Winstall (msn virus)

28 november, 2006

Jag har fått ett virus från msn som heter Winstall. Kan någon hjälpa mig att ta bort de?

29 november, 2006

Ladda hem och installera gratisversionen av SUPERAntiSpyware Free Edition:

http://www.superantispyware.com/download.html

Starta programmet, klicka på Check for updates.

Avsluta programmet när uppdateringen är klar.

Starta om datorn i felsäkert läge (tryck F8 upprepade gånger under uppstarten och välj felsäkert läge i menyn).

Starta SUPERAntiSpyware och klicka på Scan your Computer.

Bocka för alla hårddiskar (fixed drive/disk).

Välj Perform complete scan

Nästa/Next

När skanningen är klar som kommer det upp en sammanfattning, tryck på OK

Nästa/Next

Utför eller liknande

Ett fönster med Quarantine and removal Complete kommer upp

OK

Utför eller liknande

Avsluta programmet.

Starta om i normalt läge.

Starta programmet, tryck på Preferences, välj filken Statistics/Logs

Dubbelklicka på den nyaste SUPERAntiSpyware Scan Log så att loggen kommer upp i Anteckningar.

Klistra in loggen i ditt svar.

Ladda ner HijackThis:

http://www.thespykiller.co.uk/files/HJTsetup.exe

Installera, kör, skanna och spara loggen (inget annat).

Klistra in loggen i ditt svar.

I ditt svar gör du så här när du har klistrat in en logg:

Markera (måla) hela loggen och tryck sedan på LOG-knappen i Besvara-fönstret.

29 november, 2006

SUPERAntiSpyware Scan Log

Generated 11/29/2006 at 05:32 PM

Application Version : 3.3.1020

Core Rules Database Version : 3107

Trace Rules Database Version: 1133

Scan type : Complete Scan

Total Scan Time : 00:46:47

Memory items scanned : 171

Memory threats detected : 0

Registry items scanned : 4468

Registry threats detected : 15

File items scanned : 36837

File threats detected : 127

Adware.IPWins

[ipWins] C:\PROGRAM\IPWINS\IPWINS.EXE

C:\PROGRAM\IPWINS\IPWINS.EXE

HKU\S-1-5-21-299502267-1580818891-839522115-1007\Software\IpWins

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IpWins

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IpWins#DisplayName

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IpWins#UninstallString

C:\Program\ipwins\popA.tmp

C:\Program\ipwins\Services.dll

C:\Program\ipwins\Uninst.exe

C:\Program\ipwins

C:\WINDOWS\Prefetch\IPWINS.EXE-2B63173B.pf

Worm.Sober Variant

[Poss] C:\WINDOWS\DOBE~1\SPOOLSV.EXE

C:\WINDOWS\DOBE~1\SPOOLSV.EXE

C:\WINDOWS\Prefetch\SPOOLSV.EXE-1E418DC7.pf

Adware.Tracking Cookie

C:\Documents and Settings\Joppe\Cookies\joppe@viator.122.2o7[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@fastclick[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@go.drivecleaner[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@revenue[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@mediaplex[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@1071982361[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@adbrite[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@ad.cibleclick[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@ads.exitexchange[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@advertising[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@oc[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@1066230470[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@adopt.hbmediapro[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@free-counter[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@burstnet[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@track.adform[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@cgi-bin[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@tradedoubler[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@usenext[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@ads.itv[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@1071364750[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@1072273079[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@888[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@stats.fotbollsbiljetter[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@www.burstnet[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@ad1.emediate[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@kanoodle[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@mb[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@ad1.emediate[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@clicktorrent[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@cgi-bin[3].txt

C:\Documents and Settings\Joppe\Cookies\joppe@www.soundclick[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@media.fastclick[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@ads.managerzone[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@drivecleaner[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@www.drivecleaner[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@1072707600[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@mb[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@1070818065[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@90594700[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@adtech[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@m1.webstats4u[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@xiti[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@ad.adtoma[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@cassava[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@indextools[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@rotator.adjuggler[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@toplist[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@doubleclick[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@atdmt[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@ad.yieldmanager[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@exitexchange[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@belnk[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@ad.zanox[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@tripod.lycos[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@data3.perf.overture[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@publishers.clickbooth[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@dist.belnk[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@revsci[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@msnportal.112.2o7[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@tacoda[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@ads.tripod.spray[1].txt

C:\Documents and Settings\Joppe\Cookies\joppe@server.cpmstar[2].txt

C:\Documents and Settings\Gäst\Cookies\gäst@ad.adtoma[1].txt

C:\Documents and Settings\Gäst\Cookies\gäst@ad1.emediate[2].txt

C:\Documents and Settings\Gäst\Cookies\gäst@ad1.emediate[3].txt

C:\Documents and Settings\Gäst\Cookies\gäst@ads.managerzone[1].txt

C:\Documents and Settings\Gäst\Cookies\gäst@adtech[2].txt

C:\Documents and Settings\Gäst\Cookies\gäst@advertising[1].txt

C:\Documents and Settings\Gäst\Cookies\gäst@atdmt[1].txt

C:\Documents and Settings\Gäst\Cookies\gäst@doubleclick[1].txt

C:\Documents and Settings\Gäst\Cookies\gäst@tradedoubler[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@ad.adtoma[1].txt

C:\Documents and Settings\jocke\Cookies\jocke@ad.yieldmanager[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@ad.zanox[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@ad1.emediate[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@ad1.emediate[3].txt

C:\Documents and Settings\jocke\Cookies\jocke@adecn[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@adopt.hbmediapro[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@adultfriendfinder[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@belnk[1].txt

C:\Documents and Settings\jocke\Cookies\jocke@burstnet[1].txt

C:\Documents and Settings\jocke\Cookies\jocke@clicks.jackpot[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@cts.metricsdirect[1].txt

C:\Documents and Settings\jocke\Cookies\jocke@discountrealitysites[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@dist.belnk[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@eztracks.aavalue[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@focalex[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@interclick[1].txt

C:\Documents and Settings\jocke\Cookies\jocke@m1.webstats4u[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@optimost[1].txt

C:\Documents and Settings\jocke\Cookies\jocke@qnsr[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@revsci[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@rotator.adjuggler[1].txt

C:\Documents and Settings\jocke\Cookies\jocke@server.cpmstar[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@smileycentral[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@soundclick[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@starware[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@stat.www[1].txt

C:\Documents and Settings\jocke\Cookies\jocke@superstats[1].txt

C:\Documents and Settings\jocke\Cookies\jocke@tacoda[1].txt

C:\Documents and Settings\jocke\Cookies\jocke@track.adform[1].txt

C:\Documents and Settings\jocke\Cookies\jocke@webpower[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@www.burstbeacon[1].txt

C:\Documents and Settings\jocke\Cookies\jocke@www.screensavers[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@yadro[2].txt

C:\Documents and Settings\jocke\Cookies\jocke@yieldmanager[2].txt

C:\Documents and Settings\Joppe\Cookies\joppe@track[1].txt

Adware.Avenue Media/Internet Optimizer

HKU\S-1-5-21-299502267-1580818891-839522115-1007\Software\Microsoft\Internet Explorer\URLSearchHooks#_{CFBFAE00-17A6-11D0-99CB-00C04FD64497}

Adware.Toolbar888

HKCR\Interface\{C6F2214E-0B54-45A9-B90D-7DD4BA45ED0B}

HKCR\Interface\{C6F2214E-0B54-45A9-B90D-7DD4BA45ED0B}\ProxyStubClsid

HKCR\Interface\{C6F2214E-0B54-45A9-B90D-7DD4BA45ED0B}\ProxyStubClsid32

HKCR\Interface\{C6F2214E-0B54-45A9-B90D-7DD4BA45ED0B}\TypeLib

HKCR\Interface\{C6F2214E-0B54-45A9-B90D-7DD4BA45ED0B}\TypeLib#Version

Adware.ClickSpring/Yazzle

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yazzle1122Oin

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yazzle1122Oin#DisplayName

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Yazzle1122Oin#UninstallString

C:\PROGRAM\DELADE FILER\YAZZLE1122OINADMIN.EXE

C:\PROGRAM\DELADE FILER\YAZZLE1122OINUNINSTALLER.EXE

Adware.180solutions/Search Assistant

C:\DOCUMENTS AND SETTINGS\JOCKE\LOKALA INSTäLLNINGAR\TEMP\RES9C.TMP

C:\DOCUMENTS AND SETTINGS\JOCKE\LOKALA INSTäLLNINGAR\TEMP\RESC3.TMP

Trojan.Freeprod

C:\DOCUMENTS AND SETTINGS\JOPPE\LOKALA INSTäLLNINGAR\TEMP\MC-110-12-0001411.EXE

C:\DOCUMENTS AND SETTINGS\JOPPE\LOKALA INSTäLLNINGAR\TEMPORARY INTERNET FILES\CONTENT.IE5\AIYT85Q0\MCCBNEW[1].EXE

C:\DOCUMENTS AND SETTINGS\JOPPE\LOKALA INSTäLLNINGAR\TEMPORARY INTERNET FILES\CONTENT.IE5\AON6J6VR\INSTALL[1].EXE

C:\DOCUMENTS AND SETTINGS\JOPPE\MCNEW.EXE

Adware.ClickSpring

C:\Documents and Settings\Joppe\Mina dokument\CURITY~1\SANREG~1.EXE

C:\WINDOWS\SYSTEM32\ILK.DLL

Trojan.Unknown Origin

C:\WINDOWS\SYSTEM32\WNSTSCC.EXE

29 november, 2006

Från HijackThis..

[log]Logfile of HijackThis v1.99.1

Scan saved at 18:49:06, on 2006-11-29

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program\D-Link\AirPlus G\AirGCFG.exe

C:\Program\ANI\ANIWZCS2 Service\WZCSLDR2.exe

C:\Program\Hewlett-Packard\Digital Imaging\Unload\hpqcmon.exe

C:\Program\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

C:\Program\QuickTime\qttask.exe

C:\Program\ScanSoft\OmniPageSE2.0\OpwareSE2.exe

C:\Documents and Settings\Joppe\Skrivbord\winstall.exe

C:\Program\Delade filer\{B80688FA-06B0-1053-0620-02041002002e}\Update.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\MSN Messenger\msnmsgr.exe

C:\Program\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program\Delade filer\Microsoft Shared\Works Shared\wkcalrem.exe

C:\Program\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program\Internet Explorer\iexplore.exe

C:\Program\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.managerzone.se/

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

R3 - URLSearchHook: (no name) - {D4621137-83FE-FD54-DEA6-D728967130BE} - C:\WINDOWS\system32\ilk.dll (file missing)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program\google\googletoolbar2.dll

O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\sv\msntb.dll

O2 - BHO: (no name) - {D4621137-83FE-FD54-DEA6-D728967130BE} - C:\WINDOWS\system32\ilk.dll (file missing)

O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\sv\msntb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program\google\googletoolbar2.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program\Canon\Easy-WebPrint\Toolband.dll

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [WorksFUD] C:\Program\Microsoft Works\wkfud.exe

O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program\Microsoft Works\WksSb.exe /AllUsers

O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program\Microsoft Works\WkDetect.exe

O4 - HKLM\..\Run: [Generic Host Process8 System Backup] scvhost8.exe

O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program\D-Link\AirPlus G\AirGCFG.exe

O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program\ANI\ANIWZCS2 Service\WZCSLDR2.exe

O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program\Logitech\Video\ISStart.exe

O4 - HKLM\..\Run: [CamMonitor] C:\Program\Hewlett-Packard\Digital Imaging\\Unload\hpqcmon.exe

O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] C:\Program\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [OpwareSE2] "C:\Program\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"

O4 - HKLM\..\Run: [OPSE reminder] "C:\Program\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"

O4 - HKLM\..\Run: [explorer] C:\Documents and Settings\Joppe\Skrivbord\winstall.exe

O4 - HKLM\..\RunServices: [Generic Host Process8 System Backup] scvhost8.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [steam] "c:\program\steam\steam.exe" -silent

O4 - HKCU\..\Run: [updateMgr] "C:\Program\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1

O4 - HKCU\..\Run: [Jmsjojbi] C:\Documents and Settings\Joppe\Mina dokument\??curity\s?anregw.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: Påminnelser för Kalendern i Microsoft Works.lnk = ?

O8 - Extra context menu item: &Google Search - res://c:\program\google\GoogleToolbar2.dll/cmsearch.html

O8 - Extra context menu item: &Translate English Word - res://c:\program\google\GoogleToolbar2.dll/cmwordtrans.html

O8 - Extra context menu item: Backward Links - res://c:\program\google\GoogleToolbar2.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program\google\GoogleToolbar2.dll/cmcache.html

O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~3\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O8 - Extra context menu item: Similar Pages - res://c:\program\google\GoogleToolbar2.dll/cmsimilar.html

O8 - Extra context menu item: Translate Page into English - res://c:\program\google\GoogleToolbar2.dll/cmtrans.html

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by14fd.bay14.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {E055C02E-6258-40FF-80A7-3BDA52FACAD7} - http://activex.matcash.com/speedtest2.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Program\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe (file missing)

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

[/log]

Tack:)

29 november, 2006

När du har klistrat in en logg så markerar (målar) du hela loggen och så trycker du på LOG-knappen som finns på samma rad som :thumbsdown: :thumbsup: så blir folk glada när de inte behöver skrolla så mycket.

Bland annat finns det spionprogrammet PurityScan i loggen. Vi börjar med att åtgärda den.

Ladda ner http://www.mvps.org/winhelp2002/hosts.zip till Skrivbordet.

Packa upp filen. En ny mapp Hosts skapas på Skrivbordet.

Dubbelklicka på mappen för att öppna den.

Dubbelklicka på filen mvps.bat för att starta programmet.

Detta program kommer att byta ut datorns Hosts-fil så att PurityScan-otrevligheten förhindras komma i kontakt med sin skapare. Det kommer också förhindra att du kan besöka sidor som är ökända för att installera otrevligheter på datorn. Du kan läsa mer om det här:

http://www.mvps.org/winhelp2002/hosts.htm

Kontrollpanelen - Lägg till eller ta bort program

Om något av följande finns i listan så ta bort:

Oin

Yazzle by Oin

Purityscan by Oin

Snowballwars by Oin

eller något liknande med Oin eller Outerinfo i sig.

Zolero

Tizzletalk

MediaTickets

Cowabanga

Ladda ner och kör avinstallationsprogrammet

http://www.outerinfo.com/OiUninstaller.exe

Om du behöver anvisningar så finns de här: http://www.outerinfo.com/howto.html

Starta om datorn.

Ladda ner ComboFix:

http://download.bleepingcomputer.com/sUBs/combofix.exe

Kör den och följ anvisningarna som visas.

VIKTIGT! Klicka inte på Combofix-fönstret med musen när den körs annars kan den hänga upp sig.

När den är färdig så ska en logg komma upp, klistra in den här, samt en ny HijackThis-logg.

Jag tittar på loggarna i morgon.

30 november, 2006

[log]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]

"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]

"Generic Host Process8 System Backup"="scvhost8.exe"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]

"DeskHtmlVersion"=dword:00000110

"DeskHtmlMinorVersion"=dword:00000005

"Settings"=dword:00000001

"GeneralFlags"=dword:00000005

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]

"Source"="About:Home"

"SubscribedURL"="About:Home"

"FriendlyName"="Min aktuella startsida"

"Flags"=dword:00000002

"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00, 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00

"CurrentState"=hex:04,00,00,40

"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff, ff,ff,04,00,00,00

"RestoredStateInfo"=hex:18,00,00,00,12,03,00,00,23,00,00,00,dc,00,00,00,d2,00, 00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]

"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

"Generic Host Process8 System Backup"="scvhost8.exe"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]

"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"

"Generic Host Process8 System Backup"="scvhost8.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]

"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"

"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]

"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"dontdisplaylastusername"=dword:00000000

"legalnoticecaption"=""

"legalnoticetext"=""

"shutdownwithoutlogon"=dword:00000001

"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]

"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]

"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"

"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"

"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"

"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="ctfmon"

"hkey"="HKCU"

"command"="C:\\WINDOWS\\System32\\ctfmon.exe"

"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="msmsgs"

"hkey"="HKCU"

"command"="\"C:\\Program\\Messenger\\msmsgs.exe\" /background"

"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="RUNDLL32"

"hkey"="HKLM"

"command"="RUNDLL32.EXE NvQTwk,NvCplDaemon initialize"

"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="nwiz"

"hkey"="HKLM"

"command"="nwiz.exe /install"

"inimapping"="0"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 06-11-30 16:23:13.59

C:\ComboFix.txt ... 06-11-30 16:23

C:\ComboFix2.txt ... 06-11-29 19:43[/log]

30 november, 2006

Hijackthis:

[log]Logfile of HijackThis v1.99.1

Scan saved at 16:25:25, on 2006-11-30