Malware doctor virus

19 april, 2009

Har drabbats av ett program som låtsas vara ett antivirusprogram.

Det kallar sig för Malware Doctor, dess symbol är ett rött kors på vit botten.

Någon som vet vad det är, och hur man får bort det.

Mvh

Filip

19 april, 2009

Börja med att ladda ner DDS till Skrivbordet.

http://download.bleepingcomputer.com/sUBs/dds.scr

Starta programmet (i Vista högerklicka och Kör som administratör).

Tryck Yes/Ja på frågan om Optional Scan.

I ditt svar bifogar du de två loggarna DSS.txt och Attach.txt i ditt svar på detta sätt:

Tryck på LOG-knappen i Besvara-fönstret

Klistra in loggen

Tryck igen på LOG-knappen nappen i Besvara-fönstret´

Upprepa med nästa logg.

5 Maj, 2009

Jag har samma problem...

DDS.txt

[log]DDS (Ver_09-03-16.01) - NTFSx86

Run by Sebastian at 16:46:05,73 on 2009-05-05

Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_10

Microsoft Windows XP Professional 5.1.2600.3.1252.46.1053.18.3582.2658 [GMT 2:00]

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program\D-Link\D-Link DWA-556 Wireless N PCIe Desktop Adapter\acs.exe

svchost.exe

C:\WINDOWS\System32\AshEvtSvc.exe

C:\Program\Bonjour\mDNSResponder.exe

C:\Program\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Program\Java\jre6\bin\jqs.exe

C:\Program\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

C:\Program\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

C:\Program\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

C:\Program\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Documents and Settings\LocalService\Application Data\900399219.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program\Messenger\msmsgs.exe

F:\Program\DAEMON Tools Lite\daemon.exe

C:\Program\Mozilla Firefox\firefox.exe

F:\Program\WC3Banlist\WC3Banlist.exe

F:\Recived\dds.scr

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = *.local

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program\java\jre6\bin\ssv.dll

BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe

uRun: [MSMSGS] "c:\program\messenger\msmsgs.exe" /background

uRun: [DAEMON Tools Lite] "f:\program\daemon tools lite\daemon.exe" -autorun

uRun: [Malware Doctor] c:\documents and settings\localservice\application data\900399219.exe

mRun: [Malware Doctor] c:\documents and settings\localservice\application data\900399219.exe

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

uPolicies-system: DisableTaskMgr = 1 (0x1)

uPolicies-system: DisableRegistryTools = 1 (0x1)

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program\java\jre6\bin\jp2iexp.dll

LSP: %SYSTEMROOT%\system32\nvappfilter.dll

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1227718750068

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Notify: AtiExtEvent - Ati2evxx.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\sebast~1\applic~1\mozilla\firefox\profiles\d57clgmt.defaultFF - plugin: f:\program\videolan\vlc\npvlc.dll

---- FIREFOX POLICIES ----

c:\program\mozilla firefox\greprefs\all.js - pref("browser.visited_color", "#551A8B");

c:\program\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.videoFeeds.handler", "ask");

============= SERVICES / DRIVERS ===============

R2 AshEvtSvc;AshEvtSvc;c:\windows\system32\ashevtsvc.exe -k netsvcs --> c:\windows\system32\AshEvtSvc.exe -k netsvcs [?]

R3 LachesisFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [2008-12-26 12032]

R3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2005-8-2 32512]

R3 WSIMD;wsimd Service;c:\windows\system32\drivers\wsimd.sys [2008-11-26 57024]

S2 bEvtSvcE;bEvtSvcE;c:\windows\system32\bevtsvce.exe -k netsvcs --> c:\windows\system32\bEvtSvcE.exe -k netsvcs [?]

S3 getPlus® Helper;getPlus® Helper;c:\program\nos\bin\getPlus_HelperSvc.exe [2008-11-26 33752]

S3 uisp;Freescale USB JW32 driver;c:\windows\system32\drivers\Usbicp.sys [2008-12-26 14592]

=============== Created Last 30 ================

2009-05-05 00:13 <DIR> --d----- C:\ComboFix

2009-05-05 00:04 5,504 ac------ c:\windows\system32\dllcache\intelide.sys

2009-05-05 00:04 5,504 a------- c:\windows\system32\drivers\intelide.sys

2009-05-05 00:04 35,328 ac------ c:\windows\system32\dllcache\pcntpci5.sys

2009-05-05 00:04 35,328 a------- c:\windows\system32\drivers\pcntpci5.sys

2009-05-05 00:04 10,240 ac------ c:\windows\system32\dllcache\compbatt.sys

2009-05-05 00:04 10,240 a------- c:\windows\system32\drivers\compbatt.sys

2009-05-05 00:04 13,952 ac------ c:\windows\system32\dllcache\cmbatt.sys

2009-05-05 00:04 13,952 a------- c:\windows\system32\drivers\CmBatt.sys

2009-05-05 00:04 14,208 ac------ c:\windows\system32\dllcache\battc.sys

2009-05-05 00:04 14,208 a------- c:\windows\system32\drivers\battc.sys

2009-05-01 11:04 232,075 a------- c:\windows\Burn4Free_Toolbar_Uninstaller_3687.exe

2009-05-01 11:04 <DIR> --d----- c:\program\Burn4Free Toolbar

2009-05-01 09:45 161,792 a------- c:\windows\SWREG.exe

2009-05-01 09:45 117,248 a------- c:\windows\VFIND.exe

2009-05-01 09:45 98,816 a------- c:\windows\sed.exe

2009-05-01 09:43 90,624 a------- c:\windows\system32\bEvtSvcE.exe

2009-05-01 09:41 32,768 a------- c:\windows\system32\AshEvtSvc.exe

2009-04-30 03:15 <DIR> --d----- c:\docume~1\sebast~1\applic~1\DC++

2009-04-21 22:32 531 a------- c:\windows\eReg.dat

2009-04-18 17:17 <DIR> --d----- c:\program\Bonjour

2009-04-18 17:12 <DIR> --d----- c:\program\delade filer\Macrovision Shared

2009-04-17 11:25 <DIR> --d----- c:\docume~1\sebast~1\applic~1\Spotify

2009-04-17 09:21 473,600 -c------ c:\windows\system32\dllcache\fastprox.dll

2009-04-17 09:21 401,408 -c------ c:\windows\system32\dllcache\rpcss.dll

2009-04-17 09:21 284,160 -c------ c:\windows\system32\dllcache\pdh.dll

2009-04-17 09:21 227,840 -c------ c:\windows\system32\dllcache\wmiprvse.exe

2009-04-17 09:21 110,592 -c------ c:\windows\system32\dllcache\services.exe

2009-04-17 09:21 729,600 -c------ c:\windows\system32\dllcache\lsasrv.dll

2009-04-17 09:21 719,360 -c------ c:\windows\system32\dllcache\ntdll.dll

2009-04-17 09:21 681,472 -c------ c:\windows\system32\dllcache\advapi32.dll

2009-04-17 09:21 453,120 -c------ c:\windows\system32\dllcache\wmiprvsd.dll

2009-04-17 09:20 1,203,922 -c------ c:\windows\system32\dllcache\sysmain.sdb

2009-04-17 09:20 217,088 -c------ c:\windows\system32\dllcache\wordpad.exe

==================== Find3M ====================

2009-05-05 00:16 395,520 a------- c:\windows\system32\perfh01D.dat

2009-05-05 00:16 69,608 a------- c:\windows\system32\perfc01D.dat

2009-04-18 02:33 76,097 a------- c:\windows\War3Unin.dat

2009-03-06 16:24 284,160 a------- c:\windows\system32\pdh.dll

2009-03-03 02:16 826,368 a------- c:\windows\system32\wininet.dll

2009-02-20 19:18 78,336 a------- c:\windows\system32\ieencode.dll

2009-02-09 16:07 1,846,784 a------- c:\windows\system32\win32k.sys

2009-02-09 13:27 2,024,960 a------- c:\windows\system32\ntkrnlpa.exe

2009-02-09 13:27 2,146,304 a------- c:\windows\system32\ntoskrnl.exe

2009-02-09 13:27 110,592 a------- c:\windows\system32\services.exe

2009-02-09 12:56 729,600 a------- c:\windows\system32\lsasrv.dll

2009-02-09 12:56 719,360 a------- c:\windows\system32\ntdll.dll

2009-02-09 12:56 681,472 a------- c:\windows\system32\advapi32.dll

2009-02-09 12:56 401,408 a------- c:\windows\system32\rpcss.dll

2009-02-06 12:39 35,328 a------- c:\windows\system32\sc.exe

============= FINISH: 16:46:15,29 ===============[/log]

Attach.txt

[log]

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-03-16.01)

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume1

Install Date: 2008-11-26 16:43:41

System Uptime: 2009-05-05 13:40:17 (3 hours ago)

Motherboard: ASUSTeK Computer INC. | | M2N-SLI DELUXE

Processor: AMD Athlon 64 X2 Dual Core Processor 6400+ | Socket AM2 | 3214/200mhz

==== Disk Partitions =========================

A: is Removable

C: is FIXED (NTFS) - 49 GiB total, 35,416 GiB free.

D: is FIXED (NTFS) - 699 GiB total, 558,325 GiB free.

F: is FIXED (NTFS) - 195 GiB total, 151,787 GiB free.

G: is FIXED (NTFS) - 195 GiB total, 156,953 GiB free.

H: is CDROM ()

J: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}

Description: 1394 Net Adapter

Device ID: V1394\NIC1394\1900A21E8C00

Manufacturer: Microsoft

Name: 1394 Net Adapter

PNP Device ID: V1394\NIC1394\1900A21E8C00

Service: NIC1394

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}

Description: NVIDIA nForce Networking Controller

Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV0373\4&39414771&0&00

Manufacturer: NVIDIA

Name: NVIDIA nForce Networking Controller

PNP Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV0373\4&39414771&0&00

Service: NVENETFD

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}

Description: NVIDIA nForce Networking Controller

Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV0373\4&20F173B0&0&00

Manufacturer: NVIDIA

Name: NVIDIA nForce Networking Controller #2

PNP Device ID: {1A3E09BE-1E45-494B-9174-D7385B45BBF5}\NVNET_DEV0373\4&20F173B0&0&00

Service: NVENETFD

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}

Description: Hamachi Network Interface

Device ID: ROOT\NET\0000

Manufacturer: Applied Networking Inc.

Name: Hamachi Network Interface

PNP Device ID: ROOT\NET\0000

Service: hamachi

==== System Restore Points ===================

RP72: 2009-04-17 18:43:42 - Software Distribution Service 3.0

RP73: 2009-04-18 03:57:17 - Installerad Battlefield 2

RP74: 2009-04-18 04:11:00 - Installerad Battlefield 2-patch v1.41

RP75: 2009-04-19 22:13:12 - Systemkontrollpunkt

RP76: 2009-04-21 05:23:54 - Systemkontrollpunkt

RP77: 2009-04-23 14:35:20 - Systemkontrollpunkt

RP78: 2009-04-25 12:03:51 - Systemkontrollpunkt

RP79: 2009-04-27 17:50:41 - Systemkontrollpunkt

RP80: 2009-04-30 00:24:59 - Systemkontrollpunkt

RP81: 2009-05-01 05:52:02 - Systemkontrollpunkt

RP82: 2009-05-04 01:29:10 - Software Distribution Service 3.0

==== Installed Programs ======================

Adobe Anchor Service CS3

Adobe Asset Services CS3

Adobe Bridge CS3

Adobe Bridge Start Meeting

Adobe Camera Raw 4.0

Adobe CMaps

Adobe Color - Photoshop Specific

Adobe Color Common Settings

Adobe Color EU Extra Settings

Adobe Color JA Extra Settings

Adobe Color NA Recommended Settings

Adobe Default Language CS3

Adobe Device Central CS3

Adobe ExtendScript Toolkit 2

Adobe Flash Player 10 ActiveX

Adobe Flash Player 10 Plugin

Adobe Fonts All

Adobe Help Viewer CS3

Adobe Linguistics CS3

Adobe PDF Library Files

Adobe Photoshop CS3

Adobe Setup

Adobe Shockwave Player 11

Adobe Stock Photos CS3

Adobe Type Support

Adobe Update Manager CS3

Adobe Version Cue CS3 Client

Adobe WinSoft Linguistics Plugin

Adobe XMP Panels CS3

ASUSUpdate

ATI - Software Uninstall Utility

ATI Catalyst Control Center

ATI Display Driver

µTorrent

Battlefield 2

Burn4Free CD and DVD

Burn4Free Toolbar

C-Media USB Sound Driver

Catalyst Control Center - Branding

Catalyst Control Center Core Implementation

Catalyst Control Center Graphics Full Existing

Catalyst Control Center Graphics Full New

Catalyst Control Center Graphics Light

Catalyst Control Center Graphics Previews Common

Catalyst Control Center HydraVision Full

ccc-core-preinstall

ccc-core-static

ccc-utility

CCC Help English

Combined Community Codec Pack 2008-09-21 16:18

D-Link DWA-556 Wireless N PCIe Desktop Adapter

Day of Defeat

DC++ 0.750

Guitar Pro 5.2

Hamachi 1.0.0.59

HijackThis 2.0.2

Hotfix for Windows Media Format 11 SDK (KB929399)

Icemat Siberia USB Soundcard

IrfanView (remove only)

Java 6 Update 10

Java 6 Update 7

JMB36X Raid Configurer

Microsoft .NET Framework 2.0

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Internationalized Domain Names Mitigation APIs

Microsoft National Language Support Downlevel APIs

Microsoft User-Mode Driver Framework Feature Pack 1.0

Mozilla Firefox (3.0.10)

NVIDIA Drivers

NVIDIA ForceWare Network Access Manager

OpenOffice.org 3.0

PDF Settings

Sid Meier's Civilization 4

Sid Meier's Civilization 4 - Beyond the Sword

Sid Meier's Civilization 4 - Warlords

SimCity 4 Deluxe

Skins

Skype™ 4.0

Snabbkorrigering för Windows Media Player 11 (KB939683)

Snabbkorrigering för Windows XP (KB952287)

Säkerhetsuppdatering för Windows Internet Explorer 7 (KB938127-v2)

Säkerhetsuppdatering för Windows Internet Explorer 7 (KB956390)

Säkerhetsuppdatering för Windows Internet Explorer 7 (KB958215)

Säkerhetsuppdatering för Windows Internet Explorer 7 (KB960714)

Säkerhetsuppdatering för Windows Internet Explorer 7 (KB963027)

Säkerhetsuppdatering för Windows Media Player (KB952069)

Säkerhetsuppdatering för Windows Media Player 11 (KB936782)

Säkerhetsuppdatering för Windows Media Player 11 (KB954154)

Säkerhetsuppdatering för Windows XP (KB923561)

Säkerhetsuppdatering för Windows XP (KB923789)

Säkerhetsuppdatering för Windows XP (KB938464)

Säkerhetsuppdatering för Windows XP (KB941569)

Säkerhetsuppdatering för Windows XP (KB946648)

Säkerhetsuppdatering för Windows XP (KB950762)

Säkerhetsuppdatering för Windows XP (KB950974)

Säkerhetsuppdatering för Windows XP (KB951066)

Säkerhetsuppdatering för Windows XP (KB951376-v2)

Säkerhetsuppdatering för Windows XP (KB951698)

Säkerhetsuppdatering för Windows XP (KB951748)

Säkerhetsuppdatering för Windows XP (KB952004)

Säkerhetsuppdatering för Windows XP (KB952954)

Säkerhetsuppdatering för Windows XP (KB954211)

Säkerhetsuppdatering för Windows XP (KB954459)

Säkerhetsuppdatering för Windows XP (KB954600)

Säkerhetsuppdatering för Windows XP (KB955069)

Säkerhetsuppdatering för Windows XP (KB956390)

Säkerhetsuppdatering för Windows XP (KB956391)

Säkerhetsuppdatering för Windows XP (KB956572)

Säkerhetsuppdatering för Windows XP (KB956802)

Säkerhetsuppdatering för Windows XP (KB956803)

Säkerhetsuppdatering för Windows XP (KB956841)

Säkerhetsuppdatering för Windows XP (KB957095)

Säkerhetsuppdatering för Windows XP (KB957097)

Säkerhetsuppdatering för Windows XP (KB958644)

Säkerhetsuppdatering för Windows XP (KB958687)

Säkerhetsuppdatering för Windows XP (KB958690)

Säkerhetsuppdatering för Windows XP (KB959426)

Säkerhetsuppdatering för Windows XP (KB960225)

Säkerhetsuppdatering för Windows XP (KB960715)

Säkerhetsuppdatering för Windows XP (KB960803)

Säkerhetsuppdatering för Windows XP (KB961373)

Spotify

Stronghold 2 Deluxe

Uppdatering för Windows XP (KB951072-v2)

Uppdatering för Windows XP (KB951978)

Uppdatering för Windows XP (KB955839)

Uppdatering för Windows XP (KB967715)

Warcraft III: All Products

WC3Banlist

WebFldrs XP

Viktig uppdatering för Windows Media Player 11 (KB959772)

Windows Driver Package - MOTOROLA (uisp) USB (09/08/2006 1.2.0.0)

Windows Driver Package - Razer (HidUsb) HIDClass (05/10/2007 1.00)

Windows Genuine Advantage Notifications (KB905474)

Windows Genuine Advantage Validation Tool (KB892130)

Windows Internet Explorer 7

Windows Live installer

Windows Live Messenger

Windows Media Format 11 runtime

Windows Media Player 11

Windows XP Service Pack 3

WinPcap 3.1

WinRAR archiver

VLC media player 0.9.6

Xoomer 1.2

==== End Of File ===========================

[/log]

5 Maj, 2009

Ladda ner Malwarebytes Anti-Malware (MBAM) från en av dessa länkar:

http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

http://projects.securitywonks.net/projects/details.php?file=158

Dubbelklicka på mbam-setup för att installera programmet.

[log]Se till i slutet av installationen att det är bockar för:

Uppdatera Malwarebytes' Anti-Malware

Starta Malwarebytes' Anti-Malware

Tryck på Slutför

Om det finns någon uppdatering så kommer den att laddas ner och installeras.

När programmet startar så välj "Utför snabb skanning" och tryck på Skanna.

Skanningen tar ett tag.

När den är klar så tryck på OK och sedan "Visa resultat".

Bocka för allt och tryck sedan Ta bort markerade.

När borttagningen är klar så öppnar Anteckningar med en logg.

Eventuellt så kommer det upp en begäran om att starta om datorn (Restart). I så fall gör det.

Om det blir ett felmeddelande Error loading... efter omstarten så starta om datorn än en gång.

Om programmet inte kommer igång efter omstarten så starta det.

Om loggen inte kommer upp själv i Anteckningar så hittar du loggen på fliken Loggar i MBAM.

Kopiera loggen och klistra in den i ditt svar tillsammans med en ny [/log]DDS-logg.

6 Maj, 2009

here we go

mbam-log:

[log]Malwarebytes' Anti-Malware 1.36

Databasversion: 2082

Windows 5.1.2600 Service Pack 3

2009-05-06 13:03:58

mbam-log-2009-05-06 (13-03-58).txt

Skanningstyp: Snabb skanning

Antal skannade objekt: 68991

Förfluten tid: 1 minute(s), 20 second(s)

Infekterade minnesprocesser: 0

Infekterade minnesmoduler: 1

Infekterade registernycklar: 0

Infekterade registervärden: 2

Infekterade registerdataposter: 2

Infekterade mappar: 0

Infekterade filer: 5

Infekterade minnesprocesser:

(Inga illasinnade poster hittades)

Infekterade minnesmoduler:

C:\Program\Mozilla Firefox\setupapi.dll (Trojan.Agent) -> Delete on reboot.

Infekterade registernycklar:

(Inga illasinnade poster hittades)

Infekterade registervärden:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Malware Doctor (Rogue.MalwareDoc) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Malware Doctor (Rogue.MalwareDoc) -> Quarantined and deleted successfully.

Infekterade registerdataposter:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infekterade mappar:

(Inga illasinnade poster hittades)

Infekterade filer:

C:\WINDOWS\system32\bEvtSvcE.exe (Trojan.Spambot) -> Quarantined and deleted successfully.

C:\Documents and Settings\LocalService\Application Data\976949939.exe (Trojan.Spambot) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\3.tmp (Trojan.Agent) -> Delete on reboot.

C:\Program\Mozilla Firefox\setupapi.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\LocalService\Application Data\900399219.exe (Rogue.MalwareDoc) -> Delete on reboot.

[/log]

DDS.txt

[log]DDS (Ver_09-03-16.01) - NTFSx86

Run by Sebastian at 13:13:17,53 on 2009-05-06

Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_10

Microsoft Windows XP Professional 5.1.2600.3.1252.46.1053.18.3582.3041 [GMT 2:00]

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program\D-Link\D-Link DWA-556 Wireless N PCIe Desktop Adapter\acs.exe

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program\Messenger\msmsgs.exe

F:\Program\DAEMON Tools Lite\daemon.exe

C:\WINDOWS\System32\AshEvtSvc.exe

C:\Program\Bonjour\mDNSResponder.exe

C:\Program\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Program\Java\jre6\bin\jqs.exe

C:\Program\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

C:\Program\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Program\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

C:\Program\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

C:\Program\Mozilla Firefox\firefox.exe

C:\Program\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\system32\NOTEPAD.EXE

F:\Recived\dds.scr

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = *.local

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program\java\jre6\bin\ssv.dll

BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe

uRun: [MSMSGS] "c:\program\messenger\msmsgs.exe" /background

uRun: [DAEMON Tools Lite] "f:\program\daemon tools lite\daemon.exe" -autorun

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program\java\jre6\bin\jp2iexp.dll

LSP: %SYSTEMROOT%\system32\nvappfilter.dll

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1227718750068

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Notify: AtiExtEvent - Ati2evxx.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\sebast~1\applic~1\mozilla\firefox\profiles\d57clgmt.defaultFF - plugin: f:\program\videolan\vlc\npvlc.dll

---- FIREFOX POLICIES ----

c:\program\mozilla firefox\greprefs\all.js - pref("browser.visited_color", "#551A8B");

c:\program\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.videoFeeds.handler", "ask");

============= SERVICES / DRIVERS ===============

R2 AshEvtSvc;AshEvtSvc;c:\windows\system32\ashevtsvc.exe -k netsvcs --> c:\windows\system32\AshEvtSvc.exe -k netsvcs [?]

R3 LachesisFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [2008-12-26 12032]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-5-6 38496]

R3 WSIMD;wsimd Service;c:\windows\system32\drivers\wsimd.sys [2008-11-26 57024]

S2 bEvtSvcE;bEvtSvcE;c:\windows\system32\bevtsvce.exe -k netsvcs --> c:\windows\system32\bEvtSvcE.exe -k netsvcs [?]

S3 getPlus® Helper;getPlus® Helper;c:\program\nos\bin\getPlus_HelperSvc.exe [2008-11-26 33752]

S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2005-8-2 32512]

S3 uisp;Freescale USB JW32 driver;c:\windows\system32\drivers\Usbicp.sys [2008-12-26 14592]

=============== Created Last 30 ================

2009-05-06 13:01 <DIR> --d----- c:\docume~1\sebast~1\applic~1\Malwarebytes

2009-05-06 13:01 15,504 a------- c:\windows\system32\drivers\mbam.sys

2009-05-06 13:01 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys

2009-05-06 13:01 <DIR> --d----- c:\program\Malwarebytes' Anti-Malware

2009-05-06 13:01 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes

2009-05-05 18:03 58,880 a------- c:\windows\system32\1B.tmp