Har fått trojaner i datorn!

21 juni, 2007

F-secure har gång på gång varnat mig att den har hittat trojaner i datorn. Gång på gång, tar jag bort de (bekämpar jag dem, byter de bara namn...), utan någon som helst effekt, de kommer tillbaka hela tiden...

Dessa två trojaner 'kommer fram' mest:

Trojan-Spy.Win32.VBStat.h

Trojan.Win32.Agent.aoy

Datorn går segt och det kommer olika popupper hela tiden. Vad ska jag göra, jag vill verkligen inte formatera om datorn?

21 juni, 2007

Vi kan ju se om HijackThis visar något till att börja med:

http://www.thespykiller.co.uk/files/HJTsetup.exe

Installera.

Gå till mappen C:\Program\Hijackthis (där programmet installerades) med Utforskaren eller Den här datorn och byt namn på programmet HijackThis.exe till något annat, t ex rensning.exe.

Kör, skanna och spara loggen (inget annat).

I ditt svar bifogar du HijackThis-loggen på detta sätt:

Tryck på LOG-knappen i Besvara-fönstret

Klistra in loggen

Tryck igen på LOG-knappen

22 juni, 2007

[log]Logfile of HijackThis v1.99.1

Scan saved at 18:26, on 2007-06-22

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program\Telia\TELIAS~1\backweb\7836882\Program\SERVIC~1.EXE

C:\Windows\Cpqdiag\Cpqdfwag.exe

C:\Program\Telia\Telias sakerhetstjanster\Anti-Virus\fsgk32st.exe

C:\Program\Telia\Telias sakerhetstjanster\backweb\7836882\program\fsbwsys.exe

C:\Program\Telia\Telias sakerhetstjanster\Anti-Virus\FSGK32.EXE

C:\Program\Telia\Telias sakerhetstjanster\Common\FSMA32.EXE

C:\Program\Telia\Telias sakerhetstjanster\Anti-Virus\fssm32.exe

C:\Program\Delade filer\Microsoft Shared\VS7Debug\mdm.exe

C:\Program\Telia\Telias sakerhetstjanster\Common\FSMB32.EXE

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\System32\svchost.exe

C:\Program\Telia\Telias sakerhetstjanster\Common\FCH32.EXE

C:\Program\Telia\Telias sakerhetstjanster\Common\FAMEH32.EXE

C:\Program\Telia\Telias sakerhetstjanster\Anti-Virus\fsqh.exe

C:\Program\Telia\Telias sakerhetstjanster\Anti-Virus\fsrw.exe

C:\Program\Telia\Telias sakerhetstjanster\Anti-Virus\fsav32.exe

C:\Program\Telia\Telias sakerhetstjanster\FWES\Program\fsdfwd.exe

C:\WINDOWS\Explorer.EXE

C:\Program\Analog Devices\SoundMAX\Smtray.exe

C:\Program\COMPAQ\Easy Access Button Support\StartEAK.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program\QuickTime\qttask.exe

C:\Program\Telia\Telias sakerhetstjanster\Common\FSM32.EXE

C:\Program\Compaq\Easy Access Button Support\CPQEADM.EXE

C:\Program\Compaq\EASYAC~1\BttnServ.exe

C:\Program\Java\jre1.6.0_01\bin\jusched.exe

C:\Program\Telia\TELIAS~1\ANTI-S~1\fsaw.exe

C:\Program\Delade filer\Logitech\QCDriver3\LVCOMS.EXE

C:\Program\Logitech\ImageStudio\LogiTray.exe

C:\Program\Telia\Telias sakerhetstjanster\FSGUI\fsguidll.exe

C:\WINDOWS\System32\svchost.exe

C:\Program\MouseWare\system\em_exec.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\MSN Messenger\msnmsgr.exe

C:\Palm\hotsync.exe

C:\Program\NETGEAR\WG111v2\WG111v2.exe

C:\Program\Telia\Telias sakerhetstjanster\backweb\7836882\Program\fspex.exe

C:\Program\iRotate\iRotate.exe

C:\Program\Logitech\ImageStudio\LowLight.exe

C:\Program\MSN Messenger\usnsvc.exe

C:\Program\Internet Explorer\iexplore.exe

C:\Program\Delade filer\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe

C:\Program\Hijackthis\godnatt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fuska.se/forum

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/041D/bl8.asp

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {5ADF3862-9E2E-4ad3-86F7-4510E6550CD0} - C:\WINDOWS\system32\ltpvjxjf.dll

O2 - BHO: (no name) - {6B8D0016-07E4-4D10-9FB1-67EFFF8AD754} - C:\WINDOWS\system32\ssttq.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: (no name) - {DAEF6880-C4CC-4595-8178-49313C4CCE35} - (no file)

O4 - HKLM\..\Run: [smapp] C:\Program\Analog Devices\SoundMAX\Smtray.exe

O4 - HKLM\..\Run: [CPQEASYACC] C:\Program\COMPAQ\Easy Access Button Support\StartEAK.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program\Telia\Telias sakerhetstjanster\Common\FSM32.EXE" /splash

O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program\Telia\Telias sakerhetstjanster\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW

O4 - HKLM\..\Run: [F-Secure Startup Wizard] "C:\Program\Telia\Telias sakerhetstjanster\FSGUI\FSSW.EXE" /reboot

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program\Java\jre1.6.0_01\bin\jusched.exe"

O4 - HKLM\..\Run: [LVCOMS] C:\Program\Delade filer\Logitech\QCDriver3\LVCOMS.EXE

O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program\Logitech\ImageStudio\ISStart.exe

O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program\Logitech\ImageStudio\LogiTray.exe

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [PROMon.exe] PROMon.exe

O4 - HKLM\..\Run: [uSSShReg] C:\Program\ULEADS~1\ULEADP~1\SSaver\Ussshreg.exe /r

O4 - HKLM\..\Run: [sBRegRebootCleaner] C:\Program\Sunbelt Software\CounterSpy\SBRC.exe

O4 - HKLM\..\Run: [GPLv3] rundll32.exe "C:\WINDOWS\system32\ctyaywjh.dll",realset

O4 - HKLM\..\RunServices: [CPQDFWAG] C:\Windows\Cpqdiag\CpqDfwAg.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [NBJ] "C:\Program\Ahead\Nero BackItUp\NBJ.exe"

O4 - Startup: iRotate.lnk = C:\Program\iRotate\iRotate.exe

O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: HotSync Manager.lnk = C:\Palm\hotsync.exe

O4 - Global Startup: NETGEAR WG111v2 Smart Wizard.lnk = C:\Program\NETGEAR\WG111v2\WG111v2.exe

O4 - Global Startup: Telias säkerhetstjänster.lnk = ?

O8 - Extra context menu item: &Blockera detta popup-fönster - C:\Program\Telia\Telias sakerhetstjanster\Anti-Spyware\blockpopups.htm

O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: IE-sköld - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program\Telia\Telias sakerhetstjanster\Anti-Spyware\ieshield.dll

O9 - Extra 'Tools' menuitem: IE-sköld... - {300DB664-75B5-47c0-8B45-A44ACCF73C00} - C:\Program\Telia\Telias sakerhetstjanster\Anti-Spyware\ieshield.dll

O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813

O16 - DPF: {09F1ADAC-76D8-4D0F-99A5-5C907DADB988} - http://cdn.drivecleaner.com/installdrivecleanerstart_se.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1175711040515

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

O20 - Winlogon Notify: ssttq - C:\WINDOWS\system32\ssttq.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Altiris Client Service (AClient) - Altiris, Inc. - C:\COMPAQ\ACLIENT\ACLIENT.exe

O23 - Service: Apache2 - Unknown owner - C:\Program\Apache Group\Apache2\bin\Apache.exe" -k runservice (file missing)

O23 - Service: Telias säkerhetstjänster (BackWeb Plug-in - 7836882) - BackWeb Technologies Inc. - C:\Program\Telia\TELIAS~1\backweb\7836882\Program\SERVIC~1.EXE

O23 - Service: Compaq Remote Diagnostics Enabling Agent (CpqDfwWebAgent) - Compaq Computer Corporation - C:\Windows\Cpqdiag\Cpqdfwag.exe

O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program\Telia\Telias sakerhetstjanster\Anti-Virus\fsgk32st.exe

O23 - Service: fsbwsys - F-Secure Corp. - C:\Program\Telia\Telias sakerhetstjanster\backweb\7836882\program\fsbwsys.exe

O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program\Telia\Telias sakerhetstjanster\FWES\Program\fsdfwd.exe

O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program\Telia\Telias sakerhetstjanster\Common\FSMA32.EXE

O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\Windows\System32\NMSSvc.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe[/log]

Sådär!

22 juni, 2007

Ladda ner VundoFix:

http://www.atribune.org/ccount/click.php?id=4

Starta om datorn i felsäkert läge (tryck F8 upprepade gånger under uppstarten och välj felsäkert läge i menyn).

Dubbelklicka på VundoFix.exe för att starta programmet.

När den startar igen så tryck på Scan for Vundo.

När skanningen är klar så tryck på Remove Vundo.

Svara Ja/Yes på frågan om du vill ta bort filerna.

Därefter kommer Skrivbordet att försvinna medan filerna tas bort.

När det är klart så kommer det en fråga om att din dator kommer att stängas av, tryck på OK.

Sätt igång datorn igen i normalt läge.

Om det är så att VundoFix inte kunde ta bort någon fil vid första försöket så kommer VundoFix att starta igen när datorn startas, följ i så fall beskrivningen en gång till.

Klistra in C:\vundofix.txt och en ny HijackThis-logg i ditt svar.

23 juni, 2007

Jag kan inte det, dett kommer upp nån blå ruta med texten:

*** STOP: 0x0000007E (0xC0000005, 0xF776699D, 0xF7B21C80, 0xF7B2197C)

Förlåt om koden kanske inte stämde till 100%...

Det är alstså nått fel med växlingsfilen, om ni undrar vad jag tror... Det går inte att ändra på den! Det står att det är nått fel på växlingfilen och den körs i den temporär växlingsfil.

[inlägget ändrat 2007-06-23 19:52:37 av Fusk Katten]

23 juni, 2007

Vad är det du inte kan, dvs hur långt kom du i beskrivningen?

23 juni, 2007

Jag kan inte starta i felsäkert läge, jösses, glömde jag att skriva det?!

23 juni, 2007

Se om det går i normalt läge.

Då är det nog bäst med ComboFix också.

Ladda ner ComboFix:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Kör den och följ anvisningarna som visas.

VIKTIGT! Klicka inte på Combofix-fönstret med musen när den körs annars kan den hänga upp sig.

När den är färdig så ska en logg komma upp, klistra in den här, samt en ny HijackThis-logg.

23 juni, 2007

Fick två loggar:

ComboFix.txt:

[log]"IT" - 2007-06-23 20:09:36 - ComboFix 07-06-23.5 - Service Pack 2 NTFS

Unable to gain System Privileges

(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\bwhdelgj.dll

C:\WINDOWS\system32\dchkbbnp.dll

C:\WINDOWS\system32\domqqdjd.dll

C:\WINDOWS\system32\dsluymrf.dll

C:\WINDOWS\system32\emnqqicr.dll

C:\WINDOWS\system32\flragttg.dll

C:\WINDOWS\system32\gdckdqvg.dll

C:\WINDOWS\system32\higxrqwd.dll

C:\WINDOWS\system32\idpcvysu.dll

C:\WINDOWS\system32\kgyptxow.dll

C:\WINDOWS\system32\ltpvjxjf.dll

C:\WINDOWS\system32\mkujidej.dll

C:\WINDOWS\system32\pyfxxrhg.dll

C:\WINDOWS\system32\qydayenc.dll

C:\WINDOWS\system32\taqovxtd.dll

C:\WINDOWS\system32\tsdvskfk.dll

C:\WINDOWS\system32\xvwpwuyl.dll

C:\WINDOWS\system32\qttss.bak1

C:\WINDOWS\system32\qttss.bak2

C:\WINDOWS\system32\qttss.ini

C:\WINDOWS\system32\qttss.ini2

C:\WINDOWS\system32\qttss.tmp

C:\WINDOWS\system32\jgledhwb.ini

C:\WINDOWS\system32\pnbbkhcd.ini

C:\WINDOWS\system32\djdqqmod.ini

C:\WINDOWS\system32\frmyulsd.ini

C:\WINDOWS\system32\rciqqnme.ini

C:\WINDOWS\system32\gvqdkcdg.ini

C:\WINDOWS\system32\dwqrxgih.ini

C:\WINDOWS\system32\usyvcpdi.ini

C:\WINDOWS\system32\woxtpygk.ini

C:\WINDOWS\system32\ghrxxfyp.ini

C:\WINDOWS\system32\dtxvoqat.ini

C:\WINDOWS\system32\kfksvdst.ini

C:\WINDOWS\system32\lyuwpwvx.ini

C:\WINDOWS\system32\qttss.bak1

C:\WINDOWS\system32\qttss.bak2

C:\WINDOWS\system32\qttss.ini

C:\WINDOWS\system32\qttss.ini2

C:\WINDOWS\system32\qttss.tmp

C:\WINDOWS\system32\qttss.bak1

C:\WINDOWS\system32\qttss.bak2

C:\WINDOWS\system32\qttss.ini

C:\WINDOWS\system32\qttss.ini2

C:\WINDOWS\system32\qttss.tmp

C:\WINDOWS\system32\ssttq.dll

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\components

C:\WINDOWS\system32\components\msxf.dll

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\LEGACY_NM

-------\nm

((((((((((((((((((((((((( Files Created from 2007-05-23 to 2007-06-23 )))))))))))))))))))))))))))))))

2007-06-23 20:17 268,435,456 C:\WINDOWS\system32\temppf.sys

2007-06-23 20:07 1,089,529 --a------ C:\ComboFix.exe

2007-06-22 19:22 4,628 --a------ C:\WINDOWS\system32\istjapcw.exe

2007-06-21 21:11 49,152 --a------ C:\WINDOWS\nircmd.exe

2007-06-20 14:49 <KAT> d-------- C:\tmp

2007-06-19 21:56 <KAT> d-------- C:\Program\Alwil Software

2007-06-17 19:00 <KAT> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP

2007-06-17 18:41 921,890 --a------ C:\WINDOWS\system32\cneyadyq.ini.ren

2007-06-14 16:33 887,208 --ahs---- C:\WINDOWS\system32\qttss.ini2.ren

2007-06-13 08:41 889,388 --a------ C:\WINDOWS\system32\qttss.ini.ren

2007-06-12 20:15 2,151,449 --a------ C:\WINDOWS\system32\SBSP.dat

2007-06-12 18:32 943 --a------ C:\WINDOWS\system32\SBRC.dat

2007-06-12 18:32 8,944 --a------ C:\WINDOWS\system32\SBFC.dat

2007-06-11 20:06 <KAT> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sunbelt Software

2007-06-07 19:57 <KAT> d-------- C:\WINDOWS\pss

2007-06-07 19:31 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll

2007-06-04 20:47 888,877 --a------ C:\WINDOWS\system32\qttss.bak2.ren

2007-06-03 21:38 <KAT> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy

2007-06-03 20:51 <KAT> d-------- C:\Program\Lavasoft

2007-06-03 20:51 <KAT> d-------- C:\DOCUME~1\IT\APPLIC~1\Lavasoft

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-22 13:11:22 -------- d-----w C:\Program\DOSBox-0.70

2007-06-20 12:44:27 -------- d-----r C:\Program\Blender

2007-06-20 12:37:38 -------- d--h--w C:\Program\InstallShield Installation Information

2007-05-17 18:20:58 -------- d-----w C:\DOCUME~1\IT\APPLIC~1\Arcsoft

2007-05-17 14:52:49 63,488 ----a-w C:\WINDOWS\xobglu16.dll

2007-05-17 14:52:49 1,498,942 ----a-w C:\WINDOWS\xobglu32.dll

2007-05-16 15:20:05 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll

2007-05-10 15:27:28 -------- d--h--w C:\Program\WindowsUpdate

2007-05-09 13:21:16 -------- d-----w C:\Program\Microsoft Works

2007-05-08 15:01:39 -------- d-----w C:\Program\EA Games

2007-05-03 14:58:11 41,496 -c--a-w C:\DOCUME~1\IT\APPLIC~1\GDIPFONTCACHEV1.DAT

2007-04-30 16:53:14 -------- d-----w C:\DOCUME~1\IT\APPLIC~1\Ahead

2007-04-25 14:22:55 144,896 ----a-w C:\WINDOWS\system32\schannel.dll

2007-04-24 18:12:23 -------- d-----w C:\Program\iRotate

2007-04-22 13:22:11 75,828 ----a-w C:\WINDOWS\system32\perfc01D.dat

2007-04-22 13:22:11 414,606 ----a-w C:\WINDOWS\system32\perfh01D.dat

2007-04-18 16:14:40 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll

2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll

2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll

2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll

2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll

2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll

2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll

2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe

2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll

2007-04-16 20:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll

2007-04-16 20:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll

2007-03-29 17:41:42 687,480 ----a-w C:\WINDOWS\system32\SpoonUninstall.exe

2007-03-25 15:28:58 24 ----a-w C:\WINDOWS\system32\sysogg.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]

{9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 21:33]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Smapp"="C:\Program\Analog Devices\SoundMAX\Smtray.exe" [2002-01-30 19:01]

"CPQEASYACC"="C:\Program\COMPAQ\Easy Access Button Support\StartEAK.exe" [2001-12-14 16:01]

"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 10:34 C:\WINDOWS\system32\bthprops.cpl]

"QuickTime Task"="C:\Program\QuickTime\qttask.exe" [2006-04-07 16:36]

"F-Secure Manager"="C:\Program\Telia\Telias sakerhetstjanster\Common\FSM32.exe" [2005-10-26 03:51]

"F-Secure TNB"="C:\Program\Telia\Telias sakerhetstjanster\TNB\TNBUtil.exe" [2005-07-18 16:51]

"F-Secure Startup Wizard"="C:\Program\Telia\Telias sakerhetstjanster\FSGUI\FSSW.exe" [2005-10-18 10:29]

"SunJavaUpdateSched"="C:\Program\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

"LVCOMS"="C:\Program\Delade filer\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 17:54]

"LogitechGalleryRepair"="C:\Program\Logitech\ImageStudio\ISStart.exe" [2002-12-10 18:32]

"LogitechImageStudioTray"="C:\Program\Logitech\ImageStudio\LogiTray.exe" [2002-12-10 18:31]

"Logitech Utility"="Logi_MwX.Exe" [2003-03-04 02:50 C:\WINDOWS\LOGI_MWX.EXE]

"PROMon.exe"="PROMon.exe" []

"USSShReg"="C:\Program\ULEADS~1\ULEADP~1\SSaver\Ussshreg.exe" []

"SBRegRebootCleaner"="C:\Program\Sunbelt Software\CounterSpy\SBRC.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:34]

"msnmsgr"="C:\Program\MSN Messenger\msnmsgr.exe" [2007-01-19 12:55]

"NBJ"="C:\Program\Ahead\Nero BackItUp\NBJ.exe" [2005-02-10 17:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]

"CPQDFWAG"=C:\Windows\Cpqdiag\CpqDfwAg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"DisableCAD"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"EditLevel"=0 (0x0)

"NoClose"=0 (0x0)

"NoSaveSettings"=0 (0x0)

"NoFileMenu"=0 (0x0)

"NoCommonGroups"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bthsvcs BthServ

*Newly Created Service* - NMSCFG

Contents of the 'Scheduled Tasks' folder

2007-03-30 13:20:00 C:\WINDOWS\tasks\Diskrensning.job

2004-01-16 14:23:05 C:\WINDOWS\tasks\Ny aktivitet.job

2007-06-21 16:23:08 C:\WINDOWS\tasks\Scheduled scanning task.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net

Rootkit scan 2007-06-23 20:17:48

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\BTHPORT\Parameters\Services\{00001000-0000-1000-8000-00805f9b34fb}]

[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\BTHPORT\Parameters\Services\{00001115-0000-1000-8000-00805f9b34fb}]

Completion time: 2007-06-23 20:19:49

C:\ComboFix-quarantined-files.txt ... 2007-06-23 20:19

--- E O F ---

[/log]

ComboFix-quarantined-files.txt:

[log]2006-04-24 18:13 241664 --a--c--- C:\Qoobox\Quarantine\C\WINDOWS\system32\components\msxf.dll.vir

2007-06-05 18:07 660904 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\qttss.tmp.vir

2007-06-12 19:08 263220 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ssttq.dll.vir

2007-06-12 19:11 124436 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\domqqdjd.dll.vir

2007-06-13 14:48 1978705 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\djdqqmod.ini.vir

2007-06-13 19:14 124436 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\gdckdqvg.dll.vir

2007-06-13 19:15 62516 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\mkujidej.dll.vir

2007-06-14 16:29 124436 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\xvwpwuyl.dll.vir

2007-06-14 16:29 405 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\gvqdkcdg.ini.vir

2007-06-14 16:30 465 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\lyuwpwvx.ini.vir

2007-06-14 16:35 124436 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\dsluymrf.dll.vir

2007-06-14 16:36 525 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\frmyulsd.ini.vir

2007-06-15 14:38 124436 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\taqovxtd.dll.vir

2007-06-16 15:03 921780 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\dtxvoqat.ini.vir

2007-06-17 18:41 124436 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\qydayenc.dll.vir

2007-06-18 11:54 879745 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\qttss.ini.vir

2007-06-19 19:00 124436 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\tsdvskfk.dll.vir

2007-06-19 21:17 898825 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\kfksvdst.ini.vir

2007-06-20 16:49 124436 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\dchkbbnp.dll.vir

2007-06-20 19:12 902158 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\pnbbkhcd.ini.vir

2007-06-21 18:29 124436 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\higxrqwd.dll.vir

2007-06-21 21:14 62516 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ltpvjxjf.dll.vir

2007-06-21 22:01 909030 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\dwqrxgih.ini.vir

2007-06-22 19:25 124436 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\emnqqicr.dll.vir

2007-06-22 19:25 914587 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\rciqqnme.ini.vir

2007-06-23 17:57 124436 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\bwhdelgj.dll.vir

2007-06-23 19:15 941023 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\qttss.bak1.vir

2007-06-23 19:34 124436 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\pyfxxrhg.dll.vir

2007-06-23 19:34 914527 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ghrxxfyp.ini.vir

2007-06-23 19:34 914587 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\jgledhwb.ini.vir

2007-06-23 19:40 124436 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\kgyptxow.dll.vir

2007-06-23 19:48 941120 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\qttss.bak2.vir

2007-06-23 19:49 914707 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\woxtpygk.ini.vir

2007-06-23 19:54 124436 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\idpcvysu.dll.vir

2007-06-23 20:07 914767 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\usyvcpdi.ini.vir

2007-06-23 20:09 62516 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\flragttg.dll.vir

2007-06-23 20:12 274 --a------ C:\Qoobox\Quarantine\Registry_backups\LEGACY_NM.reg.cf

2007-06-23 20:12 352 --a------ C:\Qoobox\Quarantine\Registry_backups\services_nm.reg.cf

2007-06-23 20:12 945289 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\qttss.ini2.vir

2007-06-23 20:13 51 --a------ C:\Qoobox\Quarantine\catchme.log

Lista ”ver mappar i milj”variabeln PATH

Volymens serienummer „r 3E9D-8BF6

C:\QOOBOX

\---Quarantine

| catchme.log

|

+---C

| \---WINDOWS

| \---system32

| | bwhdelgj.dll.vir

| | dchkbbnp.dll.vir

| | djdqqmod.ini.vir

| | domqqdjd.dll.vir

| | dsluymrf.dll.vir

| | dtxvoqat.ini.vir

| | dwqrxgih.ini.vir

| | emnqqicr.dll.vir

| | flragttg.dll.vir

| | frmyulsd.ini.vir

| | gdckdqvg.dll.vir

| | ghrxxfyp.ini.vir

| | gvqdkcdg.ini.vir

| | higxrqwd.dll.vir

| | idpcvysu.dll.vir

| | jgledhwb.ini.vir

| | kfksvdst.ini.vir

| | kgyptxow.dll.vir

| | ltpvjxjf.dll.vir

| | lyuwpwvx.ini.vir

| | mkujidej.dll.vir

| | pnbbkhcd.ini.vir

| | pyfxxrhg.dll.vir

| | qttss.bak1.vir

| | qttss.bak2.vir

| | qttss.ini.vir

| | qttss.ini2.vir

| | qttss.tmp.vir

| | qydayenc.dll.vir

| | rciqqnme.ini.vir

| | ssttq.dll.vir

| | taqovxtd.dll.vir

| | tsdvskfk.dll.vir

| | usyvcpdi.ini.vir

| | woxtpygk.ini.vir

| | xvwpwuyl.dll.vir

| |

| \---components

| msxf.dll.vir

|

\---Registry_backups

LEGACY_NM.reg.cf

services_nm.reg.cf[/log]

Och så HjackThis:[log]Logfile of HijackThis v1.99.1

Scan saved at 20:28:37, on 2007-06-23

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program\Telia\TELIAS~1\backweb\7836882\Program\SERVIC~1.EXE

C:\Windows\Cpqdiag\Cpqdfwag.exe

C:\Program\Telia\Telias sakerhetstjanster\Anti-Virus\fsgk32st.exe

C:\Program\Telia\Telias sakerhetstjanster\backweb\7836882\program\fsbwsys.exe

C:\Program\Telia\Telias sakerhetstjanster\Anti-Virus\FSGK32.EXE

C:\Program\Telia\Telias sakerhetstjanster\Common\FSMA32.EXE

C:\Program\Telia\Telias sakerhetstjanster\Anti-Virus\fssm32.exe

C:\Program\Telia\Telias sakerhetstjanster\Common\FSMB32.EXE

C:\Program\Delade filer\Microsoft Shared\VS7Debug\mdm.exe

C:\Windows\System32\NMSSvc.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\System32\svchost.exe

C:\Program\Telia\Telias sakerhetstjanster\Common\FCH32.EXE

C:\Program\Telia\Telias sakerhetstjanster\Common\FAMEH32.EXE

C:\Program\Telia\Telias sakerhetstjanster\Anti-Virus\fsqh.exe

C:\Program\Telia\Telias sakerhetstjanster\Anti-Virus\fsrw.exe

C:\Program\Telia\Telias sakerhetstjanster\FWES\Program\fsdfwd.exe

C:\Program\Telia\Telias sakerhetstjanster\Anti-Virus\fsav32.exe

C:\Program\Analog Devices\SoundMAX\Smtray.exe

C:\Program\COMPAQ\Easy Access Button Support\StartEAK.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program\QuickTime\qttask.exe

C:\Program\Telia\Telias sakerhetstjanster\Common\FSM32.EXE

C:\Program\Compaq\Easy Access Button Support\CPQEADM.EXE

C:\Program\Telia\TELIAS~1\ANTI-S~1\fsaw.exe

C:\Program\Compaq\EASYAC~1\BttnServ.exe

C:\Program\Java\jre1.6.0_01\bin\jusched.exe

C:\Program\Delade filer\Logitech\QCDriver3\LVCOMS.EXE

C:\Program\Telia\Telias sakerhetstjanster\FSGUI\fsguidll.exe

C:\Program\Logitech\ImageStudio\LogiTray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\MSN Messenger\msnmsgr.exe

C:\Program\MouseWare\system\em_exec.exe

C:\Program\Logitech\ImageStudio\LowLight.exe

C:\Palm\hotsync.exe

C:\Program\NETGEAR\WG111v2\WG111v2.exe

C:\Program\Telia\Telias sakerhetstjanster\backweb\7836882\Program\fspex.exe

C:\Program\iRotate\iRotate.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\explorer.exe

C:\Program\internet explorer\iexplore.exe