Reklam och popup +Hijackthis

[JoshuaB]

Körde en hijackthisscan på skollaptopen och hittade flera skräpfiler...

 

[log]Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:02:16, on 2010-05-11

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program\IVT Corporation\BlueSoleil\BlueSoleilCS.exe

C:\Program\Bonjour\mDNSResponder.exe

C:\Program\LogMeIn Hamachi\hamachi-2.exe

C:\Program\CA\SharedComponents\iTechnology\igateway.exe

C:\Program\CA\eTrustITM\InoRpc.exe

C:\Program\CA\eTrustITM\InoRT.exe

C:\Program\CA\eTrustITM\InoTask.exe

C:\Program\Java\jre6\bin\jqs.exe

C:\WINDOWS\system32\lkcitdl.exe

C:\WINDOWS\system32\lkads.exe

C:\WINDOWS\system32\lktsrv.exe

C:\Program\Delade filer\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program\Novell\ZENworks\nalntsrv.exe

C:\Program\National Instruments\Shared\Security\nidmsrv.exe

C:\WINDOWS\system32\nisvcloc.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Program\Novell\ZENworks\RemoteManagement\RMAgent\WolSerNT.exe

C:\Program\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe

C:\Program\SolidWorks\COSMOS\FloWorks\binCFW\StandAloneSlv.exe

C:\Program\Novell\ZENworks\wm.exe

C:\WINDOWS\Explorer.EXE

C:\Program\Novell\ZENworks\WMRUNDLL.EXE

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\stsystra.exe

C:\Program\CA\eTrustITM\realmon.exe

C:\WINDOWS\system32\NWTRAY.EXE

C:\WINDOWS\system32\dpmw32.exe

C:\Program\iTunes\iTunesHelper.exe

C:\Program\Java\jre6\bin\jusched.exe

C:\Program\CyberLink\PowerDVD DX\PDVDDXSrv.exe

C:\Program\IVT Corporation\BlueSoleil\BtTray.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\Delade filer\InstallShield\UpdateService\ISUSPM.exe

C:\Program\Spybot - Search & Destroy\TeaTimer.exe

C:\Program\McAfee Security Scan\1.0.150\SSScheduler.exe

C:\Program\IVT Corporation\BlueSoleil\BsHelpCS.exe

C:\Program\iPod\bin\iPodService.exe

C:\DOCUME~1\ullvi\LOKALA~1\Temp\9808637.exe

C:\Program\DAEMON Tools Lite\DTLite.exe

C:\Program\uTorrent\uTorrent.exe

C:\Program\Mozilla Firefox\firefox.exe

C:\Program\Trend Micro\HijackThis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.update.microsoft.com/windowsupdate/v6/default.aspx?ln=sv

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157'>http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896'>http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe

O2 - BHO: Länkhjälp till Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Delade filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program\Adobe\/Adobe Contribute CS3/contributeieplugin.dll

O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program\Windows Desktop Search\dsWebAllow.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: Windows Live inloggningshjälpen - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [sigmatelSysTrayApp] stsystra.exe

O4 - HKLM\..\Run: [Realtime Monitor] "C:\Program\CA\eTrustITM\realmon.exe" -s

O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE

O4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINDOWS\system32\zentray.exe

O4 - HKLM\..\Run: [NDPS] C:\WINDOWS\system32\dpmw32.exe

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\Program\DELADE~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program\CyberLink\PowerDVD DX\PDVDDXSrv.exe"

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [btTray] "C:\Program\IVT Corporation\BlueSoleil\BtTray.exe"

O4 - HKLM\..\Run: [subsystem Monitor] C:\WINDOWS\system32\csrns.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [iSUSPM] "C:\Program\Delade filer\InstallShield\UpdateService\ISUSPM.exe" -scheduler

O4 - HKCU\..\Run: [eafqb] C:\WINDOWS\system32\jo2pqbg86s.exe

O4 - HKCU\..\Run: [epavqrw] C:\WINDOWS\system32\c86o3k1b703.exe

O4 - HKCU\..\Run: [arhs1] C:\WINDOWS\system32\q6g81s3o1.exe

O4 - HKCU\..\Run: [ozkglbh] C:\WINDOWS\system32\xtt2zav081c.exe

O4 - HKCU\..\Run: [ghmi6y] C:\WINDOWS\system32\gmh081oz.exe

O4 - HKCU\..\Run: [hxytup0] C:\WINDOWS\system32\rhs1ijo86a8.exe

O4 - HKCU\..\Run: [ppfl66] C:\WINDOWS\system32\6brc1st.exe

O4 - HKCU\..\Run: [nijo8] C:\WINDOWS\system32\n2e5zvqr.exe

O4 - HKCU\..\Run: [wsxnt6] C:\WINDOWS\system32\gwm1d703k0.exe

O4 - HKCU\..\Run: [rsnoj] C:\WINDOWS\system32\xx2dez081.exe

O4 - HKCU\..\Run: [qbw0d] C:\WINDOWS\system32\703s0tj.exe

O4 - HKCU\..\Run: [mns83] C:\WINDOWS\system32\bwxc86o81a.exe

O4 - HKCU\..\Run: [dzuu6g] C:\WINDOWS\system32\w3yytkkfwwr.exe

O4 - HKCU\..\Run: [wmm6y] C:\WINDOWS\system32\k1gccxoo.exe

O4 - HKCU\..\Run: [jekvq6m] C:\WINDOWS\system32\zz2fgb03s.exe

O4 - HKCU\..\Run: [vbw6s] C:\WINDOWS\system32\jfvg1wxc86o.exe

O4 - HKCU\..\Run: [ttezav] C:\WINDOWS\system32\dd66u86g8.exe

O4 - HKCU\..\Run: [off2l] C:\WINDOWS\system32\idj60lrbxs.exe

O4 - HKCU\..\Run: [zaqlm87] C:\WINDOWS\system32\60bwxc8.exe

O4 - HKCU\..\Run: [fvbwss8] C:\WINDOWS\system32\zkvwrx66o.exe

O4 - HKCU\..\Run: [oteafv] C:\WINDOWS\system32\6e81qbc.exe

O4 - HKCU\..\Run: [hidez] C:\WINDOWS\system32\snt60vbl.exe

O4 - HKCU\..\Run: [qvgrs] C:\WINDOWS\system32\a0brx66o.exe

O4 - HKCU\..\Run: [xytz6] C:\WINDOWS\system32\bxx2dez081g.exe

O4 - HKCU\..\Run: [xinyjkf] C:\WINDOWS\system32\5eeuva8.exe

O4 - HKCU\..\Run: [pqlbcxn] C:\WINDOWS\system32\nojzavlmhid.exe

O4 - HKCU\..\Run: [bgcss81] C:\WINDOWS\system32\e86q81cnojp.exe

O4 - HKCU\..\Run: [dozavl] C:\WINDOWS\system32\0fk81hc.exe

O4 - HKCU\..\Run: [rmnso6e] C:\WINDOWS\system32\bcxyt081.exe

O4 - HKCU\..\Run: [cxytup] C:\WINDOWS\system32\r2xyt081.exe

O4 - HKCU\..\Run: [arhhxd6] C:\WINDOWS\system32\kaq1h703o0.exe

O4 - HKCU\..\Run: [kaqrh70] C:\WINDOWS\system32\juzk2lbcxyt.exe

O4 - HKCU\..\Run: [xnooe7] C:\WINDOWS\system32\bbhhnjj0u.exe

O4 - HKCU\..\Run: [ypfq1g] C:\WINDOWS\system32\t66k86w8.exe

O4 - HKCU\..\Run: [zpv60] C:\WINDOWS\system32\0vlr60t.exe

O4 - HKCU\..\Run: [pklq87] C:\WINDOWS\system32\jo87087087.exe

O4 - HKCU\..\Run: [sxitupv] C:\WINDOWS\system32\w1n70uukql.exe

O4 - HKCU\..\Run: [vgbri1] C:\WINDOWS\system32\970sjj2.exe

O4 - HKCU\..\Run: [rhsnijo] C:\WINDOWS\system32\afl5ccsty8.exe

O4 - HKCU\..\Run: [bcxd97] C:\WINDOWS\system32\vq0hi6y81k.exe

O4 - HKCU\..\Run: [qvlr66] C:\WINDOWS\system32\qvg3c1t7.exe

O4 - HKCU\..\Run: [uvlb0h] C:\WINDOWS\system32\topu86g81s.exe

O4 - HKCU\..\Run: [puqvgr] C:\WINDOWS\system32\e5aaqrw86i.exe

O4 - HKCU\..\Run: [qlmcx08] C:\WINDOWS\system32\f70mmcs0tj.exe

O4 - HKCU\..\Run: [xtopu] C:\WINDOWS\system32\66e86q8.exe

O4 - HKCU\..\Run: [zvqq6c] C:\WINDOWS\system32\s3uupggbssn.exe

O4 - HKCU\..\Run: [brsnd] C:\WINDOWS\system32\mrcnojp6.exe

O4 - HKCU\..\Run: [idtupf] C:\WINDOWS\system32\h1sdezf60h.exe

O4 - HKCU\..\Run: [jefkg1w] C:\WINDOWS\system32\jzfplghm8.exe

O4 - HKCU\..\Run: [zfplg] C:\WINDOWS\system32\t703a0brx6.exe

O4 - HKCU\..\Run: [xytjkfv] C:\WINDOWS\system32\3ozavlm.exe

O4 - HKCU\..\Run: [fvw81] C:\WINDOWS\system32\vv2bcx081.exe

O4 - HKCU\..\Run: [siejz] C:\WINDOWS\system32\1j703q0.exe

O4 - HKCU\..\Run: [opvfbwx] C:\WINDOWS\system32\ijo81almhx.exe

O4 - HKCU\..\Run: [ook6a] C:\WINDOWS\system32\0plbm1c.exe

O4 - HKCU\..\Run: [upqrh] C:\WINDOWS\system32\nojffbb2s5.exe

O4 - HKCU\..\Run: [ojpfl66] C:\WINDOWS\system32\3e1v70c.exe

O4 - HKCU\..\Run: [lmrcnyj] C:\WINDOWS\system32\farhs1ijo8.exe

O4 - HKCU\..\Run: [njefk8] C:\WINDOWS\system32\di81ufgb.exe

O4 - HKCU\..\Run: [jok6a] C:\WINDOWS\system32\ydtz66q86c.exe

O4 - HKCU\..\Run: [sxiejzv] C:\WINDOWS\system32\e3a0brx66je.exe

O4 - HKCU\..\Run: [alwwm] C:\WINDOWS\system32\86whxd6.exe

O4 - HKCU\..\Run: [klb70] C:\WINDOWS\system32\1r70yyo.exe

O4 - HKCU\..\Run: [vblhcdi] C:\WINDOWS\system32\dtupql081s.exe

O4 - HKCU\..\Run: [mmhyyt] C:\WINDOWS\system32\6cc6oo6.exe

O4 - HKCU\..\Run: [injee3a] C:\WINDOWS\system32\cc6ezzvll.exe

O4 - HKCU\..\Run: [fqbcdt] C:\WINDOWS\system32\vwr081yj.exe

O4 - HKCU\..\Run: [jzavw] C:\WINDOWS\system32\1klq86c.exe

O4 - HKCU\..\Run: [fabg8] C:\WINDOWS\system32\oeu1l703s1.exe

O4 - HKCU\..\Run: [subsystem Monitor] C:\WINDOWS\system32\csrns.exe

O4 - HKCU\..\Run: [sxitu] C:\WINDOWS\system32\vq0hc0jpzv.exe

O4 - HKCU\..\Run: [alvrmn] C:\WINDOWS\system32\efk81whidt.exe

O4 - HKCU\..\Run: [ddozav] C:\WINDOWS\system32\izpa1qrw.exe

O4 - HKCU\..\Run: [nojzav] C:\WINDOWS\system32\i1yze86q81.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [uTorrent] "C:\Program\uTorrent\uTorrent.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: McAfee Security Scan.lnk = ?

O4 - Global Startup: Windows Desktop Search.lnk = C:\Program\Windows Desktop Search\WindowsSearch.exe

O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program\PokerStars\PokerStarsUpdate.exe

O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program\Novell\ZENworks\AxNalServer.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1194857338468

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1241519167718

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\WINDOWS\system32\skype4com.dll

O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program\Delade filer\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe

O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - C:\Program\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: BlueSoleilCS - IVT Corporation - C:\Program\IVT Corporation\BlueSoleil\BlueSoleilCS.exe

O23 - Service: Bonjour-tjänst (Bonjour Service) - Apple Inc. - C:\Program\Bonjour\mDNSResponder.exe

O23 - Service: BsHelpCS - IVT Corporation - C:\Program\IVT Corporation\BlueSoleil\BsHelpCS.exe

O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINDOWS\system32\cusrvc.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program\LogMeIn Hamachi\hamachi-2.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: iTechnology iGateway 4.2 (iGateway) - CA, Inc. - C:\Program\CA\SharedComponents\iTechnology\igateway.exe

O23 - Service: eTrust ITM RPC Service (InoRPC) - CA - C:\Program\CA\eTrustITM\InoRpc.exe

O23 - Service: eTrust Antivirus Realtime Service (InoRT) - CA - C:\Program\CA\eTrustITM\InoRT.exe

O23 - Service: eTrust ITM Job Service (InoTask) - CA - C:\Program\CA\eTrustITM\InoTask.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe

O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program\Java\jre6\bin\jqs.exe

O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\WINDOWS\system32\lkcitdl.exe

O23 - Service: National Instruments PSP Server Locator (lkClassAds) - National Instruments, Inc. - C:\WINDOWS\system32\lkads.exe

O23 - Service: National Instruments Time Synchronization (lkTimeSync) - National Instruments, Inc. - C:\WINDOWS\system32\lktsrv.exe

O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\Program\Novell\ZENworks\nalntsrv.exe

O23 - Service: National Instruments Domain Service (NIDomainService) - National Instruments, Inc. - C:\Program\National Instruments\Shared\Security\nidmsrv.exe

O23 - Service: NILM License Manager - Macrovision Corporation - C:\Program\National Instruments\Shared\License Manager\Bin\lmgrd.exe

O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\WINDOWS\system32\nisvcloc.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: Novell ZfD Wake on LAN Status Agent (Prometheus Wake-On-LAN Status Agent) - Novell Inc. - C:\Program\Novell\ZENworks\RemoteManagement\RMAgent\WolSerNT.exe

O23 - Service: Novell ZfD Remote Management (Remote Management Agent) - Novell Inc. - C:\Program\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe

O23 - Service: Remote Solver for COSMOSFloWorks 2007 - Unknown owner - C:\Program\SolidWorks\COSMOS\FloWorks\binCFW\StandAloneSlv.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program\WinPcap\rpcapd.exe

O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program\Delade filer\SolidWorks Shared\Service\SolidWorksLicensing.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program\Delade filer\SureThing Shared\stllssvr.exe

O23 - Service: Workstation Manager (ZFDWM) - Novell, INC. - C:\Program\Novell\ZENworks\wm.exe

 

--

End of file - 16624 bytes

[/log]

[Cecilia]

Se till att hålla uTorrent avstängd medan datorn är infekterad. Det kan så lätt spridas skadliga filer den vägen när datorn är infekterad.

 

Du får börja med att kolla upp vad det är för sorts skadliga filer i datorn. På sidan http://www.virustotal.com trycker du på Bläddra-knappen och klistrar in ett av följande filnamn i rutan, tryck på Öppna och sedan Skicka Fil. Vänta tills resultatet är klart (Närvarande status blir genomförd). Klistra in en länk till resultatet i ditt svar. Upprepa med nästa filnamn.

C:\WINDOWS\system32\csrns.exe

C:\DOCUME~1\ullvi\LOKALA~1\Temp\9808637.exe

C:\WINDOWS\system32\izpa1qrw.exe

C:\WINDOWS\system32\i1yze86q81.exe

[JoshuaB]

Se till att hålla uTorrent avstängd medan datorn är infekterad. Det kan så lätt spridas skadliga filer den vägen när datorn är infekterad.

 

Du får börja med att kolla upp vad det är för sorts skadliga filer i datorn. På sidan http://www.virustotal.com trycker du på Bläddra-knappen och klistrar in ett av följande filnamn i rutan, tryck på Öppna och sedan Skicka Fil. Vänta tills resultatet är klart (Närvarande status blir genomförd). Klistra in en länk till resultatet i ditt svar. Upprepa med nästa filnamn.

C:\WINDOWS\system32\csrns.exe

C:\DOCUME~1\ullvi\LOKALA~1\Temp\9808637.exe

C:\WINDOWS\system32\izpa1qrw.exe

C:\WINDOWS\system32\i1yze86q81.exe

 

C:\Windows\System32\csrns.exe Resultat

 

C:\DOCUME~\ullvi\LOKALA~1\TEMP\9808637.exe

 

C:\Windows\System32\izpa1qrw.exe

 

C:\WINDOWS\system32\i1yze86q81.exe

 

Inge vidare !

[Cecilia]

MBAM ska väl kunna städa bort en del av det.

 

Ladda ner Malwarebytes Anti-Malware (MBAM) från:

http://www.malwarebytes.org/mbam.php

Dubbelklicka på mbam-setup för att installera programmet.

 

Se till i slutet av installationen att det är bockar för:

Uppdatera Malwarebytes' Anti-Malware

Starta Malwarebytes' Anti-Malware

Tryck på Slutför

Om det finns någon uppdatering så kommer den att laddas ner och installeras.

 

När programmet startar så välj "Utför snabb skanning" och tryck på Skanna.

Skanningen tar ett tag.

När den är klar så tryck på OK och sedan "Visa resultat".

Bocka för allt och tryck sedan Ta bort markerade.

När borttagningen är klar så öppnar Anteckningar med en logg.

 

Eventuellt så kommer det upp en begäran om att starta om datorn (Restart). I så fall gör det.

Om det blir ett felmeddelande Error loading... efter omstarten så starta om datorn än en gång.

Om programmet inte kommer igång efter omstarten så starta det.

 

Om loggen inte kommer upp själv i Anteckningar så hittar du loggen på fliken Loggar i MBAM.

Kopiera loggen och klistra in den i ditt svar tillsammans med en ny HijackThis-logg.