knappen och låt programmet köra ostört.

När det är klart så skapas två loggfiler på Skrivbordet, OTL.txt och Extras.txt. I ditt svar klistrar du in loggen OTL.txt. Medan du bifogar Extras.txt som en fil.

[Daniel1001]

Hej Cecilia,

har kört RougueKiller. Se logg. Den valde att skapa en karantän mapp och frågade om den skulle tas bort, jag svara de nej en så länge.

OTL stänger hela tiden ner efter ca 10 sekunder. Den påbörjar Quick Scan, dör och inget mer händer. Får således inga filer.

mvh
Daniel

RogueKiller V7.3.2 [03/20/2012] by Tigzy

RogueKiller V7.3.2 [03/20/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo...13-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User: agare [Admin rights]
Mode: Scan -- Date: 04/14/2012 07:51:45

¤¤¤ Bad processes: 1 ¤¤¤
[SUSP PATH] sm56hlpr.exe -- C:\WINDOWS\sm56hlpr.exe -> KILLED [TermProc]

¤¤¤ Registry Entries: 1 ¤¤¤
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
127.0.0.1 localhost


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: FUJITSU MHV2100BH SCSI Disk Device +++++
--- User ---
[MBR] b3cf9cc2192695431bd174afb5babefb
[BSP] b3c818f378a2c0d396dafa085495c27e : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 95385 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

+++++ PhysicalDrive1: FUJITSU MHV2100BH SCSI Disk Device +++++
--- User ---
[MBR] e0dd9a93ca44b6d46f4fa0cb934d6bfc
[BSP] 63cdf42a96cdfa522460541de310de1b : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 95393 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

Finished : << RKreport[1].txt >>
RKreport[1].txt

[Cecilia]

Starta om datorn i felsäkert läge (tryck F8 upprepade gånger under uppstarten och välj felsäkert läge i menyn).

Försök köra OTL igen på samma sätt. Om det fortfarande är problem så pröva med "Run Scan"-knappen i stället. Om det fortfarande inte går så låt bli att klistra in något i rutan "Custom scan's and fixes" innan du klickar på någon av Quick- och Run-knapparna.

[Daniel1001]

Det funkade i felsäkert läge. Här kommer loggarna för RougeKiler och OTL samt filen Extras. Tack för all hjälp!

mvh
Daniel

RogueKiller V7.3.2 [03/20/2012] by Tigzy

RogueKiller V7.3.2 [03/20/2012] by Tigzy
mail: tigzyRK<at>gmail<dot>com
Feedback: http://www.geekstogo...13-roguekiller/
Blog: http://tigzyrk.blogspot.com

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User: agare [Admin rights]
Mode: Scan -- Date: 04/14/2012 07:51:45

¤¤¤ Bad processes: 1 ¤¤¤
[SUSP PATH] sm56hlpr.exe -- C:\WINDOWS\sm56hlpr.exe -> KILLED [TermProc]

¤¤¤ Registry Entries: 1 ¤¤¤
[HJ] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver: [LOADED] ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
127.0.0.1 localhost


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: FUJITSU MHV2100BH SCSI Disk Device +++++
--- User ---
[MBR] b3cf9cc2192695431bd174afb5babefb
[BSP] b3c818f378a2c0d396dafa085495c27e : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 95385 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

+++++ PhysicalDrive1: FUJITSU MHV2100BH SCSI Disk Device +++++
--- User ---
[MBR] e0dd9a93ca44b6d46f4fa0cb934d6bfc
[BSP] 63cdf42a96cdfa522460541de310de1b : Windows XP MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 95393 Mo
User = LL1 ... OK!
Error reading LL2 MBR!

Finished : << RKreport[1].txt >>
RKreport[1].txt

OTL logfile created on: 2012-04-14 11:50:21 - Run 1

OTL logfile created on: 2012-04-14 11:50:21 - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Documents and Settings\agare\Skrivbord
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 0000041D | Country: Sverige | Language: SVE | Date Format: yyyy-MM-dd

2,00 Gb Total Physical Memory | 1,74 Gb Available Physical Memory | 87,05% Memory free
3,85 Gb Paging File | 3,78 Gb Available in Paging File | 98,30% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program
Drive C: | 93,15 Gb Total Space | 10,84 Gb Free Space | 11,63% Space Free | Partition Type: NTFS
Drive D: | 93,16 Gb Total Space | 26,42 Gb Free Space | 28,36% Space Free | Partition Type: NTFS

Computer Name: 40BD2BEB73DD4B3 | User Name: agare | Logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012-04-14 07:58:26 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\agare\Skrivbord\OTL.exe
PRC - [2008-04-14 18:05:06 | 001,034,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (No Company Name) ==========

MOD - [2009-02-27 18:23:48 | 000,311,296 | ---- | M] () -- C:\Program\Delade filer\Adobe\Acrobat\ActiveX\pdfshell.SVE


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)
SRV - [2012-03-07 02:15:14 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Stopped] -- C:\Program\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012-01-13 15:53:18 | 000,652,360 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2011-10-24 22:32:00 | 000,055,144 | ---- | M] (Apple Inc.) [Auto | Stopped] -- C:\Program\Delade filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2011-04-26 20:31:44 | 000,177,392 | ---- | M] (PortWise) [Auto | Stopped] -- C:\Program\PortWise\Access Client\AccessClient-Service.exe -- (pwClientService)
SRV - [2010-01-09 22:37:50 | 004,640,000 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program\Delade filer\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010-01-09 22:18:00 | 000,149,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program\Delade filer\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2009-02-18 10:39:14 | 001,065,480 | ---- | M] (NCP Engineering GmbH) [Auto | Stopped] -- C:\Program\WatchGuard\Mobile VPN\NCPRWSNT.EXE -- (ncprwsnt)
SRV - [2008-12-02 09:33:54 | 000,850,432 | ---- | M] () [Auto | Stopped] -- C:\Program\WatchGuard\Mobile VPN\rwsrsu.exe -- (rwsrsu)
SRV - [2008-11-07 17:40:52 | 000,121,360 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program\Delade filer\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2008-10-06 11:58:18 | 000,032,768 | ---- | M] () [Auto | Stopped] -- C:\Program\WatchGuard\Mobile VPN\NCPSEC.EXE -- (NcpSec)
SRV - [2008-06-30 13:22:40 | 000,086,016 | ---- | M] (NCP engineering GmbH) [Auto | Stopped] -- C:\Program\WatchGuard\Mobile VPN\ncpclcfg.exe -- (ncpclcfg)
SRV - [2007-01-31 14:55:42 | 000,096,370 | ---- | M] (Canon Inc.) [Auto | Stopped] -- C:\Program\Canon\CAL\CALMAIN.exe -- (CCALib8)
SRV - [2005-10-03 12:04:04 | 000,102,400 | ---- | M] () [Auto | Stopped] -- C:\Program\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor4.0)
SRV - [2005-04-12 11:15:04 | 000,869,376 | ---- | M] (Nero AG) [Auto | Stopped] -- C:\Program\Ahead\InCD\InCDsrv.exe -- (InCDsrvR) InCD Helper (read only)
SRV - [2005-04-12 11:15:04 | 000,869,376 | ---- | M] (Nero AG) [Auto | Stopped] -- C:\Program\Ahead\InCD\InCDsrv.exe -- (InCDsrv)
SRV - [2003-06-19 23:25:00 | 000,322,120 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program\Delade filer\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\agare\LOKALA~1\Temp\kwwalpgr.sys -- (kwwalpgr)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\agare\LOKALA~1\Temp\catchme.sys -- (catchme)
DRV - [2012-03-07 02:03:51 | 000,612,184 | ---- | M] (AVAST Software) [File_System | System | Stopped] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012-03-07 02:03:38 | 000,337,880 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012-03-07 02:02:00 | 000,035,672 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2012-03-07 02:01:53 | 000,053,848 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012-03-07 02:01:39 | 000,095,704 | ---- | M] (AVAST Software) [File_System | Auto | Stopped] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2012-03-07 02:01:30 | 000,020,696 | ---- | M] (AVAST Software) [File_System | Auto | Stopped] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012-03-07 01:58:29 | 000,024,920 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2011-12-10 16:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011-04-26 20:31:50 | 000,039,552 | ---- | M] () [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\waclient.sys -- (waclient)
DRV - [2010-04-19 20:29:20 | 000,018,432 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\netaapl.sys -- (Netaapl)
DRV - [2009-08-06 15:37:10 | 000,010,240 | ---- | M] () [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\mdvrmng.sys -- (mdvrmng)
DRV - [2009-08-06 15:36:18 | 000,102,400 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2009-07-07 10:53:04 | 000,028,160 | ---- | M] (http://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\libusb0.sys -- (libusb0)
DRV - [2009-05-29 07:23:22 | 004,203,392 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\NETw5x32.sys -- (NETw5x32) Intel®
DRV - [2008-12-10 15:43:04 | 000,079,528 | ---- | M] (NCP Engineering GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ncpvaxp.sys -- (ncpvaxp)
DRV - [2008-12-10 15:43:04 | 000,079,528 | ---- | M] (NCP Engineering GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ncpvaxp.sys -- (NcpFiltMP)
DRV - [2008-12-10 15:43:04 | 000,079,528 | ---- | M] (NCP Engineering GmbH) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ncpvaxp.sys -- (NcpFilt)
DRV - [2008-09-26 10:53:00 | 000,037,392 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2008-09-26 10:52:00 | 000,035,472 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2008-09-26 10:52:00 | 000,010,384 | ---- | M] (Logitech, Inc.) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE)
DRV - [2007-09-06 22:53:12 | 000,014,848 | ---- | M] (Silicon Laboratories) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\DSI_SiUSBXp_3_1.sys -- (DSI_SiUSBXp_3_1)
DRV - [2006-02-27 18:47:00 | 004,241,920 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2006-02-09 21:57:46 | 001,502,208 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2005-12-05 00:55:30 | 001,428,096 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w39n51.sys -- (w39n51) Intel®
DRV - [2005-09-30 11:11:42 | 000,078,720 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2005-09-16 14:09:02 | 000,846,792 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\smserial.sys -- (smserial)
DRV - [2005-04-12 11:07:54 | 000,008,704 | ---- | M] (Nero AG) [Recognizer | System | Unknown] -- C:\WINDOWS\System32\drivers\InCDrec.sys -- (InCDrec)
DRV - [2005-04-12 11:07:50 | 000,099,456 | ---- | M] (Nero AG) [File_System | Disabled | Stopped] -- C:\WINDOWS\System32\drivers\InCDfs.sys -- (InCDfs)
DRV - [2005-04-12 11:07:30 | 000,029,056 | ---- | M] (Nero AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\InCDpass.sys -- (InCDPass)
DRV - [2005-04-12 11:07:25 | 000,028,160 | ---- | M] (Nero AG) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\InCDrm.sys -- (incdrm)
DRV - [2005-01-07 17:07:16 | 000,145,920 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService)
DRV - [2004-09-30 01:27:00 | 000,016,880 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ctpdusb.sys -- (Jukebox3)
DRV - [2004-04-14 14:52:54 | 000,020,736 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\MosIrUsb.sys -- (MosIrUsb)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.c...ferrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...g}&sourceid=ie7


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\S-1-5-21-725345543-1547161642-682003330-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.se/
IE - HKU\S-1-5-21-725345543-1547161642-682003330-1004\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKU\S-1-5-21-725345543-1547161642-682003330-1004\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/...Box&FORM=IE8SRC
IE - HKU\S-1-5-21-725345543-1547161642-682003330-1004\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.co...1I7GGLL_svSE342
IE - HKU\S-1-5-21-725345543-1547161642-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-725345543-1547161642-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\Program\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program\Alwil Software\Avast5\WebRep\FF [2012-03-14 22:59:55 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: C:\Program\Mozilla Firefox\components [2011-08-17 19:53:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: C:\Program\Mozilla Firefox\plugins [2011-11-06 21:24:34 | 000,000,000 | ---D | M]

[2011-05-14 21:31:50 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\agare\Application Data\Mozilla\Extensions
[2011-09-06 19:50:28 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\agare\Application Data\Mozilla\Firefox\Profiles\33cdtdca.default\extensions
[2011-09-06 19:50:28 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Documents and Settings\agare\Application Data\Mozilla\Firefox\Profiles\33cdtdca.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}
[2010-05-02 16:09:48 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\agare\Application Data\Mozilla\Firefox\Profiles\33cdtdca.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011-08-17 19:54:12 | 000,000,000 | ---D | M] (Vuze Remote Community Toolbar) -- C:\Documents and Settings\agare\Application Data\Mozilla\Firefox\Profiles\33cdtdca.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
[2012-03-16 23:26:49 | 000,000,000 | ---D | M] (No name found) -- C:\Program\Mozilla Firefox\extensions
[2010-02-09 16:50:33 | 000,000,000 | ---D | M] (Skype extension for Firefox) -- C:\Program\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2012-03-14 22:59:55 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM\ALWIL SOFTWARE\AVAST5\WEBREP\FF
[2011-08-17 19:53:18 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program\mozilla firefox\components\browsercomps.dll
[2010-04-12 17:29:19 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program\mozilla firefox\plugins\npdeployJava1.dll
[2011-10-24 00:49:22 | 001,826,192 | ---- | M] (Caminova, Inc.) -- C:\Program\mozilla firefox\plugins\npdjvu.dll
[2010-02-04 15:01:14 | 000,220,472 | ---- | M] (SecMaker AB) -- C:\Program\mozilla firefox\plugins\npiidplg.dll
[2009-08-03 15:07:42 | 000,373,104 | ---- | M] (Microsoft Corporation) -- C:\Program\mozilla firefox\plugins\npOGAPlugin.dll
[2010-01-01 10:00:00 | 000,001,470 | ---- | M] () -- C:\Program\mozilla firefox\searchplugins\allaannonser-sv-SE.xml
[2010-01-01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program\mozilla firefox\searchplugins\bing.xml
[2010-09-02 10:09:28 | 000,002,486 | ---- | M] () -- C:\Program\mozilla firefox\searchplugins\iMeshWebSearch.xml
[2010-01-01 10:00:00 | 000,002,670 | ---- | M] () -- C:\Program\mozilla firefox\searchplugins\prisjakt-sv-SE.xml
[2010-01-01 10:00:00 | 000,000,948 | ---- | M] () -- C:\Program\mozilla firefox\searchplugins\tyda-sv-SE.xml
[2010-01-01 10:00:00 | 000,001,174 | ---- | M] () -- C:\Program\mozilla firefox\searchplugins\wikipedia-sv-SE.xml
[2010-01-01 10:00:00 | 000,000,951 | ---- | M] () -- C:\Program\mozilla firefox\searchplugins\yahoo-sv-SE.xml

O1 HOSTS File: ([2012-04-09 07:46:13 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program\Delade filer\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Windows Live inloggningshjälpen) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program\Java\jre6\bin\jp2ssv.dll File not found
O3 - HKLM\..\Toolbar: (Easy-WebPrint) - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program\Canon\Easy-WebPrint\Toolband.dll ()
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program\Adobe\Photoshop Elements 4.0\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program\Delade filer\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [APSDaemon] C:\Program\Delade filer\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [ATICCC] C:\Program\ATI Technologies\ATI.ACE\cli.exe (ATI Technologies Inc.)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
O4 - HKLM..\Run: [Genväg till egenskapssida för High Definition Audio] C:\WINDOWS\System32\HdAShCut.exe (Windows ® Server 2003 DDK provider)
O4 - HKLM..\Run: [Google Quick Search Box] C:\Program\Google\Quick Search Box\GoogleQuickSearchBox.exe (Google Inc.)
O4 - HKLM..\Run: [InCD] C:\Program\Ahead\InCD\InCD.exe (Nero AG)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\WINDOWS\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NcpBudgetGui] C:\Program\WatchGuard\Mobile VPN\NcpBudgetGui.exe ()
O4 - HKLM..\Run: [NcpMonitor] C:\Program\WatchGuard\Mobile VPN\ncpmon.exe (NCP engineering GmbH)
O4 - HKLM..\Run: [NcpPopup] C:\Program\WatchGuard\Mobile VPN\ncppopup.exe ()
O4 - HKLM..\Run: [NcpRsuGui] C:\Program\WatchGuard\Mobile VPN\rwsrsu.exe ()
O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [Net iD] C:\Program\Net iD\iid.exe (SecMaker AB)
O4 - HKLM..\Run: [OpwareSE2] C:\Program\ScanSoft\OmniPageSE2.0\OpwareSE2.exe (ScanSoft, Inc.)
O4 - HKLM..\Run: [SMSERIAL] C:\WINDOWS\sm56hlpr.exe (Motorola Inc.)
O4 - HKU\S-1-5-21-725345543-1547161642-682003330-1004..\Run: [NBJ] C:\Program\Ahead\Nero BackItUp\NBJ.exe (Ahead Software AG)
O4 - Startup: C:\Documents and Settings\agare\Start-meny\Program\Autostart\Adobe Gamma.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start-meny\Program\Autostart\Logitech SetPoint.lnk = C:\Program\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start-meny\Program\Autostart\Nike+ Utility.lnk = C:\Program\Nike+ Utility\Nike+ Utility.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-725345543-1547161642-682003330-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-725345543-1547161642-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-725345543-1547161642-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-725345543-1547161642-682003330-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: E&xportera till Microsoft Excel - C:\Program\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Easy-WebPrint Add To Print List - C:\Program\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint High Speed Print - C:\Program\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Preview - C:\Program\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Easy-WebPrint Print - C:\Program\Canon\Easy-WebPrint\Resource.dll ()
O8 - Extra context menu item: Ski&cka till OneNote - C:\Program\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Skicka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Ski&cka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Länkade &anteckningar - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Länkade &anteckningar - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.micr.../OGAControl.cab (Office Genuine Advantage Validation Tool)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.micr...heckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {19D6A3D5-EA50-4C3B-88F0-79627C325570} https://www.one.com/...ImageUpload.dll (IlosoftMultipleImageCtrl Class)
O16 - DPF: {3195CF7C-E9E2-49B2-8B61-14F285298E1C} https://outside.comh...lientLoader.cab (Access Client web loader)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.micros...b?1250792942406 (WUWebControl Class)
O16 - DPF: {7ECB1A47-6647-4B2C-A8DA-675569C9FF15} http://www.fujidirek...geUploader7.cab (Image Uploader Control)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9A596260-169D-462F-92C0-EA1504C2796B}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program\Delade filer\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program\Delade filer\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program\Delade filer\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program\Delade filer\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program\Delade filer\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program\Delade filer\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\Delade filer\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program\Delade filer\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program\delade filer\logishrd\bluetooth\LBTWlgn.dll) - c:\Program\Delade filer\Logishrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop Components:0 (Min aktuella startsida) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\agare\Lokala inställningar\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\agare\Lokala inställningar\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009-08-20 19:49:39 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Error creating restore point.

========== Files/Folders - Created Within 30 Days ==========

[2012-04-14 07:58:16 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\agare\Skrivbord\OTL.exe
[2012-04-14 07:50:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\agare\Skrivbord\RK_Quarantine
[2012-04-10 20:39:59 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2012-04-10 20:39:38 | 000,000,000 | --SD | C] -- C:\ComboFix
[2012-04-09 07:48:40 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2012-04-08 21:53:55 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2012-04-08 21:53:55 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2012-04-08 21:53:55 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2012-04-08 21:53:55 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2012-04-08 21:53:04 | 004,452,952 | R--- | C] (Swearware) -- C:\Documents and Settings\agare\Skrivbord\ComboFix.exe
[27 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012-04-14 11:47:02 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012-04-14 11:44:39 | 000,466,970 | ---- | M] () -- C:\WINDOWS\System32\perfh01D.dat
[2012-04-14 11:44:39 | 000,444,864 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012-04-14 11:44:39 | 000,093,566 | ---- | M] () -- C:\WINDOWS\System32\perfc01D.dat
[2012-04-14 11:44:39 | 000,072,740 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012-04-14 11:43:00 | 000,000,970 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012-04-14 07:58:26 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\agare\Skrivbord\OTL.exe
[2012-04-14 07:49:19 | 001,262,080 | ---- | M] () -- C:\Documents and Settings\agare\Skrivbord\RogueKiller.exe
[2012-04-14 07:36:08 | 000,000,966 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012-04-14 07:35:34 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2012-04-09 07:46:13 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2012-04-08 21:53:04 | 004,452,952 | R--- | M] (Swearware) -- C:\Documents and Settings\agare\Skrivbord\ComboFix.exe
[27 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012-04-14 07:49:14 | 001,262,080 | ---- | C] () -- C:\Documents and Settings\agare\Skrivbord\RogueKiller.exe
[2012-04-08 21:53:55 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2012-04-08 21:53:55 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2012-04-08 21:53:55 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2012-04-08 21:53:55 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2012-04-08 21:53:55 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2012-02-14 21:39:30 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012-01-23 23:51:39 | 000,000,272 | ---- | C] () -- C:\Documents and Settings\agare\Application Data\.backup.dm
[2011-07-15 23:25:02 | 000,014,232 | ---- | C] () -- C:\WINDOWS\System32\sh4native.exe
[2011-04-06 20:24:10 | 000,071,253 | ---- | C] () -- C:\WINDOWS\Huawei ModemsUninstall.exe
[2011-04-06 20:24:09 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\drivers\mdvrmng.sys
[2010-11-17 22:30:40 | 000,000,040 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\.zreglib
[2010-07-29 22:16:03 | 002,301,088 | ---- | C] () -- C:\Documents and Settings\LocalService\Lokala inställningar\Application Data\FontCache3.0.0.0.dat
[2010-06-23 15:42:31 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat

========== LOP Check ==========

[2009-11-29 10:32:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\02. Caroline\Application Data\Agency9
[2011-04-19 09:25:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\02. Caroline\Application Data\Birdstep Technology
[2010-01-14 22:20:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\02. Caroline\Application Data\Canon
[2011-02-28 21:07:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\02. Caroline\Application Data\GARMIN
[2010-02-08 12:31:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\02. Caroline\Application Data\iid
[2011-05-12 20:19:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\02. Caroline\Application Data\imeshbandmltbpi
[2011-05-12 20:20:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\02. Caroline\Application Data\mediabarim
[2010-09-20 19:06:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\02. Caroline\Application Data\Red Kawa
[2009-11-26 10:21:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\02. Caroline\Application Data\ScanSoft
[2011-08-19 20:45:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\02. Caroline\Application Data\Spotify
[2009-08-26 20:31:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\02. Caroline\Application Data\Windows Desktop Search
[2010-09-18 16:07:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\02. Caroline\Application Data\Windows Search
[2011-08-19 16:33:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\03. Lucas\Application Data\iid
[2011-08-19 16:33:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\03. Lucas\Application Data\Windows Desktop Search
[2011-09-20 17:34:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\03. Lucas\Application Data\Windows Search
[2010-03-07 20:48:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\agare\Application Data\Agency9
[2012-02-06 21:59:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\agare\Application Data\Azureus
[2011-04-06 20:25:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\agare\Application Data\Birdstep Technology
[2010-12-28 22:21:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\agare\Application Data\Canon
[2011-07-25 22:46:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\agare\Application Data\DTencryptor-F
[2011-07-12 21:29:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\agare\Application Data\GARMIN
[2010-02-11 21:48:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\agare\Application Data\iid
[2011-05-07 07:39:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\agare\Application Data\imeshbandmltbpi
[2009-12-28 22:56:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\agare\Application Data\Leadertech
[2009-08-25 00:38:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\agare\Application Data\Opera
[2011-01-29 16:30:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\agare\Application Data\Red Kawa
[2009-08-24 22:49:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\agare\Application Data\ScanSoft
[2012-01-15 20:25:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\agare\Application Data\Spotify
[2009-11-19 23:11:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\agare\Application Data\SystemRequirementsLab
[2011-02-27 20:49:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\agare\Application Data\Tific
[2011-07-16 00:52:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\agare\Application Data\TuneUpMedia
[2009-08-20 21:30:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\agare\Application Data\Windows Desktop Search
[2009-08-21 12:18:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\agare\Application Data\Windows Search
[2010-07-29 08:22:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Alwil Software
[2011-04-06 20:25:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Birdstep Technology
[2009-08-29 13:33:08 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
[2011-12-07 08:24:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ClubSanDisk
[2010-09-08 19:55:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\espionServerData
[2012-02-06 22:22:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\iF05800DpAiE05800
[2011-10-19 20:06:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Marathon
[2009-11-14 13:39:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft
[2010-11-17 22:30:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SlySoft
[2009-11-14 13:38:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir
[2009-12-29 22:58:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SSScanWizard
[2011-07-16 00:52:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TuneUpMedia
[2010-04-12 21:16:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009-09-16 21:02:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009-08-24 22:37:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2008-04-14 18:05:06 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=74BB7DCD2BFDCC0E52869DB3582CA781 -- C:\WINDOWS\ERDNT\cache\explorer.exe
[2008-04-14 18:05:06 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=74BB7DCD2BFDCC0E52869DB3582CA781 -- C:\WINDOWS\explorer.exe
[2008-04-14 18:05:06 | 001,034,240 | ---- | M] (Microsoft Corporation) MD5=74BB7DCD2BFDCC0E52869DB3582CA781 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2004-08-04 14:00:00 | 001,032,704 | ---- | M] (Microsoft Corporation) MD5=87A3C8EAD27CF3591713D629D8BCB990 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe

< MD5 for: SVCHOST.EXE >
[2004-08-04 14:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=22D8A75754B7B9ECC4753E3C09A56B18 -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe
[2012-01-13 15:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program\Malwarebytes' Anti-Malware\Chameleon\svchost.exe
[2008-04-14 18:05:21 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=6CCEF19D7301D9861F90E299C798AD3F -- C:\WINDOWS\ERDNT\cache\svchost.exe
[2008-04-14 18:05:21 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=6CCEF19D7301D9861F90E299C798AD3F -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008-04-14 18:05:21 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=6CCEF19D7301D9861F90E299C798AD3F -- C:\WINDOWS\system32\svchost.exe

< MD5 for: USERINIT.EXE >
[2008-04-14 18:05:22 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=317799A2E42B5EA048A8A70F482CBA9F -- C:\WINDOWS\ERDNT\cache\userinit.exe
[2008-04-14 18:05:22 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=317799A2E42B5EA048A8A70F482CBA9F -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008-04-14 18:05:22 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=317799A2E42B5EA048A8A70F482CBA9F -- C:\WINDOWS\system32\userinit.exe
[2004-08-04 14:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=452202227D7A5020D058D49106C0B872 -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe

< MD5 for: WINLOGON.EXE >
[2004-08-04 14:00:00 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=3E080D3D4F81B0638766CCC4D7707D10 -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2012-01-13 15:53:20 | 000,182,856 | ---- | M] () MD5=63EEC8A8B221AB79045E776E5F592868 -- C:\Program\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2008-04-14 18:05:23 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ABD2D070BE76A9386A0A283A332E3862 -- C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008-04-14 18:05:23 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ABD2D070BE76A9386A0A283A332E3862 -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008-04-14 18:05:23 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ABD2D070BE76A9386A0A283A332E3862 -- C:\WINDOWS\system32\winlogon.exe

< C:\Windows\assembly\tmp\U\*.* /s >

< %Temp%\smtmp\1\*.* >

< %Temp%\smtmp\2\*.* >

< %Temp%\smtmp\3\*.* >

< %Temp%\smtmp\4\*.* >

< type c:\diskreport.txt /c >
Microsoft DiskPart version 5.1.3565
Copyright © 1999-2003 Microsoft Corporation.
Dator: 40BD2BEB73DD4B3
Volymnr. Enh Etikett Fils. Typ Storlek Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
Volym 0 E DVD-ROM 0 B
Volym 1 C Disc 1 NTFS Partition 93 GB Felfri System
Volym 2 D Disc 2 NTFS Partition 93 GB Felfri

< End of report >

Bifogade filer

•  Extras.Txt (47,59Kb)
  Antal nedladdningar: 2

[Cecilia]

På sidan http://www.virustotal.com klickar du på Choose File -knappen och klistrar in ett av följande filnamn i fältet "Filnamn", klicka på Öppna och sedan på Scan it!. Om det kommer upp en fråga om filen ska analyseras om så välj det alternativet. Vänta tills resultatet är klart. Klistra in länken (webbadressen) till resultatet här. Upprepa med nästa filnamn.
C:\windows\System32\appmgmts.dll
C:\windows\System32\Ias.dll
C:\windows\System32\Iprip.dll
C:\windows\System32\NWCWorkstation.dll
C:\windows\System32\Nwsapagent.dll
C:\windows\System32\WmdmPmSp.dll

[Daniel1001]

Får svaret att ingen av dessa filer finns när jag försöker öppna med hjälp av dina adresser. Har även letat i mappen System32.

Kan jag möjligtvis göra något fel.

mvh
Daniel

[Cecilia]

Nej, du gör nog inget fel.

Starta MBAM och ta fram fliken Loggar. Leta reda på den logg som innehåller:

Citat

Malewarebytes upptäckte en trojan som jag valde att läsa om och enligt den sidan rekommenderades en sökning med Spyhunter.

Det bör ju vara någon gång i början av februari. Kopiera innehållet i hela loggen och klistra in den i ditt svar.

Har du bytt lösenord till hotmail och Linkedin?

[Daniel1001]

När jag letar efter loggen hitar jag ingen log som pekar på en infektion?!?! Loggen som kördes 30 minuter innan mitt första inlägg ser ut enligt följande:

Malwarebytes Anti-Malware 1.60.1.1000

Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Databasversion: v2012.02.06.04

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
agare :: 40BD2BEB73DD4B3 [begränsad]

Skydd: Aktiverad

2012-02-06 22:50:21
mbam-log-2012-02-06 (22-50-21).txt

Skanningstyp: Snabbskanning
Aktiverade skanningsalternativ: Minne | Start | Register | Filsystem | Heuristik/Extra | Heuristik/Shuriken | PUP | PUM
Inaktiverade skanningsalternativ: P2P
Antal skannade objekt: 209242
Förfluten tid: 7 minut(er), 15 sekund(er)

Upptäckta minnesprocesser: 0
(Inga skadliga poster hittades)

Upptäckta minnesmoduler: 0
(Inga skadliga poster hittades)

Upptäckta registernycklar: 0
(Inga skadliga poster hittades)

Upptäckta registervärden: 0
(Inga skadliga poster hittades)

Upptäckta registerdataposter: 0
(Inga skadliga poster hittades)

Upptäckta mappar: 0
(Inga skadliga poster hittades)

Upptäckta filer: 0
(Inga skadliga poster hittades)

(klar)

MBAM har just nu en fil i karantän, Affiliate.Downloader som upptäcktes den 8/4. Bifogar även denna logg.

2012/04/08 21:41:33 +0200 40BD2BEB73DD4B3 agare MESSAGE Starting protection

2012/04/08 21:41:33 +0200 40BD2BEB73DD4B3 agare MESSAGE Starting protection
2012/04/08 21:41:52 +0200 40BD2BEB73DD4B3 agare MESSAGE Protection started successfully
2012/04/08 21:41:55 +0200 40BD2BEB73DD4B3 agare MESSAGE Starting IP protection
2012/04/08 21:42:01 +0200 40BD2BEB73DD4B3 agare MESSAGE IP Protection started successfully
2012/04/08 21:49:05 +0200 40BD2BEB73DD4B3 agare MESSAGE Stopping IP protection
2012/04/08 21:49:05 +0200 40BD2BEB73DD4B3 agare MESSAGE IP Protection stopped
2012/04/08 23:04:44 +0200 40BD2BEB73DD4B3 agare MESSAGE Starting protection
2012/04/08 23:05:01 +0200 40BD2BEB73DD4B3 agare MESSAGE Protection started successfully
2012/04/08 23:05:04 +0200 40BD2BEB73DD4B3 agare MESSAGE Starting IP protection
2012/04/08 23:05:10 +0200 40BD2BEB73DD4B3 agare MESSAGE IP Protection started successfully
2012/04/08 23:13:45 +0200 40BD2BEB73DD4B3 agare MESSAGE Stopping IP protection
2012/04/08 23:13:45 +0200 40BD2BEB73DD4B3 agare MESSAGE IP Protection stopped
2012/04/08 23:43:11 +0200 40BD2BEB73DD4B3 agare MESSAGE Starting protection
2012/04/08 23:43:28 +0200 40BD2BEB73DD4B3 agare MESSAGE Protection started successfully
2012/04/08 23:43:31 +0200 40BD2BEB73DD4B3 agare MESSAGE Starting IP protection
2012/04/08 23:43:36 +0200 40BD2BEB73DD4B3 agare MESSAGE IP Protection started successfully
2012/04/08 23:55:41 +0200 40BD2BEB73DD4B3 agare DETECTION C:\Documents and Settings\agare\Mina dokument\Hämtade filer\DownloadSetup.exe Affiliate.Downloader QUARANTINE
2012/04/08 23:55:41 +0200 40BD2BEB73DD4B3 agare DETECTION C:\Documents and Settings\agare\Mina dokument\Hämtade filer\DownloadSetup.exe Affiliate.Downloader DENY
2012/04/08 23:56:39 +0200 40BD2BEB73DD4B3 agare MESSAGE Starting database refresh
2012/04/08 23:56:39 +0200 40BD2BEB73DD4B3 agare MESSAGE Stopping IP protection
2012/04/08 23:56:39 +0200 40BD2BEB73DD4B3 agare MESSAGE IP Protection stopped
2012/04/08 23:56:47 +0200 40BD2BEB73DD4B3 agare MESSAGE Database refreshed successfully
2012/04/08 23:56:47 +0200 40BD2BEB73DD4B3 agare MESSAGE Starting IP protection
2012/04/08 23:56:55 +0200 40BD2BEB73DD4B3 agare MESSAGE IP Protection started successfully

När det gäller lösenord på Hotmail så ändrade jag det samma dag som spammet gick ut. Separerade även Hotmail och Linked in från varandra.

mvh
Daniel

[Cecilia]

Kan du hitta någon jestertb.dll i datorn? I vilken mapp?

Citat

- Trojan.Downloader.Tracur.X (iExplorer.exe)
- UnknownRootkit (HDAShCut.exe)
- Atlas DMT (4st bl.a. ANON.9VMNIKLO.txt)

iexplorer.exe = Internet Explorer
hdashcut.exe = en fil som hör ihop med ljudet i datorn
.txt = textfiler, mycket sällsynt att sådana skulle vara skadliga

Skanna datorn online på http://www.eset.com/onlinescan/
För att inte skannern ska ta för lång tid på sig stäng av ditt antivirusprogram under tiden.

Avbocka alternativet Remove found threats
Bocka för Scan Archives

Klicka på Advanced Settings
Bocka för:
Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology

Klicka på Scan

När skanningen är klar skapas loggfilen C:\Program\Eset\Eset Online Scanner\log.txt. Öppna den i Anteckningar och klistra sedan in innehållet i ditt svar.

[Daniel1001]

Hej, den första filen finns och det ser ut som den är i karantän.

Filnamn: jestertb.dll.vir

Mapp: C:\Qoobox\Quarantine\C\WINDOWS

ESET online scan säger att det finns 8 infekterade filer, se log nedan.

ESETSmartInstaller@High as CAB hook log:

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=9a566d8295771c408149c73768970af7
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-04-15 10:42:26
# local_time=2012-04-15 12:42:26 (+0100, Västeuropa, sommartid)
# country="Sweden"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=768 16777215 100 0 53751564 53751564 0 0
# compatibility_mode=8192 67108863 100 0 256 256 0 0
# scanned=117993
# found=8
# cleaned=0
# scan_time=6804
C:\Documents and Settings\02. Caroline\Mina dokument\Hämtade filer\videora-ipod-600-setup.exe Win32/OpenCandy application (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\agare\Mina dokument\Hämtade filer\setup-ltr1237.exe a variant of Win32/1AntiVirus application (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\agare\Mina dokument\Hämtade filer\videora-ipad-600-setup(2).exe Win32/OpenCandy application (unable to clean) 00000000000000000000000000000000 I
C:\Documents and Settings\agare\Mina dokument\Hämtade filer\videora-ipad-600-setup.exe Win32/OpenCandy application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{111FC2B3-30FE-4922-9252-E54799C29EFE}\RP382\A0126708.exe Win32/Adware.SystemSecurity.AI application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{111FC2B3-30FE-4922-9252-E54799C29EFE}\RP384\A0126861.sys Win32/Adware.SpywareCease application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{111FC2B3-30FE-4922-9252-E54799C29EFE}\RP384\A0126866.dll Win32/Adware.SpywareCease.AA application (unable to clean) 00000000000000000000000000000000 I
C:\System Volume Information\_restore{111FC2B3-30FE-4922-9252-E54799C29EFE}\RP384\A0126869.exe a variant of Win32/Adware.SpywareCease.AA application (unable to clean) 00000000000000000000000000000000 I

[Cecilia]

C:\Qoobox\Quarantine är ComboFix karantän så den filen är omhändertagen.

Det som Eset hittade och som ligger i Mina dokument\Hämtade filer kan du ju ta bort själv. C:\System Volume Information\_restore kommer att fixas innan vi är klara.

Så vitt jag kan se från loggar är datorn ren. Tycker du att datorn uppför sig normalt?

I Firefox har du ett tillägg som heter Vuze Remote Community Toolbar. Det bör avinstalleras pga det som står på http://www.systemloo...te_Toolbar.html . Avinstallationen gör du i Firefox - Verktyg - Tillägg.

Stäng av alla program du ser inklusive antivirusprogram och antispionprogram så att de inte krockar med OTL.
Hur? Se http://www.bleepingc...opic114351.html

Starta programmet OTL (i Vista/Windows7 högerklicka och välj Kör som administratör).
Kopiera alla raderna i rutan:

:Services
kwwalpgr
esgiguard
:OTL
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\agare\LOKALA~1\Temp\kwwalpgr.sys -- (kwwalpgr)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program\Enigma Software Group\SpyHunter\esgiguard.sys -- (esgiguard)
[2011-08-17 19:54:12 | 000,000,000 | ---D | M] (Vuze Remote Community Toolbar) -- C:\Documents and Settings\agare\Application Data\Mozilla\Firefox\ProfilesO2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program\Java\jre6\bin\jp2ssv.dll File not found
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab (Reg Error: Key error.)
:commands
[CREATERESTOREPOINT]
[EMPTYFLASH]
[EMPTYJAVA]
[reboot]

Klistra in dem i rutan Custom Scans/Fixes. Kontrollera att det ser exakt likadant ut, t ex när det gäller radbrytningar.
Tryck på Run Fix.
Om du blir tillfrågad om att starta om datorn så gör det.
Det kommer upp en logg i Anteckningar. Kopiera den och klistra in i ditt svar.

Om den inte kommer automatiskt så hittar du den i mappen c:\_OTL\Moved Files med ett namn som innehåller dagens datum och klockslaget för körningen.

Se till att aktivera antivirusprogram mm innan du ansluter datorn till internet.

Ta bort mappen C:\Program\Enigma Software Group.

[Daniel1001]

Hej,

har tagit bort de filer som låg under Hämtade filer och avinstallerat/tagit bort Vuze remote.

Behöver jag göra något med filen i C:\Qoobox\Quarantine?

Här kommer loggen från OTL.

========== SERVICES/DRIVERS ==========

========== SERVICES/DRIVERS ==========
Service kwwalpgr stopped successfully!
Service kwwalpgr deleted successfully!
Service esgiguard stopped successfully!
Service esgiguard deleted successfully!
========== OTL ==========
Error: No service named kwwalpgr was found to stop!
Service\Driver key kwwalpgr not found.
File C:\DOCUME~1\agare\LOKALA~1\Temp\kwwalpgr.sys not found.
Error: No service named esgiguard was found to stop!
Service\Driver key esgiguard not found.
File C:\Program\Enigma Software Group\SpyHunter\esgiguard.sys not found.
Folder C:\Documents and Settings\agare\Application Data\Mozilla\Firefox\ProfilesO2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program\Java\jre6\bin\jp2ssv.dll File not found\ not found.
Starting removal of ActiveX control {E2883E8F-472F-4FB0-9522-AC9BF37916A7}
C:\WINDOWS\Downloaded Program Files\gp.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E2883E8F-472F-4FB0-9522-AC9BF37916A7}\ not found.
========== COMMANDS ==========
Restore point Set: OTL Restore Point (0)

[EMPTYFLASH]

User: 02. Caroline
->Flash cache emptied: 11552 bytes

User: 03. Lucas
->Flash cache emptied: 978 bytes

User: agare
->Flash cache emptied: 1536 bytes

User: All Users

User: Default User

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0,00 mb


[EMPTYJAVA]

User: 02. Caroline
->Java cache emptied: 61857006 bytes

User: 03. Lucas
->Java cache emptied: 0 bytes

User: agare
->Java cache emptied: 69452814 bytes

User: All Users

User: Default User

User: LocalService

User: NetworkService

Total Java Files Cleaned = 125,00 mb


OTL by OldTimer - Version 3.2.39.2 log created on 04152012_223944

En liten fråga mitt i alltihopa. När det gäller antivirusprogram etc, skall man satsa på ett av de mer välkända betalversionerna typ Mcfee eller Norton eller är det helt OK med gratisverionerna av Avast eller dylikt?

Tusen tack!

mvh
Daniel

[Cecilia]

Ingen orsak!

C:\Qoobox\Quarantine kommer att tas bort i samband med att ComboFix avinstalleras när allt är klart.

McAfee har inte fått så bra resultat i de flesta tester senaste året. Ett köpt "Internet Security"-paket är normalt mer heltäckande än de gratis antivirusprogrammen, men det är ju bara du som kan avgöra hur försiktig du är med datorn.

Kör DDS och klistra in DDS.txt för en sista koll.

[Daniel1001]

Här kommer DDS.txt.

mvh
Daniel

.

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by agare at 20:03:20 on 2012-04-16
Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.2046.1189 [GMT 2:00]
.
AV: Norton 360 *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
FW: Norton 360 *Enabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program\Ahead\InCD\InCDsrv.exe
svchost.exe
svchost.exe
C:\Program\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
C:\Program\Delade filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program\Bonjour\mDNSResponder.exe
svchost.exe
C:\Program\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program\Delade filer\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program\WatchGuard\Mobile VPN\ncpclcfg.exe
C:\Program\WatchGuard\Mobile VPN\ncprwsnt.exe
C:\Program\WatchGuard\Mobile VPN\ncpsec.exe
C:\Program\PortWise\Access Client\AccessClient-Service.exe
C:\Program\WatchGuard\Mobile VPN\rwsrsu.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\sm56hlpr.exe
C:\Program\Google\Quick Search Box\GoogleQuickSearchBox.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program\Ahead\InCD\InCD.exe
C:\Program\Adobe\Photoshop Elements 4.0\apdproxy.exe
C:\Program\CyberLink\PowerDVD\PDVDServ.exe
C:\Program\WatchGuard\Mobile VPN\NcpBudgetGui.exe
C:\Program\WatchGuard\Mobile VPN\ncpmon.exe
C:\Program\WatchGuard\Mobile VPN\rwsrsu.exe
C:\Program\Net iD\iid.exe
C:\Program\iTunes\iTunesHelper.exe
C:\Program\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program\Skype\Phone\Skype.exe
C:\Program\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\Logitech\SetPoint\SetPoint.exe
C:\Program\Nike+ Utility\Nike+ Utility.exe
C:\Program\Windows Desktop Search\WindowsSearch.exe
C:\Program\Delade filer\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program\ATI Technologies\ATI.ACE\cli.exe
C:\Program\ATI Technologies\ATI.ACE\cli.exe
C:\Program\Google\Common\Google Updater\GoogleUpdaterService.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.se/
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program\delade filer\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program\alwil software\avast5\aswWebRepIE.dll
BHO: Windows Live inloggningshjälpen: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program\delade filer\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program\google\googletoolbarnotifier\5.7.7227.1100\swg.dll
BHO: Office Document Cache Handler: {b4f3a835-0e21-4959-ba22-42b3008e02ff} - c:\program\micros~3\office14\URLREDIR.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll
TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program\canon\easy-webprint\Toolband.dll
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program\alwil software\avast5\aswWebRepIE.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program\google\google toolbar\GoogleToolbar_32.dll
uRun: [Skype] "c:\program\skype\\phone\Skype.exe" /nosplash /minimized
uRun: [NBJ] "c:\program\ahead\nero backitup\NBJ.exe"
uRun: [swg] "c:\program\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [Genväg till egenskapssida för High Definition Audio] HDAShCut.exe
mRun: [ATICCC] "c:\program\ati technologies\ati.ace\cli.exe" runtime -Delay
mRun: [SMSERIAL] sm56hlpr.exe
mRun: [Google Quick Search Box] "c:\program\google\quick search box\GoogleQuickSearchBox.exe" /autorun
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [OpwareSE2] "c:\program\scansoft\omnipagese2.0\OpwareSE2.exe"
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [InCD] c:\program\ahead\incd\InCD.exe
mRun: [Adobe Photo Downloader] "c:\program\adobe\photoshop elements 4.0\apdproxy.exe"
mRun: [RemoteControl] c:\program\cyberlink\powerdvd\PDVDServ.exe
mRun: [Adobe Reader Speed Launcher] "c:\program\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [NcpBudgetGui] "c:\program\watchguard\mobile vpn\NcpBudgetGui.exe" -start
mRun: [NcpPopup] "c:\program\watchguard\mobile vpn\ncppopup.exe" noerrmsg
mRun: [NcpMonitor] "c:\program\watchguard\mobile vpn\ncpmon.exe" autorun
mRun: [NcpRsuGui] "c:\program\watchguard\mobile vpn\rwsrsu.exe" -gui
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [AppleSyncNotifier] c:\program\delade filer\apple\mobile device support\AppleSyncNotifier.exe
mRun: [Net iD] "c:\program\net id\iid.exe"
mRun: [QuickTime Task] "c:\program\quicktime\qttask.exe" -atboottime
mRun: [APSDaemon] "c:\program\delade filer\apple\apple application support\APSDaemon.exe"
mRun: [iTunesHelper] "c:\program\itunes\iTunesHelper.exe"
mRun: [Malwarebytes' Anti-Malware] "c:\program\malwarebytes' anti-malware\mbamgui.exe" /starttray
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\agare\start-~1\program\autost~1\adobeg~1.lnk - c:\program\delade filer\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\logite~1.lnk - c:\program\logitech\setpoint\SetPoint.exe
StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\nike_u~1.lnk - c:\program\nike+ utility\Nike+ Utility.exe
StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\window~1.lnk - c:\program\windows desktop search\WindowsSearch.exe
IE: E&xportera till Microsoft Excel - c:\program\micros~3\office14\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program\canon\easy-webprint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program\canon\easy-webprint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program\canon\easy-webprint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program\canon\easy-webprint\Resource.dll/RC_Print.html
IE: Ski&cka till OneNote - c:\program\micros~3\office14\ONBttnIE.dll/105
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program\microsoft office\office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program\microsoft office\office14\ONBttnIELinkedNotes.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\program\micros~3\office11\REFIEBAR.DLL
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {19D6A3D5-EA50-4C3B-88F0-79627C325570} - hxxps://www.one.com/static/controls/IlosoftMultipleImageUpload.dll
DPF: {3195CF7C-E9E2-49B2-8B61-14F285298E1C} - hxxps://outside.comhem.com/wa/AccessClientLoader.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1250792942406
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {7ECB1A47-6647-4B2C-A8DA-675569C9FF15} - hxxp://www.fujidirekt.se/asp/_upload/activex/ImageUploader7.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{9A596260-169D-462F-92C0-EA1504C2796B} : DhcpNameServer = 192.168.1.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program\delade~1\skype\SKYPE4~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
Notify: LBTWlgn - c:\program\delade filer\logishrd\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program\windows desktop search\MSNLNamespaceMgr.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\agare\application data\mozilla\firefox\profiles\33cdtdca.default\
FF - plugin: c:\program\canon\zoombrowser ex\program\NPCIG.dll
FF - plugin: c:\program\google\update\1.3.21.111\npGoogleUpdate3.dll
FF - plugin: c:\program\micros~3\office14\NPAUTHZ.DLL
FF - plugin: c:\program\micros~3\office14\NPSPWRAP.DLL
FF - plugin: c:\program\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program\mozilla firefox\plugins\npdjvu.dll
FF - plugin: c:\program\mozilla firefox\plugins\npiidplg.dll
FF - plugin: c:\program\mozilla firefox\plugins\npOGAPlugin.dll
.
============= SERVICES / DRIVERS ===============
.
R1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2011-7-15 612184]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2009-8-24 337880]
R1 waclient;Portwise Access Client Driver;c:\windows\system32\drivers\waclient.sys [2009-10-11 39552]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-8-24 20696]
R2 avast! Antivirus;avast! Antivirus;c:\program\alwil software\avast5\AvastSvc.exe [2010-7-29 44768]
R2 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2009-12-28 10384]
R2 MBAMService;MBAMService;c:\program\malwarebytes' anti-malware\mbamservice.exe [2009-8-24 652360]
R2 ncpclcfg;ncpclcfg;c:\program\watchguard\mobile vpn\ncpclcfg.exe [2009-11-16 86016]
R2 ncprwsnt;ncprwsnt;c:\program\watchguard\mobile vpn\NCPRWSNT.EXE [2009-11-16 1065480]
R2 NcpSec;NcpSec;c:\program\watchguard\mobile vpn\NCPSEC.EXE [2009-11-16 32768]
R2 pwClientService;PortWise Client Service;c:\program\portwise\access client\AccessClient-Service.exe [2011-4-26 177392]
R2 rwsrsu;RwsRsu;c:\program\watchguard\mobile vpn\rwsrsu.exe [2009-11-16 850432]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-8-24 20464]
R3 NcpFiltMP;NcpFiltMP;c:\windows\system32\drivers\ncpvaxp.sys [2009-11-16 79528]
S2 gupdate;Tjänsten Google Update (gupdate);c:\program\google\update\GoogleUpdate.exe [2010-2-11 135664]
S3 gupdatem;Tjänsten Google Update (gupdatem);c:\program\google\update\GoogleUpdate.exe [2010-2-11 135664]
S3 libusb0;LibUsb-Win32 - Kernel Driver 07/07/2009, 0.1.12.2;c:\windows\system32\drivers\libusb0.sys [2011-5-4 28160]
S3 MosIrUsb;MosIrUsb.sys;c:\windows\system32\drivers\MosIrUsb.sys [2004-4-14 20736]
S3 NcpFilt;Ncp Filter Service;c:\windows\system32\drivers\ncpvaxp.sys [2009-11-16 79528]
S3 ncpvaxp;NCP Secure Client Virtual Adapter Driver;c:\windows\system32\drivers\ncpvaxp.sys [2009-11-16 79528]
S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [2010-6-29 18432]
S3 osppsvc;Office Software Protection Platform;c:\program\delade filer\microsoft shared\officesoftwareprotectionplatform\OSPPSVC.EXE [2010-1-9 4640000]
.
=============== Created Last 30 ================
.
2012-04-15 20:39:44 -------- d-----w- C:\_OTL
2012-04-15 08:44:48 -------- d-----w- c:\program\ESET
2012-04-10 18:39:38 -------- d-s---w- C:\ComboFix
2012-04-08 19:53:55 98816 ----a-w- c:\windows\sed.exe
2012-04-08 19:53:55 518144 ----a-w- c:\windows\SWREG.exe
2012-04-08 19:53:55 256000 ----a-w- c:\windows\PEV.exe
2012-04-08 19:53:55 208896 ----a-w- c:\windows\MBR.exe
.
==================== Find3M ====================
.
2012-03-07 00:15:19 41184 ----a-w- c:\windows\avastSS.scr
2012-03-07 00:03:51 612184 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-03-01 10:59:55 916992 ----a-w- c:\windows\system32\wininet.dll
2012-03-01 10:59:55 43520 ----a-w- c:\windows\system32\licmgr10.dll
2012-03-01 10:59:55 1469440 ------w- c:\windows\system32\inetcpl.cpl
2012-02-29 14:10:28 177664 ----a-w- c:\windows\system32\wintrust.dll
2012-02-29 14:10:28 148480 ----a-w- c:\windows\system32\imagehlp.dll
2012-02-29 12:17:53 385024 ----a-w- c:\windows\system32\html.iec
2012-02-14 10:09:44 1070352 ----a-w- c:\windows\system32\MSCOMCTL.OCX
2012-02-06 18:45:59 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-03 09:57:40 1860096 ----a-w- c:\windows\system32\win32k.sys
.
============= FINISH: 20:06:20,53 ===============

[Cecilia]

Verkar allt bra med datorn nu?
För i så fall är dags för mig att ge dig anvisningar för att ta bort alla dessa specialprogram du har laddat ner.

Det är rester kvar av Norton i säkerhetscentret:
AV: Norton 360 *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
Du kan få bort det på följande vis:

Start - Kör
Skriv in
wbemtest
och tryck sedan på OK
När programmet kommer upp så gör du som i det här bildspelet med fem bilder:
http://img.photobuck...AV_From_WMI.gif
Det vill säga:
Connect
root\SecurityCenter
Query
SELECT * FROM AntivirusProduct
Apply
Markera numret som hör ihop med Norton enligt raden en bit upp.
Delete
Starta om datorn

[Daniel1001]

Hej igen!

Ja datorn känns bra. Har tagit bort Norton enligt din beskrivnig.Redo att fortsätta bortplockandet!

mvh
Daniel

[Cecilia]

Hej!

Nu återstår bara en sista städomgång:

1. Tryck Windows-tangenten + R
Kopiera och klistra in denna rad:
ComboFix /Uninstall

Observera att det är ett mellanrum före /
Klicka på OK.

Ovanstående kommer att avinstallera ComboFix och ta bort gamla systemåterställningspunkter (C:\System Volume Information\_restore) som kan vara infekterade.

2. Starta OTL.
Tryck på knappen CleanUp! och det m.fl. rensningsprogram kommer att avinstalleras efter en omstart av datorn. Om något sådant program är kvar efter det så fråga hur du ska ta bort det. Ta bort eventuella loggar.

3. Spara TFC (Temporary File Cleaner) av OldTimer på Skrivbordet.
http://oldtimer.geekstogo.com/TFC.exe

Stäng alla program och fönster.
Kör TFC (om du har Vista eller Windows 7 så högerklicka på filen och välj Kör som administratör).
Klicka på Start-knappen för att starta städningen.
Det kan ta några minuter och låt datorn vara ifred under tiden.

När det är klart är det meningen att datorn ska startas om automatiskt. Om den inte gör det så startar du om datorn själv. Ta bort TFC-filen.

4. Byt alla lösenord som du använder i datorn och på internet eftersom dessa kan ha kommit i orätta händer.
http://mnin.blogspot...iggersyzor.html beskriver ett skadligt program som spionerar genom att ta skärmbilder, logga tangentbordsnedtryckningar och läsa lösenord som är lagrade i webbläsare, epostprogram etc.

5. Förbättra skyddet i datorn, se mina Råd för en säkrare dator: http://ceciliasec.wordpress.com/rad/