MSN-Virus

11 december, 2007

[log]Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:46:17, on 2007-12-11

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program\Analog Devices\Core\smax4pnp.exe

C:\Program\Analog Devices\SoundMAX\Smax4.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

C:\Program\QuickTime\QTTask.exe

C:\Program\Delade filer\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\MSN Messenger\MsnMsgr.Exe

D:\Program\Microsoft ActiveSync\wcescomm.exe

C:\Program\SUPERAntiSpyware\SUPERAntiSpyware.exe

D:\Program\MICROS~1\rapimgr.exe

C:\Program\Mozilla Firefox\firefox.exe

C:\WINDOWS\explorer.exe

C:\Program\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.se/

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.se/0SESVSE/SAOS01?FORM=TOOLBR

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Delade filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\Windows Live Toolbar\msntb.dll

O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [soundMAX] "C:\Program\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKLM\..\Run: [cctray] "D:\Program\CA\CA Internet Security Suite\cctray\cctray.exe"

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [iTunesHelper] "D:\Program\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program\Delade filer\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [unlockerAssistant] "C:\Program\Unlocker\UnlockerAssistant.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [steam] "d:\valve\steam\steam.exe" -silent

O4 - HKCU\..\Run: [H/PC Connection Agent] "D:\Program\Microsoft ActiveSync\wcescomm.exe"

O4 - HKCU\..\Run: [DAEMON Tools] "D:\Program\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: Registration .LNK = D:\Valve\Steam\SteamApps\NiForInteVeta\Dark Messiah of Might and Magic\RegistrationReminder.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe

O8 - Extra context menu item: &Windows Live Search - res://C:\Program\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: E&xportera till Microsoft Excel - res://D:\Program\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Öppna på ny flik i bakgrunden - res://C:\Program\Windows Live Toolbar\Components\sv-se\msntabres.dll.mui/229?39a911e3a526465faff1d5047ede6ec5

O8 - Extra context menu item: Öppna på ny flik i förgrunden - res://C:\Program\Windows Live Toolbar\Components\sv-se\msntabres.dll.mui/230?39a911e3a526465faff1d5047ede6ec5

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - D:\Program\MICROS~1\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\Program\MICROS~1\INetRepl.dll

O9 - Extra 'Tools' menuitem: Skapa mobilfavorit ... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - D:\Program\MICROS~1\INetRepl.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O16 - DPF: {0B79F48A-E8D6-11DB-9283-E25056D89593} (F-Secure Online Scanner 3.1) - http://support.f-secure.com/ols/fscax.cab

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase4009.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O20 - Winlogon Notify: !SASWinLogon - C:\Program\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program\Delade filer\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: CaCCProvSP - CA, Inc. - D:\Program\CA\CA Internet Security Suite\ccprovsp.exe

O23 - Service: iPod Service - Unknown owner - C:\Program\iPod\bin\iPodService.exe (file missing)

O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - Unknown owner - C:\Program\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PPCtlPriv - Unknown owner - D:\Program\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe (file missing)

--

End of file - 8397 bytes[/log]

Så, nu får ni undersöka

11 december, 2007

Släng den Combofix du har och ladda ner den igen + kör och skicka loggen som kommer ut.

11 december, 2007

[log]ComboFix 07-12-09.1 - Gustav Karlsson 2007-12-11 17:28:50.3 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1053.18.1407 [GMT 1:00]

Running from: C:\Documents and Settings\Gustav Karlsson\Skrivbord\ComboFix.exe

.

((((((((((((((((((((((((( Files Created from 2007-11-11 to 2007-12-11 )))))))))))))))))))))))))))))))

.

2007-12-11 16:36 . 2007-12-11 16:36 <KAT> d-------- C:\Program\Trend Micro

2007-12-11 16:28 . 2007-12-11 16:28 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com

2007-12-10 22:09 . 2007-12-10 22:09 <KAT> d-------- C:\Program\Lavasoft

2007-12-10 22:09 . 2007-12-10 22:09 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft

2007-12-10 19:57 . 2005-09-23 08:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll

2007-12-10 19:36 . 2007-12-10 19:36 152,708 --a------ C:\WINDOWS\sirtottempale.exe.zip

2007-12-10 19:36 . 2007-12-10 19:36 152,706 --a------ C:\WINDOWS\smarterchild.exe.zip

2007-12-10 19:36 . 2007-12-10 19:35 152,698 --a------ C:\WINDOWS\fordedge.exe.zip

2007-12-10 19:35 . 2007-12-10 19:36 152,708 --a------ C:\WINDOWS\pic0382.zip

2007-12-10 19:35 . 2007-12-10 19:35 152,700 --a------ C:\WINDOWS\lellie_93.exe.zip

2007-12-10 19:35 . 2007-12-10 19:35 152,700 --a------ C:\WINDOWS\hampusgvg.exe.zip

2007-12-10 19:12 . 2007-12-11 16:28 <KAT> d-------- C:\Program\SUPERAntiSpyware

2007-12-10 19:12 . 2007-12-10 19:12 <KAT> d-------- C:\Documents and Settings\Gustav Karlsson\Application Data\SUPERAntiSpyware.com

2007-12-09 21:47 . 2007-12-09 21:47 <KAT> d-------- C:\WINDOWS\system32\config\systemprofile\Lokala instõllningar

2007-12-09 21:47 . 2007-12-09 21:47 <KAT> d-------- C:\Documents and Settings\NetworkService\Lokala instõllningar

2007-12-09 21:47 . 2007-12-09 21:47 <KAT> d-------- C:\Documents and Settings\LocalService\Lokala instõllningar

2007-12-09 21:47 . 2007-12-09 21:47 <KAT> d-------- C:\Documents and Settings\Gustav Karlsson\Lokala instõllningar

2007-12-09 21:47 . 2007-12-09 21:47 <KAT> d-------- C:\Documents and Settings\Default User\Lokala instõllningar

2007-12-09 19:40 . 2007-12-09 19:40 0 --a------ C:\23990098.$$$

2007-12-09 18:05 . 2007-12-09 18:05 <KAT> d-------- C:\Kaspersky

2007-12-08 18:08 . 2007-12-08 18:08 <KAT> d-------- C:\Documents and Settings\Gustav Karlsson\Application Data\AltrixSoft

2007-12-07 21:55 . 2007-12-07 21:58 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help

2007-12-07 17:51 . 2006-01-01 01:04 10,027 --a------ C:\WINDOWS\system32\mspriv32.dll

2007-12-03 18:48 . 1997-08-26 12:06 315,904 --a------ C:\WINDOWS\IsUninst.exe

2007-12-01 17:18 . 2007-12-01 17:18 <KAT> d-------- C:\Program\GetTubeVideo

2007-11-26 17:06 . 2007-12-01 17:21 <KAT> d-------- C:\Program\YouTube Downloader

2007-11-26 16:41 . 2007-11-26 16:41 3 ---h----- C:\WINDOWS\system32\YT11

2007-11-26 16:40 . 1999-08-27 19:53 184,320 --a------ C:\WINDOWS\system32\ARFrmExt.ocx

2007-11-26 16:40 . 2001-06-26 21:35 131,072 --a------ C:\WINDOWS\system32\ARButton.ocx

2007-11-26 16:40 . 2000-07-15 06:00 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL

2007-11-26 16:40 . 2001-02-24 00:12 102,400 --a------ C:\WINDOWS\system32\MRActLabel.ocx

2007-11-26 16:40 . 2007-02-15 01:29 81,920 --a------ C:\WINDOWS\system32\GkSui20.EXE

2007-11-26 16:40 . 2001-06-26 21:10 69,632 --a------ C:\WINDOWS\system32\ARFlatButton.ocx

2007-11-24 13:59 . 2007-11-24 14:27 <KAT> d-------- C:\Program\WMR11

2007-11-23 18:39 . 2007-11-23 18:39 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll

2007-11-21 19:52 . 2007-11-21 19:52 <KAT> d-------- C:\WINDOWS\MetaCreations

2007-11-21 19:46 . 1997-04-08 20:08 299,520 --a------ C:\WINDOWS\uninst.exe

2007-11-13 10:27 . 2007-11-13 10:46 <KAT> d-------- C:\Program\Resco

2007-11-13 10:27 . 2005-08-24 16:18 70,656 --a------ C:\WINDOWS\RSetupCE.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-12-11 16:28 --------- d-----w C:\Documents and Settings\Gustav Karlsson\Application Data\uTorrent

2007-12-11 15:28 --------- d-----w C:\Program\Delade filer\InstallShield

2007-12-11 14:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab

2007-12-10 21:13 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys

2007-12-10 21:13 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys

2007-12-10 19:08 --------- d--h--w C:\Program\InstallShield Installation Information

2007-12-10 18:12 --------- d-----w C:\Program\Delade filer\Wise Installation Wizard

2007-12-09 11:47 --------- d-----w C:\Documents and Settings\Gustav Karlsson\Application Data\dvdcss

2007-12-07 15:29 118,784 ----a-w C:\WINDOWS\Web\Wallpaper\talkin_message.exe

2007-12-07 15:29 118,784 ----a-w C:\WINDOWS\Web\Wallpaper\summerofficeboard.exe

2007-12-07 15:28 --------- d-----w C:\Program\EasyDVDConverter

2007-12-02 14:50 --------- d-----w C:\Program\Windows Live Safety Center

2007-11-30 16:41 --------- d-----w C:\Program\Windows Live Toolbar

2007-11-07 18:43 --------- d-----w C:\Program\Connective Tools

2007-11-06 16:39 --------- d-----w C:\Program\Dealio

2007-10-23 13:11 --------- d-----w C:\Program\Handbrake

2007-10-23 12:03 --------- d-----w C:\Program\Boilsoft MOV Converter

2007-10-22 18:50 --------- d-----w C:\Documents and Settings\Gustav Karlsson\Application Data\OTVREG

2007-10-21 12:45 --------- d-----w C:\Documents and Settings\Gustav Karlsson\Application Data\TVU Networks

2007-10-16 15:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files

2007-10-16 15:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\fssg

2007-10-16 14:40 81,984 ----a-w C:\WINDOWS\system32\bdod.bin

2007-07-24 15:34 47,360 ----a-w C:\Documents and Settings\Gustav Karlsson\Application Data\pcouffin.sys

2007-04-07 13:18 1 ----a-w C:\Documents and Settings\Gustav Karlsson\SI.bin

2006-06-23 06:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe

2006-05-03 09:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll

2007-07-24 08:09 10,856 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys

2007-02-21 10:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll

.

((((((((((((((((((((((((((((( snapshot@2007-12-09_21.43.04.43 )))))))))))))))))))))))))))))))))))))))))

.

+ 2007-12-10 18:12:58 29,696 ----a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF11.exe

+ 2007-12-10 18:12:58 18,944 ----a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe

+ 2007-12-10 18:12:58 65,024 ----a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe

+ 2007-12-10 21:09:26 1,038,336 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC.exe

+ 2007-12-10 21:09:26 178,688 ----a-r C:\WINDOWS\Installer\{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}\Icon0E6AB9FC1.exe

- 2007-12-07 22:26:41 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat

+ 2007-12-10 15:38:14 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat

- 2007-12-07 22:26:41 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Lokala inställningar\Temporary Internet Files\Content.IE5\index.dat

+ 2007-12-10 15:38:14 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Lokala inställningar\Temporary Internet Files\Content.IE5\index.dat

- 2007-12-07 22:26:41 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Lokala inställningar\Tidigare\History.IE5\index.dat

+ 2007-12-10 15:38:14 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Lokala inställningar\Tidigare\History.IE5\index.dat

+ 2007-06-04 14:14:56 6,272 ----a-w C:\WINDOWS\system32\drivers\AWRTPD.sys

+ 2007-04-13 14:19:52 7,680 ----a-w C:\WINDOWS\system32\lsdelete.exe

- 2007-12-01 19:19:50 66,988 ----a-w C:\WINDOWS\system32\perfc009.dat

+ 2007-12-11 16:01:41 66,988 ----a-w C:\WINDOWS\system32\perfc009.dat

- 2007-12-01 19:19:50 78,720 ----a-w C:\WINDOWS\system32\perfc01D.dat

+ 2007-12-11 16:01:41 78,720 ----a-w C:\WINDOWS\system32\perfc01D.dat

- 2007-12-01 19:19:50 412,992 ----a-w C:\WINDOWS\system32\perfh009.dat

+ 2007-12-11 16:01:41 412,992 ----a-w C:\WINDOWS\system32\perfh009.dat

- 2007-12-01 19:19:50 416,044 ----a-w C:\WINDOWS\system32\perfh01D.dat

+ 2007-12-11 16:01:41 416,044 ----a-w C:\WINDOWS\system32\perfh01D.dat

+ 2007-12-11 15:28:36 8,514,556 ----a-w C:\WINDOWS\system32\Restore\rstrlog.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-02 13:00]

"MsnMsgr"="C:\Program\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:55]

"Steam"="d:\valve\steam\steam.exe" [2007-11-30 13:31]

"H/PC Connection Agent"="D:\Program\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 14:41]

"DAEMON Tools"="D:\Program\DAEMON Tools\daemon.exe" [2006-11-12 11:48]

"SUPERAntiSpyware"="C:\Program\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"JMB36X Configure"="C:\WINDOWS\system32\JMRaidTool.exe" [2006-06-02 09:45]

"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50]

"NvCplDaemon"="RUNDLL32.exe" [2006-03-02 13:00 C:\WINDOWS\system32\rundll32.exe]

"nwiz"="nwiz.exe" [2007-04-20 05:05 C:\WINDOWS\system32\nwiz.exe]

"SoundMAXPnP"="C:\Program\Analog Devices\Core\smax4pnp.exe" [2006-05-01 11:07]

"SoundMAX"="C:\Program\Analog Devices\SoundMAX\Smax4.exe" [2006-04-10 08:19]

"cctray"="D:\Program\CA\CA Internet Security Suite\cctray\cctray.exe" [2007-03-13 13:58]

"NvMediaCenter"="RUNDLL32.exe" [2006-03-02 13:00 C:\WINDOWS\system32\rundll32.exe]

"Adobe Photo Downloader"="C:\Program\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 10:09]

"Adobe Reader Speed Launcher"="C:\Program\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]

"iTunesHelper"="D:\Program\iTunes\iTunesHelper.exe" [2007-06-28 08:14]

"QuickTime Task"="C:\Program\QuickTime\QTTask.exe" [2007-06-29 05:24]

"TkBellExe"="C:\Program\Delade filer\Real\Update_OB\realsched.exe" [2007-08-15 11:07]

"UnlockerAssistant"="C:\Program\Unlocker\UnlockerAssistant.exe" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-03-02 13:00]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

C:\Program\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program\SUPERAntiSpyware\SASWINLO.dll

R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);C:\WINDOWS\system32\drivers\sfdrv01a.sys

S3 PPCtlPriv;PPCtlPriv;"D:\Program\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe"

S3 Razerlow;Razer Copperhead Driver;C:\WINDOWS\system32\Drivers\Razerlow.sys

S3 uisp;Freescale USB JW32 driver;C:\WINDOWS\system32\Drivers\usbicp.sys

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{878E8032-B97A-5919-3505-9BEFF0793AB0}]

C:\WINDOWS:msnmsgrrr.exe

.

Contents of the 'Scheduled Tasks' folder

"2007-09-19 10:12:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"

- C:\Program\Apple Software Update\SoftwareUpdate.exe

"2007-12-11 15:47:00 C:\WINDOWS\Tasks\Kontrollera uppdateringar för Windows Live Toolbar.job"

- C:\Program\Windows Live Toolbar\MSNTBUP.EXE

.

**************************************************************************

catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-12-11 17:29:16

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2007-12-11 17:29:32

C:\ComboFix2.txt ... 2007-12-11 16:35

C:\ComboFix3.txt ... 2007-12-09 21:47

.

--- E O F ---[/log]

Nöjd? x)

11 december, 2007

[log]Kopiera alla rader nedan

File::

C:\WINDOWS\sirtottempale.exe.zip

C:\WINDOWS\smarterchild.exe.zip

C:\WINDOWS\fordedge.exe.zip

C:\WINDOWS\pic0382.zip

C:\WINDOWS\lellie_93.exe.zip

C:\WINDOWS\hampusgvg.exe.zip

C:\WINDOWS\msnmsgrrr.exe

och klistra in i notepad.

Spara den på Skrivbordet med namn CFScript

Sen dra CFScript med musen i Combofix och kör den.

Skicka loggen som kommer ut och en ny Hijack log.[/log]

11 december, 2007

ComFix:

[log]ComboFix 07-12-09.1 - Gustav Karlsson 2007-12-11 19:13:46.4 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1053.18.1553 [GMT 1:00]

Running from: C:\Documents and Settings\Gustav Karlsson\Skrivbord\ComboFix.exe

Command switches used :: C:\Documents and Settings\Gustav Karlsson\Skrivbord\CFScript.txt

* Created a new restore point

FILE