yahooo ?

1 januari, 2008

När jag loggar in på min Yahoo msn får jag konstiga offline meddelande från folk som jag inte känner. Jag erbjuds att klicka på olika länkar.

Jag har scannat datorn med antivirus,adwarr och sprywar utan att hitta några fel på.

Jag undrar vilka är det?hur har de fått tag på min msn? och om det är något farligt med det?

2 januari, 2008

Du ska aldrig klicka på "konstiga" okända länkar från folk du itne känner?

Som gjort för att få in en massa skräp i datorn.

Låter som massriktad spam kanske?

Du kna ju lägga upp en HijackThis logg så får vi se om din dator har något skräp?

Ladda ner HijackThis

http://www.thespykiller.co.uk/files/HJTsetup.exe

Installera, kör, skanna sedan och spara loggen.

Klistra in loggen "tryck på logknappen, klistra in, tryck på loggknappen igen" och låt oss titta på loggen.

// Gästen

Sopa alltid rent framför egen dörr

2 januari, 2008

Jag har försökt klicka på den länken men jag får istället svar:

Error 404 File Not found

Är det rätt länk?

2 januari, 2008

Här kommer det.Hopas problemet blir löst.

[log]Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 19:02:28, on 2008-01-02

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\windows\system\hpsysdrv.exe

C:\Program\USB Storage RW\shwicon.exe

C:\HP\KBD\KBD.EXE

C:\Program\Delade filer\Microsoft Shared\Works Shared\WkUFind.exe

C:\Program\Delade filer\Real\Update_OB\realsched.exe

C:\WINDOWS\System32\LVCOMSX.EXE

C:\Program\Logitech\Video\LogiTray.exe

C:\Program\iTunes\iTunesHelper.exe

C:\Program\QuickTime\qttask.exe

C:\Program\ExtraFilm Hemma\Agent.exe

C:\Program\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe

C:\Program\Windows Defender\MSASCui.exe

C:\Program\Java\jre1.6.0_03\bin\jusched.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program\Macrogaming\SweetIM\SweetIM.exe

C:\Program\Delade filer\AOL\1117210522\ee\AOLHostManager.exe

C:\Program\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe

C:\Program\Browser Sentinel\BrowserSentinel.exe

C:\Program\Real\RealPlayer\RealPlay.exe

C:\Program\Delade filer\AOL\1117210522\ee\AOLServiceHost.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\Bluetooth\Bluetooth-programvara\bin\btwdins.exe

C:\Program\Windows Media Player\WMPNSCFG.exe

C:\WINDOWS\system32\cisvc.exe

C:\Program\Bluetooth\Bluetooth-programvara\BTTray.exe

C:\Program\Hewlett-Packard\Digital Imaging\bin\hpomau08.exe

C:\WINDOWS\System32\svchost.exe

C:\Program\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\Program\Logitech\Video\FxSvr2.exe

C:\Program\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe

C:\Program\iPod\bin\iPodService.exe

C:\WINDOWS\SYSTEM32\cidaemon.exe

C:\Program\Internet Explorer\IEXPLORE.EXE

C:\Program\Delade filer\Microsoft Shared\Windows Live\WLLoginProxy.exe

C:\Program\Internet Explorer\IEXPLORE.EXE

C:\Program\Yahoo!\MESSEN~1\ymsgr_tray.exe

C:\Program\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comhem.se/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.se/0SESVSE/SAOS01?FORM=TOOLBR

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program\Yahoo!\Companion\Installs\cpn\yt.dll

R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program\Macrogaming\SweetIMBarForIE\toolbar.dll

O2 - BHO: ElnkBhoGuard Class - {00000000-0000-0000-0000-000000000002} - C:\Program\EarthLink\Toolbar\EScamBlk.dll

O2 - BHO: ElnkScamBHO Class - {15F4D456-5BAA-4076-8486-EECB38CD3E57} - C:\Program\EarthLink\Toolbar\EScamBlk.dll

O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\Program\MACROG~1\SWEETI~1\toolbar.dll

O2 - BHO: ElnkPubBHO Class - {512ACF1B-64D9-4928-B382-A80556F28DB4} - C:\Program\EarthLink\Toolbar\ElnkPuB.dll

O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program\Yahoo!\Common\yiesrvc.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_03\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: ElnkProtectionBHO Class - {9579D574-D4D8-4335-9560-FE8641A013BD} - C:\Program\EarthLink\Toolbar\ProtctIE.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\Windows Live Toolbar\msntb.dll

O2 - BHO: ElnkLegacyUninstBHO Class - {E713904C-DF05-4C79-BBAD-02DB923253BE} - C:\Program\EarthLink\Toolbar\uninsttb.dll

O3 - Toolbar: EarthLink Toolbar - {C7768536-96F8-4001-B1A2-90EE21279187} - C:\Program\EarthLink\Toolbar\Toolbar.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program\Windows Live Toolbar\msntb.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program\google\googletoolbar3.dll

O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program\Macrogaming\SweetIMBarForIE\toolbar.dll

O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [KYE_Showicon] "C:\Program\USB Storage RW\shwicon.exe" -t"KYE\USB Storage RW"

O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE

O4 - HKLM\..\Run: [storageGuard] "C:\Program\VERITAS Software\Update Manager\sgtray.exe" /r

O4 - HKLM\..\Run: [WCOLOREAL] C:\Program\Coloreal\coloreal.exe

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe

O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program\Delade filer\Microsoft Shared\Works Shared\WkUFind.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program\Delade filer\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE

O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program\Logitech\Video\ISStart.exe

O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program\Logitech\Video\LogiTray.exe

O4 - HKLM\..\Run: [HostManager] C:\Program\Delade filer\AOL\1117210522\ee\AOLHostManager.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [ExtraFilmHemmaAgent] "C:\Program\ExtraFilm Hemma\Agent.exe"

O4 - HKLM\..\Run: [kav] "C:\Program\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"

O4 - HKLM\..\Run: [Windows Defender] "C:\Program\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKLM\..\Run: [AVP] "C:\Program\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [sweetIM] C:\Program\Macrogaming\SweetIM\SweetIM.exe

O4 - HKCU\..\Run: [LDM] \Program\BackWeb-8876480.exe

O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Program\Logitech\Video\ManifestEngine.exe boot

O4 - HKCU\..\Run: [browser Sentinel] "C:\Program\Browser Sentinel\BrowserSentinel.exe" -autorun

O4 - HKCU\..\Run: [updateMgr] "C:\Program\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1

O4 - HKCU\..\Run: [Yahoo! Pager] ~"C:\Program\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [sweetIM] C:\Program\Macrogaming\SweetIM\SweetIM.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJÄNST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [WindowsRegKey update] Windowsup.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [WindowsRegKey update] Windowsup.exe (User 'Default user')

O4 - .DEFAULT User Startup: Spray Messenger.lnk = C:\Program\Spray Messenger\LM.exe (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: BTTray.lnk = ?

O4 - Global Startup: hp officejet 4100 series.lnk = ?

O4 - Global Startup: hpoddt01.exe.lnk = ?

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: &Windows Live Search - res://C:\Program\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program\Yahoo!\Common/ycsrch.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Program\MICROS~4\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: EarthLink Google Search - res://C:\Program\EarthLink\Toolbar\SearchUI.dll/search.html

O8 - Extra context menu item: Skicka till &Bluetooth - C:\Program\Bluetooth\Bluetooth-programvara\btsendto_ie_ctx.htm

O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program\Yahoo!\Common/ycdict.htm

O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program\Yahoo!\Common/ycmap.htm

O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program\Yahoo!\Common/ycsms.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll

O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program\Yahoo!\Common\yiesrvc.dll

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program\Bluetooth\Bluetooth-programvara\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program\Bluetooth\Bluetooth-programvara\btsendto_ie.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O16 - DPF: {0EB1CA3E-C9C7-42B6-8016-B0CBA435E291} (ImclCtl Class) - http://www.messenger.spray.se/messenger/client/ActiveXMsgrCore.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab

O16 - DPF: {3451DEDE-631F-421C-8127-FD793AFC6CC8} (ActiveDataInfo Class) - http://www.symantec.com/techsupp/asa/ctrl/SymAData.cab

O16 - DPF: {44990200-3C9D-426D-81DF-AAB636FA4345} (Symantec SmartIssue) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsi.cab

O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - http://www.symantec.com/techsupp/asa/ctrl/tgctlsr.cab

O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/securityadvisor/pestscan/pestscan.cab

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase9602.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1126339348296

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1137091419281

O16 - DPF: {CAFEEFAC-0014-0001-0000-ABCDEFFEDCBA} (Java Runtime Environment 1.4.1) -

O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup161.cab

O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://82.193.168.111/commod/XUpload.ocx

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program\Bluetooth\Bluetooth-programvara\bin\btwdins.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Program\iPod\bin\iPodService.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

--

End of file - 12962 bytes

[/log]

2 januari, 2008

Din HijackThis log är inte helt ren.

Ladda ner ComboFix till Skrivbordet:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Dra ur internetanslutningen och stäng av antivirusprogram och antispionprogram.

Kör ComboFix och följ anvisningarna som visas.

VIKTIGT! Klicka inte på Combofix-fönstret med musen när den körs annars kan den hänga upp sig.

När den är färdig så ska en logg komma upp, klistra in den här.

Kontrollera att antivirusprogram mm är igång innan du ansluter till internet.

Edit: Du kan också bifoga en ny HijackThis log som du har scannat efter Combofixen

// Gästen

Sopa alltid rent framför egen dörr

[inlägget ändrat 2008-01-02 20:41:57 av //gästen]

2 januari, 2008

Här kommer:

[log]ComboFix 08-01-03.3 - Ägaren 2008-01-02 21:24:39.1 - NTFSx86

Running from: C:\Documents and Settings\Ägaren\Skrivbord\ComboFix.exe

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\WINDOWS\IA

C:\WINDOWS\keyboard1.dat

.

((((((((((((((((((((((((( Files Created from 2007-12-03 to 2008-01-03 )))))))))))))))))))))))))))))))

.

2008-01-02 21:22 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe

2007-12-28 22:20 . 2007-12-28 22:20 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft

2007-12-28 22:19 . 2007-12-28 22:19 <KAT> d-------- C:\Program\Delade filer\Wise Installation Wizard

2007-12-26 17:09 . 2007-12-26 17:09 <KAT> d-------- C:\QSURF

2007-12-26 17:09 . 2007-12-26 17:09 104,688 --a------ C:\WINDOWS\~GLC0014.TMP

2007-12-25 14:04 . 2007-12-25 14:05 <KAT> d-------- C:\Program\Macrogaming

2007-12-18 17:51 . 2007-12-18 17:51 54,156 --ah----- C:\WINDOWS\QTFont.qfn

2007-12-18 17:51 . 2007-12-18 17:51 1,409 --a------ C:\WINDOWS\QTFont.for

2007-12-18 17:49 . 2007-12-18 17:49 1,409 --a------ C:\WINDOWS\system32\tmpEE6C7.FOT

2007-12-18 17:49 . 2007-12-18 17:49 1,409 --a------ C:\WINDOWS\system32\tmpDD1C7.FOT

2007-12-18 17:49 . 2007-12-18 17:49 1,409 --a------ C:\WINDOWS\system32\tmpC27C7.FOT

2007-12-18 17:49 . 2007-12-18 17:49 1,409 --a------ C:\WINDOWS\system32\tmpA97C7.FOT

2007-12-18 17:49 . 2007-12-18 17:49 1,409 --a------ C:\WINDOWS\system32\tmp98CD7.FOT

2007-12-18 17:49 . 2007-12-18 17:49 1,409 --a------ C:\WINDOWS\system32\tmp905C7.FOT

2007-12-18 17:49 . 2007-12-18 17:49 1,409 --a------ C:\WINDOWS\system32\tmp685C7.FOT

2007-12-18 17:49 . 2007-12-18 17:49 1,409 --a------ C:\WINDOWS\system32\tmp4F5C7.FOT

2007-12-18 17:49 . 2007-12-18 17:49 1,409 --a------ C:\WINDOWS\system32\tmp096C7.FOT

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-01-03 20:38 49,582,880 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat

2008-01-03 20:38 3,783,200 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat

2008-01-02 18:00 --------- d-----w C:\Program\Trend Micro

2008-01-01 22:34 7,340,032 ----a-w C:\Documents and Settings\Ägaren\NTUSER.DAT

2008-01-01 22:34 664,364 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx

2008-01-01 22:34 355,388 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx

2008-01-01 20:13 --------- d-s---w C:\Documents and Settings\Ägaren\Application Data\Microsoft

2007-12-28 20:37 --------- d-----w C:\Program\Lavasoft

2007-12-28 20:37 --------- d-----w C:\Documents and Settings\Ägaren\Application Data\Lavasoft

2007-11-30 21:11 --------- d-----w C:\Program\Windows Live Toolbar

2007-11-24 13:05 87,112 ----a-w C:\Documents and Settings\Ägaren\Application Data\GDIPFONTCACHEV1.DAT

2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys

2007-02-09 08:20 2,893 ---ha-w C:\Documents and Settings\Ägaren\hpothb07.dat

2007-02-09 08:08 2,338 ---ha-w C:\Documents and Settings\Administratör\hpothb07.dat

2004-04-01 12:56 67,096 ----a-w C:\Documents and Settings\Administratör\Application Data\GDIPFONTCACHEV1.DAT

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LDM"="\Program\BackWeb-8876480.exe" [ ]

"LogitechSoftwareUpdate"="C:\Program\Logitech\Video\ManifestEngine.exe" [2004-10-08 11:06 196608]

"Browser Sentinel"="C:\Program\Browser Sentinel\BrowserSentinel.exe" [2005-10-05 19:13 618496]

"updateMgr"="C:\Program\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 15:45 313472]

"Yahoo! Pager"="~C:\Program\Yahoo!\MESSEN~1\YAHOOM~1.exe" [ ]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:34 15360]

"WMPNSCFG"="C:\Program\Windows Media Player\WMPNSCFG.exe" [2006-11-15 09:49 204288]

"SweetIM"="C:\Program\Macrogaming\SweetIM\SweetIM.exe" [2007-10-14 18:09 103712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 23:04 52736]

"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2002-10-16 13:05 114688]

"KYE_Showicon"="C:\Program\USB Storage RW\shwicon.exe" [2002-10-25 22:33 69632]

"KBD"="C:\HP\KBD\KBD.EXE" [2003-03-31 02:50 61440]

"StorageGuard"="C:\Program\VERITAS Software\Update Manager\sgtray.exe" [2002-06-18 14:01 155648]

"WCOLOREAL"="C:\Program\Coloreal\coloreal.exe" [2002-11-27 00:14 131072]

"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-14 04:42 212992]

"nwiz"="nwiz.exe" [2002-09-10 05:35 372736 C:\WINDOWS\system32\nwiz.exe]

"PS2"="C:\WINDOWS\system32\ps2.exe" [2002-10-16 22:57 81920]

"Microsoft Works Update Detection"="C:\Program\Delade filer\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-25 03:20 28672]

"TkBellExe"="C:\Program\Delade filer\Real\Update_OB\realsched.exe" [2005-01-07 12:47 180269]

"LVCOMSX"="C:\WINDOWS\System32\LVCOMSX.EXE" [2004-10-08 10:52 221184]

"LogitechVideoRepair"="C:\Program\Logitech\Video\ISStart.exe" [2004-10-08 11:31 458752]

"LogitechVideoTray"="C:\Program\Logitech\Video\LogiTray.exe" [2004-10-08 11:24 217088]

"HostManager"="C:\Program\Delade filer\AOL\1117210522\ee\AOLHostManager.exe" [2005-05-20 17:45 169560]

"iTunesHelper"="C:\Program\iTunes\iTunesHelper.exe" [2005-10-18 11:58 278528]

"QuickTime Task"="C:\Program\QuickTime\qttask.exe" [2006-01-04 21:50 155648]

"ExtraFilmHemmaAgent"="C:\Program\ExtraFilm Hemma\Agent.exe" [2005-05-27 15:00 303104]

"kav"="C:\Program\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2006-11-08 18:28 155751]

"Windows Defender"="C:\Program\Windows Defender\MSASCui.exe" [2006-11-03 18:20 866584]

"SunJavaUpdateSched"="C:\Program\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]

"AVP"="C:\Program\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2006-11-08 18:28 155751]

"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 09:34 110592 C:\WINDOWS\system32\bthprops.cpl]

"SweetIM"="C:\Program\Macrogaming\SweetIM\SweetIM.exe" [2007-10-14 18:09 103712]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"WindowsRegKey update"="Windowsup.exe" []

"Microsoft Update"="muamgrd.exe" []

"DWQueuedReporting"="C:\Program\DELADE~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]

C:\Documents and Settings\All Users\Start-meny\Program\AutostartAdobe Reader Speed Launch.lnk - C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26]

BTTray.lnk - C:\Program\Bluetooth\Bluetooth-programvara\BTTray.exe [2005-09-19 15:02:54]

hp officejet 4100 series.lnk - C:\Program\Hewlett-Packard\Digital Imaging\bin\hpomau08.exe [2003-04-06 00:17:50]

hpoddt01.exe.lnk - C:\Program\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-06 00:06:58]

Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2005-05-27 16:50:49]

Microsoft Office.lnk - C:\Program\Microsoft Office\Office10\OSA.EXE [2001-02-13 16:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\New.net Startup]

rundll32 C:\Program\NEWDOT~1\NEWDOT~1.DLL,ClientStartup -s

S3 T5100_usb;LGE USB driver;C:\WINDOWS\system32\Drivers\T5100.sys [2004-08-19 00:48]

.

Contents of the 'Scheduled Tasks' folder

"2007-12-31 22:48:00 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp officejet 4100 series#1091137551.job"

- C:\Program\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe:-I

"2008-01-03 20:45:04 C:\WINDOWS\Tasks\Kontrollera uppdateringar för Windows Live Toolbar.job"

- C:\Program\Windows Live Toolbar\MSNTBUP.EXE

"2008-01-02 15:24:05 C:\WINDOWS\Tasks\MP Scheduled Scan.job"

- C:\Program\Windows Defender\MpCmdRun.exe

"2007-05-03 11:01:25 C:\WINDOWS\Tasks\RegistrySmart Scheduled Scan.job"

- C:\Program\RegistrySmart\RegistrySmart.ex

- C:\Program\RegistrySmart.Ägaren.Runs RegistrySmart to optimize your registry.

.

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-01-03 21:39:52

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2008-01-03 21:48:58

ComboFix-quarantined-files.txt 2008-01-03 20:48:49

ComboFix2.txt 2006-09-28 09:57:56

ComboFix3.txt 2006-09-27 19:27:55

.

2007-12-28 09:21:29 --- E O F ---

[/log]

Och den andra:

[log]

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:00:01, on 2008-01-03

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\Program\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\windows\system\hpsysdrv.exe

C:\Program\USB Storage RW\shwicon.exe

C:\HP\KBD\KBD.EXE

C:\Program\Delade filer\Microsoft Shared\Works Shared\WkUFind.exe

C:\Program\Delade filer\Real\Update_OB\realsched.exe

C:\WINDOWS\System32\LVCOMSX.EXE

C:\Program\Logitech\Video\LogiTray.exe

C:\Program\iTunes\iTunesHelper.exe

C:\Program\QuickTime\qttask.exe

C:\Program\ExtraFilm Hemma\Agent.exe

C:\Program\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe

C:\Program\Windows Defender\MSASCui.exe

C:\Program\Java\jre1.6.0_03\bin\jusched.exe

C:\Program\Macrogaming\SweetIM\SweetIM.exe

C:\Program\Delade filer\AOL\1117210522\ee\AOLHostManager.exe

C:\Program\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe

C:\Program\Browser Sentinel\BrowserSentinel.exe

C:\Program\Real\RealPlayer\RealPlay.exe

C:\Program\Delade filer\AOL\1117210522\ee\AOLServiceHost.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\Bluetooth\Bluetooth-programvara\bin\btwdins.exe

C:\Program\Windows Media Player\WMPNSCFG.exe

C:\WINDOWS\system32\cisvc.exe

C:\Program\Bluetooth\Bluetooth-programvara\BTTray.exe

C:\Program\Hewlett-Packard\Digital Imaging\bin\hpomau08.exe

C:\WINDOWS\System32\svchost.exe

C:\Program\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\Program\Logitech\Video\FxSvr2.exe

C:\Program\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe

C:\Program\iPod\bin\iPodService.exe

C:\WINDOWS\SYSTEM32\cidaemon.exe

C:\Program\Yahoo!\MESSEN~1\ymsgr_tray.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe