Just nu i M3-nätverket
Jump to content

Hjälp mig snälla


dana

Recommended Posts

jag har fått något som heter digital protection

 

 

 

 

DDS (Ver_10-03-17.01) - NTFSx86

Run by Jessica at 22:01:48,46 on 2010-05-02

Internet Explorer: 7.0.5730.11

Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.503.96 [GMT 2:00]

 

AV: Digital Protection *On-access scanning enabled* (Outdated) {28e00e3b-806e-4533-925c-f4c3d79514b9}

AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

 

============== Running Processes ===============

 

c:\windows\system32\svchost -k dcomlaunch

svchost.exe

c:\windows\system32\svchost.exe -k netsvcs

C:\Program\Intel\Wireless\Bin\EvtEng.exe

C:\Program\Intel\Wireless\Bin\S24EvMon.exe

C:\Program\Intel\Wireless\Bin\WLKeeper.exe

svchost.exe

svchost.exe

C:\Program\Intel\Wireless\Bin\ZcfgSvc.exe

C:\WINDOWS\Explorer.EXE

C:\Program\Alwil Software\Avast5\AvastSvc.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program\Bonjour\mDNSResponder.exe

C:\Program\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

C:\Program\Intel\Wireless\Bin\RegSrvc.exe

c:\windows\system32\svchost.exe -k imgsvc

C:\Program\Intel\Wireless\Bin\1XConfig.exe

C:\Program\Apoint\Apoint.exe

C:\Program\Java\jre1.6.0_05\bin\jusched.exe

C:\Program\Intel\Wireless\Bin\ifrmewrk.exe

C:\Program\Dell\QuickSet\quickset.exe

C:\Program\CyberLink\PowerDVD\DVDLauncher.exe

C:\Program\Dell\Media Experience\DMXLauncher.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program\Delade filer\InstallShield\UpdateService\issch.exe

C:\Program\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe

C:\Program\ALWILS~1\Avast5\avastUI.exe

C:\Program\Apoint\Apntex.exe

C:\Program\Messenger\msmsgs.exe

C:\WINDOWS\system32\ctfmon.exe

C:\DOCUME~1\Jessica\LOKALA~1\Temp\sysmon64x.exe

C:\Program\Digital Protection\digprot.exe

C:\Program\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe

C:\Program\Digital Line Detect\DLG.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\Mozilla Firefox\firefox.exe

C:\Program\Java\jre1.6.0_05\bin\jucheck.exe

C:\Program\Internet Explorer\iexplore.exe

C:\Documents and Settings\Jessica\Mina dokument\Hämtade filer\dds.scr

 

============== Pseudo HJT Report ===============

 

uStart Page = hxxp://www.google.se/

uSearch Page = hxxp://www.google.com

uDefault_Page_URL = hxxp://www.euro.dell.com/

uSearch Bar = hxxp://www.google.com/ie

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

mSearchAssistant = hxxp://www.google.com/ie

BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program\adobe\adobe acrobat 6.0\acrobat\activex\AcroIEHelper.dll

BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program\java\jre1.6.0_05\bin\ssv.dll

BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File

BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program\adobe\adobe acrobat 6.0\acrobat\AcroIEFavClient.dll

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program\adobe\adobe acrobat 6.0\acrobat\AcroIEFavClient.dll

TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File

TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File

TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File

EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program\adobe\adobe acrobat 6.0\acrobat\AcroIEFavClient.dll

uRun: [MSMSGS] "c:\program\messenger\msmsgs.exe" /background

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [sysmon64x.exe] c:\docume~1\jessica\lokala~1\temp\sysmon64x.exe

uRun: [Digital Protection] "c:\program\digital protection\digprot.exe" -noscan

uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\NPSWF32_FlashUtil.exe -p

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Apoint] c:\program\apoint\Apoint.exe

mRun: [sunJavaUpdateSched] "c:\program\java\jre1.6.0_05\bin\jusched.exe"

mRun: [intelWireless] c:\program\intel\wireless\bin\ifrmewrk.exe /tf Intel PROSet/Wireless

mRun: [Dell QuickSet] c:\program\dell\quickset\quickset.exe

mRun: [DVDLauncher] "c:\program\cyberlink\powerdvd\DVDLauncher.exe"

mRun: [updateManager] "c:\program\delade filer\sonic\update manager\sgtray.exe" /r

mRun: [DMXLauncher] c:\program\dell\media experience\DMXLauncher.exe

mRun: [dla] c:\windows\system32\dla\tfswctrl.exe

mRun: [iSUSPM Startup] c:\program\delade~1\instal~1\update~1\ISUSPM.exe -startup

mRun: [iSUSScheduler] "c:\program\delade filer\installshield\updateservice\issch.exe" -start

mRun: [DAEMON Tools-1033] "c:\program\d-tools\daemon.exe" -lang 1033

mRun: [AdobeVersionCue] c:\program\adobe\adobe version cue\controlpanel\VersionCueTray.exe

mRun: [AppleSyncNotifier] c:\program\delade filer\apple\mobile device support\bin\AppleSyncNotifier.exe

mRun: [QuickTime Task] "c:\program\quicktime\qttask.exe" -atboottime

mRun: [avast5] c:\program\alwils~1\avast5\avastUI.exe /nogui

mRun: [Family Tree Builder Update] c:\program\myheritage\bin\FTBCheckUpdates.exe

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\acroba~1.lnk - c:\program\adobe\adobe acrobat 6.0\distillr\acrotray.exe

StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\adobeg~1.lnk - c:\program\delade filer\adobe\calibration\Adobe Gamma Loader.exe

StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\digita~1.lnk - c:\program\digital line detect\DLG.exe

StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\micros~1.lnk - c:\program\microsoft office\office\OSA9.EXE

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program\java\jre1.6.0_05\bin\ssv.dll

DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab

DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} - hxxps://components.viewpoint.com/MTSInstallers/MetaStream3.cab?url=http://www.viewpoint.com/cgi-bin/installer.v4/vet_install_premium.pl?1&6&04.00.09.13&premium&unknown&http://62.3.133.38/SE/24_3d_view_my_car_pop.jsp?noreloadredir

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136561260750

DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - hxxp://82.193.160.173/activex/AxisCamControl.ocx

DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - hxxp://messenger.msn.com/download/msnmessengersetupdownloader.cab

DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Notify: igfxcui - igfxsrvc.dll

Notify: IntelWireless - c:\program\intel\wireless\bin\LgNotify.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

 

================= FIREFOX ===================

 

FF - ProfilePath - c:\docume~1\jessica\applic~1\mozilla\firefox\profiles\ai9he8ek.default\

 

---- FIREFOX POLICIES ----

c:\program\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program\mozilla firefox\greprefs\all.js - pref("browser.visited_color", "#551A8B");

c:\program\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\program\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\program\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.videoFeeds.handler", "ask");

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

 

============= SERVICES / DRIVERS ===============

 

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [2005-4-8 155136]

R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [2005-4-8 5248]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2010-1-31 162640]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2010-1-31 19024]

R2 avast! Antivirus;avast! Antivirus;c:\program\alwil software\avast5\AvastSvc.exe [2010-1-31 40384]

S3 avast! Mail Scanner;avast! Mail Scanner;c:\program\alwil software\avast5\AvastSvc.exe [2010-1-31 40384]

S3 avast! Web Scanner;avast! Web Scanner;c:\program\alwil software\avast5\AvastSvc.exe [2010-1-31 40384]

S3 bvrp_pci;bvrp_pci; [x]

S3 ComFiltr;Panda Anti-Dialer;\??\c:\windows\system32\drivers\comfiltr.sys --> c:\windows\system32\drivers\COMFiltr.sys [?]

S3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\pavsrk.sys --> c:\windows\system32\PavSRK.sys [?]

 

=============== Created Last 30 ================

 

2010-05-02 19:52:53 524 ----a-w- c:\docume~1\alluse~1\applic~1\fiosejgfse.dll

2010-04-29 22:28:21 0 d-----w- c:\docume~1\jessica\applic~1\Malwarebytes

2010-04-29 22:28:12 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 22:28:09 20824 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-29 22:28:09 0 d-----w- c:\program\Malwarebytes' Anti-Malware

2010-04-29 22:28:09 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-04-29 22:18:18 0 d-----w- c:\windows\pss

2010-04-29 21:52:22 0 d-----w- c:\program\Digital Protection

2010-04-20 16:48:56 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys

2010-04-20 16:48:56 25856 ----a-w- c:\windows\system32\dllcache\usbprint.sys

 

==================== Find3M ====================

 

2010-03-29 17:22:09 65988 ----a-w- c:\windows\system32\perfc01D.dat

2010-03-29 17:22:09 389578 ----a-w- c:\windows\system32\perfh01D.dat

2010-03-10 13:22:02 70656 ------w- c:\windows\system32\dllcache\ie4uinit.exe

2010-03-10 13:22:02 13824 ------w- c:\windows\system32\dllcache\ieudinit.exe

2010-03-09 11:11:42 430080 ----a-w- c:\windows\system32\vbscript.dll

2010-03-09 11:11:42 430080 ------w- c:\windows\system32\dllcache\vbscript.dll

2010-02-24 13:11:07 455680 ------w- c:\windows\system32\dllcache\mrxsmb.sys

2010-02-23 05:20:02 634648 ------w- c:\windows\system32\dllcache\iexplore.exe

2010-02-23 05:18:28 161792 ------w- c:\windows\system32\dllcache\ieakui.dll

2010-02-17 12:09:32 2190720 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-02-17 12:09:32 2190720 ------w- c:\windows\system32\dllcache\ntoskrnl.exe

2010-02-16 19:09:30 2067584 ----a-w- c:\windows\system32\ntkrnlpa.exe

2010-02-16 19:09:30 2067584 ------w- c:\windows\system32\dllcache\ntkrnlpa.exe

2010-02-16 19:09:26 2147328 ------w- c:\windows\system32\dllcache\ntkrnlmp.exe

2010-02-16 19:09:26 2025472 ------w- c:\windows\system32\dllcache\ntkrpamp.exe

2010-02-12 10:03:03 293376 ------w- c:\windows\system32\browserchoice.exe

2010-02-12 04:35:03 100864 ----a-w- c:\windows\system32\6to4svc.dll

2010-02-12 04:35:03 100864 ------w- c:\windows\system32\dllcache\6to4svc.dll

2010-02-11 12:02:15 226880 ------w- c:\windows\system32\dllcache\tcpip6.sys

2008-12-09 13:04:32 32768 --sha-w- c:\windows\system32\config\systemprofile\lokala inställningar\tidigare\history.ie5\mshist012008120920081210\index.dat

2008-04-12 18:24:37 16384 --sha-w- c:\windows\temp\history\history.ie5\index.dat

 

============= FINISH: 22:02:33,12 ===============

Attach.txt

Link to comment
Share on other sites

Hej,

Gör följande:

Spara ComboFix på Skrivbordet:

http://download.blee...Bs/ComboFix.exe

 

Stäng av alla program du ser inklusive antivirusprogram och antispionprogram men lämna brandväggen på.

Hur? Se http://www.bleepingc...opic114351.html

Kör ComboFix och följ anvisningarna som visas.

Om det kommer upp en fråga om du vill installera återställningskonsolen så svara ja.

 

VIKTIGT! Klicka inte på ComboFix-fönstret med musen när den körs annars kan den hänga upp sig.

 

När den är färdig så ska en logg komma upp, klistra in den i ditt svar. Kontrollera att antivirusprogram mm är igång innan du ansluter till internet.

 

Om du får problem med att komma ut på internet:

Kontrollpanelen - Nätverksanslutningar

högerklicka på din internetanslutning och välj Reparera och/eller starta om datorn.

 

Varning! ComboFix förhindrar automatisk körning av CD, disketter och USB-enheter för att göra det lättare att rensa datorn och skydda datorn mot infektioner i framtiden. Det kan bli problem t ex om datorn har internet via ett USB-modem eller USB-nätverkskort. Säg då till i stället för att köra ComboFix.

 

Lycka till och återkom om du har frågor, samt med logg efter körning av Combofix.

Mvh

Mats H

Link to comment
Share on other sites

hej och väldigt tack för hjälpen hittills

 

ComboFix 10-05-02.01 - Jessica 2010-05-02 22:55:26.1.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.503.285 [GMT 2:00]

Körs från: c:\documents and settings\Jessica\Skrivbord\ComboFix.exe

.

 

((((((((((((((((((((((((((((((((((((((( Andra raderingar ))))))))))))))))))))))))))))))))))))))))))))))))

.

 

c:\documents and settings\All Users\Application Data\fiosejgfse.dll

c:\documents and settings\All Users\Application Data\pragmamfeklnmal.dll

c:\documents and settings\All Users\Favoriter\_favdata.dat

c:\documents and settings\Jessica\Application Data\Microsoft\Internet Explorer\Quick Launch\Digital Protection.lnk

c:\documents and settings\Jessica\Skrivbord\nudetube.com.lnk

c:\documents and settings\Jessica\Skrivbord\pornotube.com.lnk

c:\documents and settings\Jessica\Skrivbord\youporn.com.lnk

c:\documents and settings\Jessica\Start-meny\Program\Digital Protection

c:\documents and settings\Jessica\Start-meny\Program\Digital Protection\About.lnk

c:\documents and settings\Jessica\Start-meny\Program\Digital Protection\Activate.lnk

c:\documents and settings\Jessica\Start-meny\Program\Digital Protection\Buy.lnk

c:\documents and settings\Jessica\Start-meny\Program\Digital Protection\Digital Protection Support.lnk

c:\documents and settings\Jessica\Start-meny\Program\Digital Protection\Digital Protection.lnk

c:\documents and settings\Jessica\Start-meny\Program\Digital Protection\Scan.lnk

c:\documents and settings\Jessica\Start-meny\Program\Digital Protection\Settings.lnk

c:\documents and settings\Jessica\Start-meny\Program\Digital Protection\Update.lnk

c:\program\Digital Protection

c:\program\Digital Protection\about.ico

c:\program\Digital Protection\activate.ico

c:\program\Digital Protection\buy.ico

c:\program\Digital Protection\dig.db

c:\program\Digital Protection\digext.dll

c:\program\Digital Protection\dighook.dll

c:\program\Digital Protection\digprot.exe

c:\program\Digital Protection\help.ico

c:\program\Digital Protection\scan.ico

c:\program\Digital Protection\settings.ico

c:\program\Digital Protection\splash.mp3

c:\program\Digital Protection\Uninstall.exe

c:\program\Digital Protection\update.ico

c:\program\Digital Protection\virus.mp3

c:\program\WindowsUpdate

c:\windows\jestertb.dll

c:\windows\PRAGMAgoipyyuwpc

c:\windows\PRAGMAgoipyyuwpc\PRAGMAcfg.ini

 

.

(((((((((((((((((((((((( Filer Skapade från 2010-04-02 till 2010-05-02 ))))))))))))))))))))))))))))))

.

 

2010-04-29 22:28 . 2010-04-29 22:28 -------- d-----w- c:\documents and settings\Jessica\Application Data\Malwarebytes

2010-04-29 22:28 . 2010-03-29 22:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 22:28 . 2010-04-29 22:28 -------- d-----w- c:\program\Malwarebytes' Anti-Malware

2010-04-29 22:28 . 2010-04-29 22:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-04-29 22:28 . 2010-03-29 22:45 20824 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-29 22:25 . 2010-04-29 22:25 -------- d-----w- c:\documents and settings\Administratör

2010-04-20 16:48 . 2008-04-13 17:47 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys

2010-04-20 16:48 . 2008-04-13 17:47 25856 ----a-w- c:\windows\system32\dllcache\usbprint.sys

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-05-02 20:45 . 2010-01-31 17:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software

2010-04-17 08:34 . 2010-03-02 20:44 -------- d-----w- c:\documents and settings\Jessica\Application Data\Spotify

2010-03-29 17:22 . 2005-03-23 17:49 65988 ----a-w- c:\windows\system32\perfc01D.dat

2010-03-29 17:22 . 2005-03-23 17:49 389578 ----a-w- c:\windows\system32\perfh01D.dat

2010-03-24 18:39 . 2010-03-24 18:39 -------- d-----w- c:\program\Hasbro Interactive

2010-03-11 12:37 . 2004-08-04 12:00 832512 ----a-w- c:\windows\system32\wininet.dll

2010-03-11 12:37 . 2004-08-04 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll

2010-03-11 12:37 . 2004-08-04 12:00 17408 ----a-w- c:\windows\system32\corpol.dll

2010-03-09 11:11 . 2004-08-04 12:00 430080 ----a-w- c:\windows\system32\vbscript.dll

2010-03-05 23:11 . 2010-03-05 23:11 -------- d-----w- c:\program\SverigesRadio

2010-02-24 13:11 . 2004-08-04 12:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-02-17 12:09 . 2004-08-04 12:00 2190720 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-02-16 19:09 . 2004-08-04 12:00 2067584 ----a-w- c:\windows\system32\ntkrnlpa.exe

2010-02-12 10:03 . 2010-03-07 23:01 293376 ------w- c:\windows\system32\browserchoice.exe

2010-02-12 04:35 . 2004-08-04 12:00 100864 ----a-w- c:\windows\system32\6to4svc.dll

2010-02-11 12:02 . 2004-08-04 12:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys

2010-02-05 22:54 . 2010-02-05 22:54 0 ----a-w- c:\windows\nsreg.dat

.

 

(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Not* Tomma poster & legitima standardposter visas inte.

REGEDIT4

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-10-08 155648]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-10-08 126976]

"Apoint"="c:\program\Apoint\Apoint.exe" [2004-09-13 155648]

"SunJavaUpdateSched"="c:\program\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]

"IntelWireless"="c:\program\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024]

"Dell QuickSet"="c:\program\Dell\QuickSet\quickset.exe" [2004-11-10 598016]

"DVDLauncher"="c:\program\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 57344]

"UpdateManager"="c:\program\Delade filer\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]

"DMXLauncher"="c:\program\Dell\Media Experience\DMXLauncher.exe" [2004-09-15 86016]

"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]

"ISUSPM Startup"="c:\program\DELADE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 196608]

"ISUSScheduler"="c:\program\Delade filer\InstallShield\UpdateService\issch.exe" [2004-04-13 69632]

"DAEMON Tools-1033"="c:\program\D-Tools\daemon.exe" [2004-08-22 81920]

"AdobeVersionCue"="c:\program\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe" [2003-10-22 1732608]

"AppleSyncNotifier"="c:\program\Delade filer\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]

"QuickTime Task"="c:\program\QuickTime\qttask.exe" [2008-11-04 413696]

"Family Tree Builder Update"="c:\program\MyHeritage\Bin\FTBCheckUpdates.exe" [2009-11-02 222736]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

 

c:\documents and settings\All Users\Start-meny\Program\Autostart\

Acrobat Assistant.lnk - c:\program\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193]

Adobe Gamma Loader.lnk - c:\program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe [2005-4-8 110592]

Digital Line Detect.lnk - c:\program\Digital Line Detect\DLG.exe [2005-3-23 24576]

Microsoft Office.lnk - c:\program\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]

2004-09-07 16:08 110592 ----a-w- c:\program\Intel\Wireless\Bin\LgNotify.dll

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program\\Messenger\\msmsgs.exe"=

"c:\\Program\\BitComet\\BitComet.exe"=

"c:\\Program\\VideoLAN\\VLC\\vlc.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program\\MSN Messenger\\msnmsgr.exe"=

"c:\\Program\\MSN Messenger\\livecall.exe"=

"c:\\Program\\Bonjour\\mDNSResponder.exe"=

"c:\\Program\\Spotify\\spotify.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"6969:TCP"= 6969:TCP:fildelning port 6969

 

R0 d347bus;d347bus;c:\windows\SYSTEM32\DRIVERS\d347bus.sys [2005-04-08 155136]

R0 d347prt;d347prt;c:\windows\SYSTEM32\DRIVERS\d347prt.sys [2005-04-08 5248]

S3 bvrp_pci;bvrp_pci; [x]

S3 ComFiltr;Panda Anti-Dialer;\??\c:\windows\system32\DRIVERS\COMFiltr.sys --> c:\windows\system32\DRIVERS\COMFiltr.sys [?]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\SYSTEM32\DRIVERS\mbamswissarmy.sys [2010-04-30 38224]

S3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys --> c:\windows\system32\PavSRK.sys [?]

.

Innehållet i mappen 'Schemalagda aktiviteter':

 

2010-04-20 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

.

.

------- Extra genomsökning -------

.

uStart Page = hxxp://www.google.se/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

FF - ProfilePath - c:\documents and settings\Jessica\Application Data\Mozilla\Firefox\Profiles\ai9he8ek.default\

 

---- FIREFOX POLICY ----

c:\program\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);

c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

.

- - - - FÖRÄLDRALÖSA POSTER SOM TAGITS BORT - - - -

 

SafeBoot-klmdb.sys

AddRemove-Digital Protection - c:\program\Digital Protection\Pklkvqdii+`}`

 

 

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net'>http://www.gmer.net

Rootkit scan 2010-05-02 23:05

Windows 5.1.2600 Service Pack 3 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

 

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

 

device: opened successfully

user: MBR read successfully

called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x82B7F990]<<

kernel: MBR read successfully

detected MBR rootkit hooks:

\Driver\Disk -> CLASSPNP.SYS @ 0xf8676f28

\Driver\ACPI -> ACPI.sys @ 0xf8463cb8

\Driver\atapi -> 0x82b7f990

IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579014

\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579014

NDIS: Broadcom 440x 10/100 Integrated Controller -> SendCompleteHandler -> NDIS.sys @ 0xf8297bb0

PacketIndicateHandler -> NDIS.sys @ 0xf8286a0d

SendHandler -> NDIS.sys @ 0xf829ab40

Warning: possible MBR rootkit infection !

user & kernel MBR OK

 

**************************************************************************

.

--------------------- DLLer som "laddats" under processer som körs ---------------------

 

- - - - - - - > 'winlogon.exe'(992)

c:\program\Intel\Wireless\Bin\LgNotify.dll

.

Sluttid: 2010-05-02 23:08:59

ComboFix-quarantined-files.txt 2010-05-02 21:08

 

Före genomsökningen: 39 200 239 616 byte ledigt

Efter genomsökningen: 39 708 307 456 byte ledigt

 

WindowsXP-KB310994-SP2-Home-BootDisk-SVE.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

 

- - End Of File - - BA628AFCF16F2141F4F684479CDCC9BF

Link to comment
Share on other sites

Hej,

kul att det hjälpte,

nu återstår en körning med Malwarebytes som jag ser att du har.

Återkom med resultat, en logg om något hittas, annars att allt är ok.

 

Sedan är det städning.

Hämta hem OTC

http://oldtimer.geekstogo.com/OTC.exe

Dubbelklicka på filen för att starta programmet.

Tryck på knappen CleanUp! och de olika fix-program som du har laddat ner kommer att avinstalleras, inkl. detta program, efter en omstart av datorn. Om något fix-program är kvar efter det så fråga hur du ska ta bort det.

 

1. Ta bort samtliga systemåterställningspunkter eftersom dessa kan vara infekterade.

Börja med att skapa en ny systemåterställningspunkt:

Start - Program- Tillbehör - Systemverktyg - Systemåterställning

Välj att skapa en ny återställningspunkt och tryck på Nästa.

 

Ta sedan bort alla gamla systemåterställningspunkter genom att köra diskrensningsprogrammet.

Högerklicka på C: i Den här datorn/Utforskaren och välj Egenskaper.

På fliken Allmänt finns det en knapp som heter Diskrensning. Välj den.

Efter några minuter kommer programmet upp och då väljer du en flik som heter Fler alternativ eller något likande. Tryck på den Rensa-knapp som tar bort alla systemåterställningspunkter utom den senaste.

 

2. Ta bort alla tillfälliga filer genom att ladda ner ATF-Cleaner på Skrivbordet:

http://www.atribune..../click.php?id=1

Stäng av alla andra program, särskilt webbläsare.

Dubbelklicka på ATF-Cleaner.exe för att starta programmet.

Bocka i Select All. Tryck på Empty Selected.

 

Om du använder Firefox: Tryck på Firefox och välj Select All. Tryck på Empty Selected. Om du vill ha kvar dina lösenord så tryck No vid frågan.

 

Om du använder Opera: Tryck på Opera och välj Select All. Tryck på Empty Selected. Om du vill ha kvar dina lösenord så tryck No vid frågan.

Tryck på Exit i Main-menyn för att stänga programmet.

 

Obs! Detta kommer att ta bort alla cookies, om du har cookies som du vill ha kvar så får du antingen spara undan dem innan eller låta bli att välja Select All och i stället markera allt annat.

 

3. Byt alla lösenord som du använder i datorn och på internet eftersom dessa kan ha kommit i orätta händer.

 

Att uppdatera:

Adobe Reader, till version 9.3 hittas här http://get.adobe.com/se/reader/

Avinstallera den gamla Java versionen från KOntrollpanelen, Lägg till / Ta bort program, installera ny här: http://www.java.com/sv/

 

Återkom med Malwarebytes svar och om du har fler frågor.

Hoppas att din dator fungerar bättre nu.

Mvh

Mats H

Link to comment
Share on other sites

Beklagar, men datorn är nog inte ren än. Om du inte har följt Mats inlägg än så vänta med det.

 

1. Spara DeFogger by jpshortstuff http://www.jpshortstuff.247fixes.com/Defogger.exe på Skrivbordet.

 

Starta DeFogger.

När programmets fönster kommer upp trycker du på knappen Disable för att inaktivera drivrutinerna som hör ihop med ditt installerade CD-emuleringsprogram.

Tryck på Yes/Ja för att fortsätta.

När programmet är klart kommer det upp ett meddelande 'Finished!'.

Tryck på OK.

Programmet ber om omstart av datorn, tryck på OK.

 

VIKTIGT! Om du får ett felmeddelande medan DeFogger kör, så klistra in loggen defogger_disable som då skapas på Skrivbordet.

 

Aktivera inte dessa drivrutiner innan rensningen är helt klar.

 

2. Spara Gmer på Skrivbordet från:

http://www2.gmer.net/download.php

Den har ett slumpmässigt namn så notera vad programmet sparas som.

 

Dra ur internetanslutningen.

Stäng alla program, även antivirusprogram och brandvägg.

Starta det nedladdade programmet.

En första snabbskanning startar.

Om det kommer upp en WARNING som nämner ROOTKIT och frågar om "fully scan" så välj Nej/No. Spara loggen och klistra in i ditt svar. Gör inte mer.

 

Om frågan inte kommer så välj fliken Rootkit/Malware, kontrollera att allt är förbockat till höger utom Show All och andra partitioner än C:\. Tryck på Scan. Låt datorn stå ifred medan Gmer håller på.

Tryck på Save och spara resultatet på Skrivbordet.

Sätt igång antivirusprogram och brandvägg innan du ansluter till internet.

Klistra in resultatet i ditt svar.

 

3. Ladda ner och kör detta program:

http://www2.gmer.net/mbr/mbr.exe

Klistra in innehållet i mbr.log som skapas i samma mapp som där mbr.exe ligger (t ex på Skrivbordet om mbr.exe finns på Skrivbordet).

 

Obs! Dra ur internetanslutningen och inaktivera/stäng av antivirus- och andra säkerhetsprogram innan du kör mbr.exe.

Link to comment
Share on other sites

Brynäsarn

Jag ser i DDS-loggen att det finns en väldigt gammal java-version med säkerhetshål

i datorn,jag rekommenderar att du laddar hem uppdaterad version http://www.java.com/sv/

Avinstallera sedan den gamla....

Link to comment
Share on other sites

Hej,

vill bara be "Dana" om att avvakta alla uppdateringar av program till ev. virusinfektion är borttagen.

"Brynäsarens" kommentar är givetvis riktig, och den punkten kommer vi till vid avlutning av det hela.

Mvh

Mats H

Link to comment
Share on other sites

hej cecilia har gjort som du sagt och här är loggen.

 

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2010-05-03 22:22:21

Windows 5.1.2600 Service Pack 3

Running: 9ph2tnru.exe; Driver: C:\DOCUME~1\Jessica\LOKALA~1\Temp\pwroyaog.sys

 

 

---- User code sections - GMER 1.0.15 ----

 

.text C:\Program\Mozilla Firefox\firefox.exe[2192] ntdll.dll!LdrLoadDll 7C9163C3 5 Bytes JMP 004013F0 C:\Program\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)

 

---- Devices - GMER 1.0.15 ----

 

Device \FileSystem\Fastfat \Fat A9472D20

Device \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

Device \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

Device \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

Device \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

Device \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

 

---- EOF - GMER 1.0.15 ----

Link to comment
Share on other sites

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

 

device: opened successfully

user: MBR read successfully

kernel: MBR read successfully

user & kernel MBR OK

Link to comment
Share on other sites

1. Ladda ner Malwarebytes Anti-Malware (MBAM) från:

http://www.malwarebytes.org/mbam.php

Dubbelklicka på mbam-setup för att installera programmet.

 

Se till i slutet av installationen att det är bockar för:

Uppdatera Malwarebytes' Anti-Malware

Starta Malwarebytes' Anti-Malware

Tryck på Slutför

Om det finns någon uppdatering så kommer den att laddas ner och installeras.

 

När programmet startar så välj "Utför full skanning" och tryck på Skanna.

Skanningen tar ett tag.

När den är klar så tryck på OK och sedan "Visa resultat".

Bocka för allt och tryck sedan Ta bort markerade.

När borttagningen är klar så öppnar Anteckningar med en logg.

 

Eventuellt så kommer det upp en begäran om att starta om datorn (Restart). I så fall gör det.

Om det blir ett felmeddelande Error loading... efter omstarten så starta om datorn än en gång.

Om programmet inte kommer igång efter omstarten så starta det.

 

Om loggen inte kommer upp själv i Anteckningar så hittar du loggen på fliken Loggar i MBAM.

Kopiera loggen och klistra in den i ditt svar.

 

2. Spara denna fil på Skrivbordet:

http://rootrepeal.googlepages.com/RootRepeal.zip

Packa upp zip-filen (extrahera) så att du får en programfil.

 

Dra ut internetanslutningen. Stäng av alla program du ser inklusive brandvägg, antivirusprogram och antispionprogram.

Hur? Se http://www.bleepingcomputer.com/forums/topic114351.html

 

Starta RootRepeal (i Vista och Windows 7 som vanligt genom att högerklicka på ikonen och välja Kör som administratör).

Välj Report-fliken och tryck på Scan.

Bocka för alla sju valen och tryck sedan på Yes/Ja.

Välj C: och tryck Ok.

Det tar ett tag för RootRepeal att söka igenom C:.

När sökningen är klar så tryck på Save Report och spara den med namnet rootrepeal.log. Klistra in innehållet i rootrepeal.log i ditt svar.

 

3. Spara HAMeb_Check by noahdfear på Skrivbordet.

http://noahdfear.net/downloads/HAMeb_check.exe

Kör programmet och klistra in loggen i ditt svar.

Link to comment
Share on other sites

här kommer det.

 

 

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

 

Databasversion: 4065

 

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.11

 

2010-05-04 19:27:21

mbam-log-2010-05-04 (19-27-21).txt

 

Skanningstyp: Fullständig skanning (C:\|)

Antal skannade objekt: 183955

Förfluten tid: 39 minut(er), 44 sekund(er)

 

Infekterade minnesprocesser: 0

Infekterade minnesmoduler: 0

Infekterade registernycklar: 0

Infekterade registervärden: 0

Infekterade registerdataposter: 0

Infekterade mappar: 0

Infekterade filer: 8

 

Infekterade minnesprocesser:

(Inga illasinnade poster hittades)

 

Infekterade minnesmoduler:

(Inga illasinnade poster hittades)

 

Infekterade registernycklar:

(Inga illasinnade poster hittades)

 

Infekterade registervärden:

(Inga illasinnade poster hittades)

 

Infekterade registerdataposter:

(Inga illasinnade poster hittades)

 

Infekterade mappar:

(Inga illasinnade poster hittades)

 

Infekterade filer:

C:\Qoobox\Quarantine\C\Program\Digital Protection\digext.dll.vir (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\Program\Digital Protection\dighook.dll.vir (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\Program\Digital Protection\digprot.exe.vir (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\Program\Digital Protection\Uninstall.exe.vir (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{619781AC-CF96-4B2F-8E58-2353903809FC}\RP287\A0097694.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{619781AC-CF96-4B2F-8E58-2353903809FC}\RP287\A0097692.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{619781AC-CF96-4B2F-8E58-2353903809FC}\RP287\A0097693.dll (Malware.Packer.Gen) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{619781AC-CF96-4B2F-8E58-2353903809FC}\RP287\A0097698.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.

Link to comment
Share on other sites

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2010/05/04 19:35

Program Version: Version 1.3.5.0

Windows Version: Windows XP SP3

==================================================

 

Drivers

-------------------

Name: dump_atapi.sys

Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys

Address: 0xAA5C1000 Size: 98304 File Visible: No Signed: -

Status: -

 

Name: dump_WMILIB.SYS

Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS

Address: 0xF8B06000 Size: 8192 File Visible: No Signed: -

Status: -

 

Name: hspwt.sys

Image Path: hspwt.sys

Address: 0xF85B2000 Size: 54016 File Visible: No Signed: -

Status: -

 

Name: rootrepeal.sys

Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys

Address: 0xA9589000 Size: 49152 File Visible: No Signed: -

Status: -

 

Hidden/Locked Files

-------------------

Path: C:\hiberfil.sys

Status: Locked to the Windows API!

 

==EOF==

Link to comment
Share on other sites

C:\Documents and Settings\Jessica\Skrivbord\HAMeb_check.exe

2010-05-04 at 19:56:40,26

 

No HelpAssistant account in User list

 

 

~~ Checking profile list ~~

 

No HelpAssistant profile in registry

 

~~ Checking for HelpAssistant directories ~~

 

none found

 

~~ Checking mbr ~~

 

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

 

device: opened successfully

user: MBR read successfully

called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS

kernel: MBR read successfully

user & kernel MBR OK

 

~~ Checking for termsrv32.dll ~~

 

termsrv32.dll was not found

 

 

HKEY_LOCAL_MACHINE\system\currentcontrolset\services\termservice\parameters

ServiceDll REG_EXPAND_SZ %SystemRoot%\System32\termsrv.dll

 

~~ Checking firewall ports ~~

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile\GloballyOpenPorts\List]

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

 

 

~~ EOF ~~

Link to comment
Share on other sites

Kopiera alla rader i rutan:

KILLALL::
Rootkit::
c:\windows\system32\drivers\hspwt.sys

och klistra in i Anteckningar.

Spara filen på Skrivbordet med namnet CFScript.

 

Förbered datorn på samma sätt som tidigare för ComboFix.

Dra CFScript med musen och släpp den ovanpå ComboFix-ikonen på Skrivbordet så startar programmet på ett särskilt sätt.

Klistra in loggen som kommer ut.

Link to comment
Share on other sites

här kommer den och tack för all hjälp hittills.

 

 

ComboFix 10-05-02.01 - Jessica 2010-05-04 22:56:28.2.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.503.263 [GMT 2:00]

Körs från: c:\documents and settings\Jessica\Skrivbord\ComboFix.exe

Använda kommandoväxlar :: c:\documents and settings\Jessica\Skrivbord\CFScript.txt

.

 

(((((((((((((((((((((((( Filer Skapade från 2010-04-04 till 2010-05-04 ))))))))))))))))))))))))))))))

.

 

2010-04-29 22:28 . 2010-04-29 22:28 -------- d-----w- c:\documents and settings\Jessica\Application Data\Malwarebytes

2010-04-29 22:28 . 2010-04-29 13:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 22:28 . 2010-05-04 16:44 -------- d-----w- c:\program\Malwarebytes' Anti-Malware

2010-04-29 22:28 . 2010-04-29 22:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-04-29 22:28 . 2010-04-29 13:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-29 22:25 . 2010-04-29 22:25 -------- d-----w- c:\documents and settings\Administratör

2010-04-20 16:48 . 2008-04-13 17:47 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys

2010-04-20 16:48 . 2008-04-13 17:47 25856 ----a-w- c:\windows\system32\dllcache\usbprint.sys

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-05-02 20:45 . 2010-01-31 17:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software

2010-04-17 08:34 . 2010-03-02 20:44 -------- d-----w- c:\documents and settings\Jessica\Application Data\Spotify

2010-03-29 17:22 . 2005-03-23 17:49 65988 ----a-w- c:\windows\system32\perfc01D.dat

2010-03-29 17:22 . 2005-03-23 17:49 389578 ----a-w- c:\windows\system32\perfh01D.dat

2010-03-24 18:39 . 2010-03-24 18:39 -------- d-----w- c:\program\Hasbro Interactive

2010-03-11 12:37 . 2004-08-04 12:00 832512 ----a-w- c:\windows\system32\wininet.dll

2010-03-11 12:37 . 2004-08-04 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll

2010-03-11 12:37 . 2004-08-04 12:00 17408 ----a-w- c:\windows\system32\corpol.dll

2010-03-09 11:11 . 2004-08-04 12:00 430080 ----a-w- c:\windows\system32\vbscript.dll

2010-03-05 23:11 . 2010-03-05 23:11 -------- d-----w- c:\program\SverigesRadio

2010-02-24 13:11 . 2004-08-04 12:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-02-17 12:09 . 2004-08-04 12:00 2190720 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-02-16 19:09 . 2004-08-04 12:00 2067584 ----a-w- c:\windows\system32\ntkrnlpa.exe

2010-02-12 10:03 . 2010-03-07 23:01 293376 ------w- c:\windows\system32\browserchoice.exe

2010-02-12 04:35 . 2004-08-04 12:00 100864 ----a-w- c:\windows\system32\6to4svc.dll

2010-02-11 12:02 . 2004-08-04 12:00 226880 ----a-w- c:\windows\system32\drivers\tcpip6.sys

2010-02-05 22:54 . 2010-02-05 22:54 0 ----a-w- c:\windows\nsreg.dat

.

 

(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Not* Tomma poster & legitima standardposter visas inte.

REGEDIT4

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-10-08 155648]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-10-08 126976]

"Apoint"="c:\program\Apoint\Apoint.exe" [2004-09-13 155648]

"SunJavaUpdateSched"="c:\program\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]

"IntelWireless"="c:\program\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024]

"Dell QuickSet"="c:\program\Dell\QuickSet\quickset.exe" [2004-11-10 598016]

"DVDLauncher"="c:\program\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 57344]

"UpdateManager"="c:\program\Delade filer\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]

"DMXLauncher"="c:\program\Dell\Media Experience\DMXLauncher.exe" [2004-09-15 86016]

"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]

"ISUSPM Startup"="c:\program\DELADE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 196608]

"ISUSScheduler"="c:\program\Delade filer\InstallShield\UpdateService\issch.exe" [2004-04-13 69632]

"DAEMON Tools-1033"="c:\program\D-Tools\daemon.exe" [2004-08-22 81920]

"AdobeVersionCue"="c:\program\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe" [2003-10-22 1732608]

"AppleSyncNotifier"="c:\program\Delade filer\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]

"QuickTime Task"="c:\program\QuickTime\qttask.exe" [2008-11-04 413696]

"Family Tree Builder Update"="c:\program\MyHeritage\Bin\FTBCheckUpdates.exe" [2009-11-02 222736]

 

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

 

c:\documents and settings\All Users\Start-meny\Program\Autostart\

Acrobat Assistant.lnk - c:\program\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe [2003-5-15 217193]

Adobe Gamma Loader.lnk - c:\program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe [2005-4-8 110592]

Digital Line Detect.lnk - c:\program\Digital Line Detect\DLG.exe [2005-3-23 24576]

Microsoft Office.lnk - c:\program\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]

2004-09-07 16:08 110592 ----a-w- c:\program\Intel\Wireless\Bin\LgNotify.dll

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program\\Messenger\\msmsgs.exe"=

"c:\\Program\\BitComet\\BitComet.exe"=

"c:\\Program\\VideoLAN\\VLC\\vlc.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program\\MSN Messenger\\msnmsgr.exe"=

"c:\\Program\\MSN Messenger\\livecall.exe"=

"c:\\Program\\Bonjour\\mDNSResponder.exe"=

"c:\\Program\\Spotify\\spotify.exe"=

 

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"6969:TCP"= 6969:TCP:fildelning port 6969

 

S3 bvrp_pci;bvrp_pci; [x]

S3 ComFiltr;Panda Anti-Dialer;\??\c:\windows\system32\DRIVERS\COMFiltr.sys --> c:\windows\system32\DRIVERS\COMFiltr.sys [?]

S3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys --> c:\windows\system32\PavSRK.sys [?]

S4 d347bus;d347bus;c:\windows\SYSTEM32\DRIVERS\d347bus.sys [2005-04-08 155136]

S4 d347prt;d347prt;c:\windows\SYSTEM32\DRIVERS\d347prt.sys [2005-04-08 5248]

.

Innehållet i mappen 'Schemalagda aktiviteter':

 

2010-04-20 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]

.

.

------- Extra genomsökning -------

.

uStart Page = hxxp://www.google.se/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

FF - ProfilePath - c:\documents and settings\Jessica\Application Data\Mozilla\Firefox\Profiles\ai9he8ek.default\

FF - prefs.js: browser.startup.homepage - www.google.se

 

---- FIREFOX POLICY ----

c:\program\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);

c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

.

 

**************************************************************************

 

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-05-04 23:04

Windows 5.1.2600 Service Pack 3 NTFS

 

scanning hidden processes ...

 

scanning hidden autostart entries ...

 

scanning hidden files ...

 

scan completed successfully

hidden files: 0

 

**************************************************************************

.

--------------------- DLLer som "laddats" under processer som körs ---------------------

 

- - - - - - - > 'winlogon.exe'(972)

c:\program\Intel\Wireless\Bin\LgNotify.dll

 

- - - - - - - > 'explorer.exe'(1376)

c:\program\WINDOW~2\wmpband.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Andra processer som körs ------------------------

.

c:\program\Intel\Wireless\Bin\EvtEng.exe

c:\program\Intel\Wireless\Bin\S24EvMon.exe

c:\program\Intel\Wireless\Bin\WLKeeper.exe

c:\program\Intel\Wireless\Bin\ZcfgSvc.exe

c:\program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program\Bonjour\mDNSResponder.exe

c:\program\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

c:\program\Intel\Wireless\Bin\RegSrvc.exe

c:\program\Intel\Wireless\Bin\1XConfig.exe

c:\windows\system32\wscntfy.exe

c:\program\Apoint\Apntex.exe

c:\program\Java\jre1.6.0_05\bin\jucheck.exe

.

**************************************************************************

.

Sluttid: 2010-05-04 23:09:28 - datorn startades om.

ComboFix-quarantined-files.txt 2010-05-04 21:09

ComboFix2.txt 2010-05-02 21:09

 

Före genomsökningen: 39 665 864 704 byte ledigt

Efter genomsökningen: 39 634 210 816 byte ledigt

 

- - End Of File - - E9CC2853DA1C8A7C736BD5169E5E0726

Link to comment
Share on other sites

Starta Kommandotolken (Start - Program - Tillbehör) och skriv:

sc delete bvrp_pci

sc delete ComFiltr

sc delete PavSRK.sys

 

Vad har hänt med Avast?

 

Starta om datorn och klistra in nya loggar från RootRepeal och DDS.

Link to comment
Share on other sites

fick avinstalera avast tidigare pga att de inte fungerade alls. tänkte instalera det igen sen.

 

hur får jag nya loggar från rootrepeal och dds??

Link to comment
Share on other sites

DDS (Ver_10-03-17.01) - NTFSx86

Run by Jessica at 0:15:22,67 on 2010-05-05

Internet Explorer: 7.0.5730.11

Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.503.256 [GMT 2:00]

 

 

============== Running Processes ===============

 

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Program\Intel\Wireless\Bin\EvtEng.exe

C:\Program\Intel\Wireless\Bin\S24EvMon.exe

C:\Program\Intel\Wireless\Bin\WLKeeper.exe

C:\Program\Intel\Wireless\Bin\ZcfgSvc.exe

C:\WINDOWS\Explorer.EXE

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program\Bonjour\mDNSResponder.exe

C:\Program\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

C:\Program\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\wuauclt.exe

C:\Program\Intel\Wireless\Bin\1XConfig.exe

C:\Program\Apoint\Apoint.exe

C:\Program\Java\jre1.6.0_05\bin\jusched.exe

C:\Program\Intel\Wireless\Bin\ifrmewrk.exe

C:\Program\Dell\QuickSet\quickset.exe

C:\Program\CyberLink\PowerDVD\DVDLauncher.exe

C:\Program\Delade filer\Sonic\Update Manager\sgtray.exe

C:\Program\Dell\Media Experience\DMXLauncher.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program\Delade filer\InstallShield\UpdateService\issch.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe

C:\Program\MyHeritage\Bin\FTBCheckUpdates.exe

C:\Program\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe

C:\Program\Apoint\Apntex.exe

C:\Program\Digital Line Detect\DLG.exe

C:\Documents and Settings\Jessica\Skrivbord\dds.scr

 

============== Pseudo HJT Report ===============

 

uStart Page = hxxp://www.google.se/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program\adobe\adobe acrobat 6.0\acrobat\activex\AcroIEHelper.dll

BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program\java\jre1.6.0_05\bin\ssv.dll

BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File

BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program\adobe\adobe acrobat 6.0\acrobat\AcroIEFavClient.dll

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program\adobe\adobe acrobat 6.0\acrobat\AcroIEFavClient.dll

TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File

TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File

TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Apoint] c:\program\apoint\Apoint.exe

mRun: [sunJavaUpdateSched] "c:\program\java\jre1.6.0_05\bin\jusched.exe"

mRun: [intelWireless] c:\program\intel\wireless\bin\ifrmewrk.exe /tf Intel PROSet/Wireless

mRun: [Dell QuickSet] c:\program\dell\quickset\quickset.exe

mRun: [DVDLauncher] "c:\program\cyberlink\powerdvd\DVDLauncher.exe"

mRun: [updateManager] "c:\program\delade filer\sonic\update manager\sgtray.exe" /r

mRun: [DMXLauncher] c:\program\dell\media experience\DMXLauncher.exe

mRun: [dla] c:\windows\system32\dla\tfswctrl.exe

mRun: [iSUSPM Startup] c:\program\delade~1\instal~1\update~1\ISUSPM.exe -startup

mRun: [iSUSScheduler] "c:\program\delade filer\installshield\updateservice\issch.exe" -start

mRun: [DAEMON Tools-1033] "c:\program\d-tools\daemon.exe" -lang 1033

mRun: [AdobeVersionCue] c:\program\adobe\adobe version cue\controlpanel\VersionCueTray.exe

mRun: [AppleSyncNotifier] c:\program\delade filer\apple\mobile device support\bin\AppleSyncNotifier.exe

mRun: [QuickTime Task] "c:\program\quicktime\qttask.exe" -atboottime

mRun: [Family Tree Builder Update] c:\program\myheritage\bin\FTBCheckUpdates.exe

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\acroba~1.lnk - c:\program\adobe\adobe acrobat 6.0\distillr\acrotray.exe

StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\adobeg~1.lnk - c:\program\delade filer\adobe\calibration\Adobe Gamma Loader.exe

StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\digita~1.lnk - c:\program\digital line detect\DLG.exe

StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\micros~1.lnk - c:\program\microsoft office\office\OSA9.EXE

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program\java\jre1.6.0_05\bin\ssv.dll

DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab

DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} - hxxps://components.viewpoint.com/MTSInstallers/MetaStream3.cab?url=http://www.viewpoint.com/cgi-bin/installer.v4/vet_install_premium.pl?1&6&04.00.09.13&premium&unknown&http://62.3.133.38/SE/24_3d_view_my_car_pop.jsp?noreloadredir

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136561260750

DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - hxxp://82.193.160.173/activex/AxisCamControl.ocx

DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} - hxxp://messenger.msn.com/download/msnmessengersetupdownloader.cab

DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Notify: igfxcui - igfxsrvc.dll

Notify: IntelWireless - c:\program\intel\wireless\bin\LgNotify.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

 

================= FIREFOX ===================

 

FF - ProfilePath - c:\docume~1\jessica\applic~1\mozilla\firefox\profiles\ai9he8ek.default\

FF - prefs.js: browser.startup.homepage - www.google.se

 

---- FIREFOX POLICIES ----

c:\program\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program\mozilla firefox\greprefs\all.js - pref("browser.visited_color", "#551A8B");

c:\program\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\program\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\program\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.videoFeeds.handler", "ask");

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

 

============= SERVICES / DRIVERS ===============

 

S4 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [2005-4-8 155136]

S4 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [2005-4-8 5248]

 

=============== Created Last 30 ================

 

2010-05-04 20:55:06 0 d-----w- C:\ComboFix

2010-05-03 20:03:22 52 ----a-w- c:\documents and settings\jessica\defogger_reenable

2010-05-02 20:50:26 0 d-sha-r- C:\cmdcons

2010-05-02 20:49:33 98816 ----a-w- c:\windows\sed.exe

2010-05-02 20:49:33 77312 ----a-w- c:\windows\MBR.exe

2010-05-02 20:49:33 256512 ----a-w- c:\windows\PEV.exe

2010-05-02 20:49:33 161792 ----a-w- c:\windows\SWREG.exe

2010-04-29 22:28:21 0 d-----w- c:\docume~1\jessica\applic~1\Malwarebytes

2010-04-29 22:28:12 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 22:28:09 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-29 22:28:09 0 d-----w- c:\program\Malwarebytes' Anti-Malware

2010-04-29 22:28:09 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-04-29 22:18:18 0 d-----w- c:\windows\pss

2010-04-20 16:48:56 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys

2010-04-20 16:48:56 25856 ----a-w- c:\windows\system32\dllcache\usbprint.sys

 

==================== Find3M ====================

 

2010-03-29 17:22:09 65988 ----a-w- c:\windows\system32\perfc01D.dat

2010-03-29 17:22:09 389578 ----a-w- c:\windows\system32\perfh01D.dat

2010-03-10 13:22:02 70656 ------w- c:\windows\system32\dllcache\ie4uinit.exe

2010-03-10 13:22:02 13824 ------w- c:\windows\system32\dllcache\ieudinit.exe

2010-03-09 11:11:42 430080 ----a-w- c:\windows\system32\vbscript.dll

2010-03-09 11:11:42 430080 ------w- c:\windows\system32\dllcache\vbscript.dll

2010-02-24 13:11:07 455680 ------w- c:\windows\system32\dllcache\mrxsmb.sys

2010-02-23 05:20:02 634648 ------w- c:\windows\system32\dllcache\iexplore.exe

2010-02-23 05:18:28 161792 ------w- c:\windows\system32\dllcache\ieakui.dll

2010-02-17 12:09:32 2190720 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-02-17 12:09:32 2190720 ------w- c:\windows\system32\dllcache\ntoskrnl.exe

2010-02-16 19:09:30 2067584 ----a-w- c:\windows\system32\ntkrnlpa.exe

2010-02-16 19:09:30 2067584 ------w- c:\windows\system32\dllcache\ntkrnlpa.exe

2010-02-16 19:09:26 2147328 ------w- c:\windows\system32\dllcache\ntkrnlmp.exe

2010-02-16 19:09:26 2025472 ------w- c:\windows\system32\dllcache\ntkrpamp.exe

2010-02-12 10:03:03 293376 ------w- c:\windows\system32\browserchoice.exe

2010-02-12 04:35:03 100864 ----a-w- c:\windows\system32\6to4svc.dll

2010-02-12 04:35:03 100864 ------w- c:\windows\system32\dllcache\6to4svc.dll

2010-02-11 12:02:15 226880 ------w- c:\windows\system32\dllcache\tcpip6.sys

2008-12-09 13:04:32 32768 --sha-w- c:\windows\system32\config\systemprofile\lokala inställningar\tidigare\history.ie5\mshist012008120920081210\index.dat

 

============= FINISH: 0:16:00,56 ===============

Link to comment
Share on other sites

här kommer nästa

 

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2010/05/05 00:29

Program Version: Version 1.3.5.0

Windows Version: Windows XP SP3

==================================================

 

Drivers

-------------------

Name: dump_atapi.sys

Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys

Address: 0xAA4D1000 Size: 98304 File Visible: No Signed: -

Status: -

 

Name: dump_WMILIB.SYS

Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS

Address: 0xF8B24000 Size: 8192 File Visible: No Signed: -

Status: -

 

Name: rootrepeal.sys

Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys

Address: 0xA9441000 Size: 49152 File Visible: No Signed: -

Status: -

 

Hidden/Locked Files

-------------------

Path: C:\hiberfil.sys

Status: Locked to the Windows API!

 

==EOF==

Link to comment
Share on other sites

Det är många gamla Java-versioner med många säkerhetshål i datorn. Installera en ny från http://www.java.com/sv/ och därefter avinstallera följande (inga webbläsare igång):

J2SE Runtime Environment 5.0 Update 10

J2SE Runtime Environment 5.0 Update 11

J2SE Runtime Environment 5.0 Update 4

J2SE Runtime Environment 5.0 Update 6

J2SE Runtime Environment 5.0 Update 9

Java 2 Runtime Environment, SE v1.4.2_03

Java™ 6 Update 2

Java™ 6 Update 3

Java™ 6 Update 5

Java™ SE Runtime Environment 6 Update 1

 

Även VLC och Adobe Reader är gamla versioner med säkerhetshål. I ditt fall med en svag dator så föreslår jag att du byter ut Adobe Reader mot Sumatra PDF som är ett litet och snabbt program. För ytterligare kontroll av om det finns program med säkerhetshål låt Secunias Software Inspector kolla upp datorn.

 

Håller du på och kör RootRepeal också?

Link to comment
Share on other sites

Och där hade RootRepeal-loggen kommit också! :)

 

Den ser ju fin ut.

 

Det finns någon mindre sak som behöver tas bort med HijackThis. Ladda ner från en av länkarna:

http://go.trendmicro.com/free-tools/hijackthis/HiJackThis.msi (bästa alternativet)

http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html

http://go.trendmicro.com/free-tools/hijackthis/HiJackThis.exe

Installera, starta och välj "Do a system scan and save a logfile", kopiera loggen som kommer upp (inget annat) och klistra in i ditt svar.

Link to comment
Share on other sites

här kommer denna

 

 

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 00:54:01, on 2010-05-05

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.17023)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program\Intel\Wireless\Bin\EvtEng.exe

C:\Program\Intel\Wireless\Bin\S24EvMon.exe

C:\Program\Intel\Wireless\Bin\WLKeeper.exe

C:\Program\Intel\Wireless\Bin\ZcfgSvc.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program\Bonjour\mDNSResponder.exe

C:\Program\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

C:\Program\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program\Apoint\Apoint.exe

C:\Program\Java\jre1.6.0_05\bin\jusched.exe

C:\Program\Intel\Wireless\Bin\ifrmewrk.exe

C:\Program\Dell\QuickSet\quickset.exe

C:\Program\CyberLink\PowerDVD\DVDLauncher.exe

C:\Program\Dell\Media Experience\DMXLauncher.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program\Delade filer\InstallShield\UpdateService\issch.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe

C:\Program\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe

C:\Program\Apoint\Apntex.exe

C:\Program\Digital Line Detect\DLG.exe

C:\Program\Intel\Wireless\Bin\1XConfig.exe

C:\Program\Java\jre1.6.0_05\bin\jucheck.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program\Trend Micro\HiJackThis\HiJackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.se/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157'>http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896'>http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Adobe Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program\Adobe\Adobe Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Apoint] C:\Program\Apoint\Apoint.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [intelWireless] C:\Program\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless

O4 - HKLM\..\Run: [Dell QuickSet] C:\Program\Dell\QuickSet\quickset.exe

O4 - HKLM\..\Run: [DVDLauncher] "C:\Program\CyberLink\PowerDVD\DVDLauncher.exe"

O4 - HKLM\..\Run: [updateManager] "C:\Program\Delade filer\Sonic\Update Manager\sgtray.exe" /r

O4 - HKLM\..\Run: [DMXLauncher] C:\Program\Dell\Media Experience\DMXLauncher.exe

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [iSUSPM Startup] C:\Program\DELADE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program\Delade filer\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program\D-Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Family Tree Builder Update] C:\Program\MyHeritage\Bin\FTBCheckUpdates.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Acrobat Assistant.lnk = C:\Program\Adobe\Adobe Acrobat 6.0\Distillr\acrotray.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Digital Line Detect.lnk = ?

O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office\OSA9.EXE

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab

O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstallers/MetaStream3.cab?url=http://www.viewpoint.com/cgi-bin/installer.v4/vet_install_premium.pl?1&6&04.00.09.13&premium&unknown&http://62.3.133.38/SE/24_3d_view_my_car_pop.jsp?noreloadredir

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1136561260750

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://82.193.160.173/activex/AxisCamControl.ocx

O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program\Adobe\Adobe Version Cue\service\VersionCue.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour-tjänst (Bonjour Service) - Apple Inc. - C:\Program\Bonjour\mDNSResponder.exe

O23 - Service: EvtEng - Intel Corporation - C:\Program\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

O23 - Service: RegSrvc - Intel Corporation - C:\Program\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program\Intel\Wireless\Bin\WLKeeper.exe

 

--

End of file - 8138 bytes

Link to comment
Share on other sites

Kollade lite till och du skulle kunna avinstallera BitComet, Bonjour och Viewpoint Media Player, om du inte vet att det verkligen är något du använder.

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.



×
×
  • Create New...