Infekterad dator som är seg

23 juli, 2010

Hej!

Jag har lite problem med min dator, den är lite seg och så df körde jag också

samma program (ComboFix) som du rekomenderade o här är logen:

Tack så jättemycket! kolla om det är något strull!

ComboFix 10-07-22.06 - bou 2010-07-23 21:22:10.1.1 - x86

Körs från: c:\documents and settings\bou\Skrivbord\ComboFix.exe

* Skapade en ny återställningspunkt

* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Andra raderingar ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

c:\documents and settings\bou\Application Data\chrtmp

c:\documents and settings\bou\Start-meny\Program\Mach7.lnk

c:\program\Delade filer\m7

c:\program\Delade filer\m7\finish_install.exe

c:\program\Delade filer\m7\in.vbs

c:\program\Delade filer\m7\licence.txt

c:\program\Delade filer\m7\mach7.dat

c:\program\Delade filer\m7\mach7.exe

c:\program\Delade filer\m7\mach7ico.ico

c:\program\Delade filer\m7\startm7.bat

c:\windows\system32\_000008_.tmp.dll

c:\windows\system32\_000009_.tmp.dll

c:\windows\system32\fonts

c:\windows\system32\fonts\DataStudioSymbol.TTF

c:\windows\system32\mxpvct22.dat

c:\windows\system32\mxpvct25.dat

c:\windows\Temp\_ex-08.exe

----- BITS: Troligen infekterade webbplatser -----

hxxp://www.podtrac.com

hxxp://libsyn.com

.

((((((((((((((((((((((((((((((((((((((( Drivrutiner/Tjänster )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_SSHNAS

(((((((((((((((((((((((( Filer Skapade från 2010-06-23 till 2010-07-23 ))))))))))))))))))))))))))))))

.

2010-07-23 19:34 . 2010-07-23 19:34 -------- dc----w- c:\temp\WPDNSE

2010-07-23 19:33 . 2010-07-23 19:33 53248 -c--a-w- c:\temp\catchme.dll

2010-07-23 19:32 . 2010-07-23 19:32 16384 -c--atw- c:\temp\Perflib_Perfdata_154.dat

2010-07-23 10:36 . 2010-07-23 19:26 -------- dc----w- c:\temp\div9.tmp

2010-07-21 10:05 . 2010-07-21 10:05 -------- dc----w- c:\temp\div3.tmp

2010-07-19 22:12 . 2010-07-22 19:11 -------- dc----w- c:\documents and settings\bou\Application Data\vlc

2010-07-19 22:09 . 2010-07-19 22:09 -------- dc----w- c:\documents and settings\bou\Lokala instï¿½llningar

2010-07-19 22:03 . 2010-07-19 22:03 -------- dc----w- c:\documents and settings\bou\Application Data\MozillaControl

2010-07-19 22:03 . 2010-07-23 19:26 -------- dc----w- c:\temp\{1D2C96C3-A3F3-49E7-B839-95279DED837F}

2010-07-19 22:01 . 2010-07-19 22:01 -------- dc----w- c:\program\Mozilla ActiveX Control v1.7.12

2010-07-19 21:57 . 2010-07-19 22:25 -------- dc----w- c:\program\Graboid

2010-07-19 20:12 . 2010-07-23 19:26 -------- dc----w- c:\temp\divBA.tmp

2010-07-14 15:11 . 2010-06-14 14:31 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe

2010-07-14 15:08 . 2010-07-14 15:08 -------- dc----w- c:\temp\msohtml1

2010-07-14 15:08 . 2010-07-14 15:08 -------- dc----w- c:\temp\msohtml

2010-07-14 14:57 . 2010-07-14 14:57 -------- dc----w- c:\temp\VBE

2010-07-14 13:37 . 2010-07-23 19:26 -------- dc----w- c:\temp\iss1D.tmp

2010-07-14 13:19 . 2010-07-14 13:19 -------- dc----w- c:\temp\div16.tmp

2010-07-14 13:18 . 2010-07-23 19:26 -------- dc----w- c:\temp\is-TE48T.tmp

2010-07-14 12:58 . 2010-07-14 13:24 -------- dc----w- c:\temp\comtypes_cache

2010-07-14 11:51 . 2010-07-14 11:51 -------- dc----w- c:\windows\system32\wbem\Repository

2010-07-14 11:11 . 2010-07-14 11:54 766976 -c--a-w- c:\windows\system32\drivers\djscd.sys

2010-07-14 11:02 . 2010-07-20 22:00 -------- dc----w- c:\temp\hsperfdata_bou

2010-07-14 10:58 . 2010-07-14 10:58 -------- dc----w- c:\temp\div5.tmp

2010-07-13 21:02 . 2010-07-23 19:26 -------- dc----w- c:\temp\MessengerCache

2010-07-13 19:01 . 2010-07-13 19:01 -------- dc----w- c:\documents and settings\All Users\Application Data\wanted_demo

2010-07-13 18:48 . 2010-07-13 18:48 -------- dc----w- c:\program\WarnerBros

2010-07-13 14:52 . 2010-07-13 14:52 -------- dc----w- c:\program\AGEIA Technologies

2010-07-13 14:52 . 2010-07-13 14:52 -------- dc----w- c:\windows\system32\AGEIA

2010-07-13 14:46 . 2010-07-13 14:46 -------- dc----w- c:\program\Delade filer\Wise Installation Wizard

2010-07-13 09:47 . 2010-07-23 19:26 -------- dc----w- c:\temp\divA.tmp

2010-07-12 14:56 . 2010-07-12 14:56 -------- dc----w- c:\program\Thomas Wright Consulting

2010-07-11 11:08 . 2010-07-11 11:08 -------- dc----w- c:\windows\BBSTORE

2010-07-11 11:08 . 1997-05-12 14:53 314368 -c--a-w- c:\windows\IsUninst.exe

2010-07-11 10:51 . 2010-07-11 10:51 -------- dc----w- c:\program\Telia

2010-07-11 10:51 . 2010-07-11 10:51 -------- dc----w- c:\documents and settings\All Users\Application Data\Support.com

2010-07-10 19:16 . 2010-07-10 19:16 -------- dc----w- c:\windows\system32\winrm

2010-07-10 19:15 . 2010-07-10 19:16 -------- dc-h--w- c:\windows\$968930Uinstall_KB968930$

2010-07-10 14:17 . 2010-07-12 15:04 -------- dc----w- c:\program\MAGIX

2010-07-10 14:17 . 2010-07-12 15:04 -------- dc----w- c:\documents and settings\All Users\Application Data\MAGIX

2010-07-10 13:53 . 2010-07-10 14:56 -------- dc----w- c:\program\Ace Translator

2010-07-10 11:29 . 2010-07-10 11:29 -------- dc----w- c:\documents and settings\All Users\Application Data\Boss Media

2010-07-08 19:56 . 2010-07-08 19:58 -------- dc----w- c:\windows\uninstall

2010-07-08 17:14 . 2010-07-08 17:14 -------- dc----w- c:\documents and settings\bou\Application Data\Need for Speed World

2010-07-08 14:39 . 2010-07-08 14:39 -------- dc----w- c:\program\Ask.com

2010-07-08 14:39 . 2010-07-08 14:39 -------- dc----w- c:\program\Adobe PhotoShop CS3

2010-07-08 14:38 . 2010-07-08 14:38 -------- dc----w- c:\program\Vuze_Remote

2010-07-08 14:38 . 2010-07-08 14:38 -------- dc----w- c:\program\Windows Desktop Search

2010-07-08 14:38 . 2010-07-08 14:38 -------- dc----w- c:\program\PhotoFiltre

2010-07-08 14:38 . 2010-07-08 14:38 -------- dc----w- c:\program\Xara

2010-07-08 14:38 . 2010-07-14 13:37 -------- dc----w- c:\program\Uniblue

2010-07-08 14:38 . 2010-07-08 14:38 -------- dc----w- c:\program\UnHackMe

2010-07-08 14:38 . 2010-07-08 14:38 -------- dc----r- c:\program\Net Nanny

2010-07-08 14:36 . 2010-07-08 16:25 -------- dc----w- c:\program\Delade filer\Adobe AIR

2010-07-08 13:13 . 2010-07-08 13:13 -------- dc----w- c:\documents and settings\bou\Application Data\AdobeSupportAdvisor.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1

2010-07-08 13:13 . 2010-07-08 14:36 -------- dc----w- c:\program\AdobeSupportAdvisor

2010-07-08 13:13 . 2010-07-08 13:13 -------- dc----w- c:\program\Delade filer\Adobe AIR(3)

2010-07-07 10:29 . 2010-07-07 10:29 -------- dc----w- c:\program\Activision

2010-07-04 20:04 . 2010-07-04 20:05 -------- dc----w- c:\documents and settings\All Users\Application Data\PlatinumHideIP

2010-07-04 20:04 . 2010-07-04 20:04 -------- dc----w- c:\documents and settings\bou\Application Data\PlatinumHideIP

2010-07-04 18:41 . 2010-07-04 20:03 -------- dc----w- c:\documents and settings\bou\Application Data\DVD Flick

2010-07-04 18:40 . 2010-07-04 18:41 -------- dc----w- c:\program\DVD Flick

2010-07-03 23:20 . 2010-07-03 23:20 138056 -c--a-w- c:\windows\system32\drivers\PnkBstrK.sys

2010-07-03 23:20 . 2010-07-03 23:20 189248 -c--a-w- c:\windows\system32\PnkBstrB.exe

2010-07-03 23:20 . 2010-07-03 23:20 75064 -c--a-w- c:\windows\system32\PnkBstrA.exe

2010-07-03 23:20 . 2010-07-03 23:20 2434856 -c--a-w- c:\windows\system32\pbsvc_bc2.exe

2010-07-02 16:54 . 2010-07-02 16:54 -------- dcsh--w- c:\documents and settings\NetworkService\IETldCache

2010-07-01 19:53 . 2010-07-01 19:53 -------- dc----w- c:\documents and settings\bou\Application Data\CheeseSoft

2010-07-01 19:53 . 2010-07-01 19:54 -------- dc----w- c:\program\FinalUninstaller

2010-06-27 15:36 . 2010-07-14 12:00 -------- dc----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2010-06-27 15:36 . 2010-06-30 11:11 -------- dc----w- c:\program\Spybot - Search & Destroy

2010-06-26 19:39 . 2010-06-26 19:39 2 -cshatr- c:\windows\winstart.bat

2010-06-26 00:06 . 2010-06-26 00:06 -------- dc----w- c:\program\Conduit

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-23 19:32 . 2008-05-08 02:12 -------- dc----w- c:\program\NORMAN

2010-07-22 19:11 . 2010-07-19 22:12 -------- dc----w- c:\documents and settings\bou\Application Data\vlc

2010-07-19 22:49 . 2010-01-11 16:44 -------- dc----w- c:\documents and settings\bou\Application Data\uTorrent

2010-07-19 20:34 . 2010-02-03 17:56 -------- dc----w- c:\documents and settings\bou\Application Data\U3

2010-07-14 13:13 . 2010-05-07 17:01 -------- dc----w- c:\documents and settings\bou\Application Data\Uniblue

2010-07-13 18:48 . 2010-07-13 18:48 -------- dc----w- c:\program\WarnerBros

2010-07-13 18:48 . 2006-10-03 06:21 -------- dc-h--w- c:\program\InstallShield Installation Information

2010-07-11 10:58 . 2010-05-16 14:46 -------- dc----w- c:\program\MagicISO

2010-07-10 11:58 . 2010-06-14 16:59 57344 -c--a-w- c:\documents and settings\All Users\Application Data\DivX\RunAsUser\RUNASUSERPROCESS.dll

2010-07-10 11:58 . 2010-05-07 21:03 -------- dc----w- c:\documents and settings\All Users\Application Data\DivX

2010-07-10 11:57 . 2010-07-10 11:57 56765 -c--a-w- c:\documents and settings\All Users\Application Data\DivX\DivXPlusShortcuts\Uninstaller.exe

2010-07-10 11:57 . 2010-05-07 21:05 -------- dc----w- c:\program\DivX

2010-07-10 11:57 . 2010-07-10 11:57 57715 -c--a-w- c:\documents and settings\All Users\Application Data\DivX\Player\Uninstaller.exe

2010-07-10 11:57 . 2010-07-10 11:57 84054 -c--a-w- c:\documents and settings\All Users\Application Data\DivX\TransferWizard\Uninstaller.exe

2010-07-10 11:56 . 2010-07-10 11:56 54153 -c--a-w- c:\documents and settings\All Users\Application Data\DivX\DFXPlugin\Uninstaller.exe

2010-07-10 11:56 . 2010-06-16 17:39 1062184 -c--a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\Resource.dll

2010-07-10 11:54 . 2010-06-16 17:39 895256 -c--a-w- c:\documents and settings\All Users\Application Data\DivX\Setup\DivXSetup.exe

2010-07-08 16:24 . 2010-07-08 16:25 53632 -c--a-w- c:\documents and settings\bou\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe

2010-07-08 16:23 . 2010-07-08 16:23 12124624 -c--a-w- c:\documents and settings\bou\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airinstaller2x0\airinstaller2x0.exe

2010-07-08 15:42 . 2010-02-11 14:34 -------- dc----w- c:\program\Delade filer\Adobe

2010-07-08 14:38 . 2010-07-08 14:38 -------- dc----w- c:\program\Vuze_Remote

2010-07-04 18:46 . 2010-05-16 13:55 -------- dc----w- c:\documents and settings\bou\Application Data\ImgBurn

2010-07-04 18:45 . 2010-05-15 23:19 -------- dc----w- c:\program\ImgBurn

2010-07-03 23:20 . 2010-07-03 23:20 138056 -c--a-w- c:\documents and settings\bou\Application Data\PnkBstrK.sys

2010-07-01 22:16 . 2010-01-13 19:55 -------- dc----w- c:\documents and settings\bou\Application Data\HpUpdate

2010-07-01 21:26 . 2010-05-25 20:57 -------- dc----w- c:\program\Ubisoft

2010-07-01 20:11 . 2010-03-29 16:49 -------- dc----w- c:\documents and settings\bou\Application Data\Apple Computer

2010-07-01 15:30 . 2010-03-28 17:18 -------- dc--a-w- c:\documents and settings\All Users\Application Data\TEMP

2010-07-01 14:20 . 2008-05-08 02:16 -------- dc----w- c:\documents and settings\All Users\Application Data\Apple Computer

2010-06-30 19:54 . 2006-05-02 12:05 -------- dc----w- c:\program\Google

2010-06-30 13:33 . 2010-05-25 21:21 -------- dc----w- c:\program\CCleaner

2010-06-28 12:17 . 2010-04-25 08:27 1324 -c--a-w- c:\windows\system32\d3d9caps.dat

2010-06-24 21:50 . 2008-05-30 08:03 -------- dc----w- c:\program\HP

2010-06-21 23:36 . 2010-03-24 20:19 -------- dc----w- c:\program\Free FLV Converter

2010-06-21 19:14 . 2010-06-21 19:14 0 -c-ha-w- c:\windows\system32\drivers\Msft_Kernel_SynTP_01009.Wdf

2010-06-21 19:14 . 2010-06-21 19:14 0 -c-ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf

2010-06-21 18:11 . 2010-05-29 10:14 -------- dc----w- c:\documents and settings\bou\Application Data\Dream Aquarium

2010-06-21 15:26 . 2010-06-21 15:24 -------- dc----w- c:\program\PcMedik

2010-06-19 19:54 . 2010-06-23 10:24 168448 -c--a-w- c:\windows\Wpicug.exe

2010-06-19 19:54 . 2010-06-22 12:01 168448 -c--a-w- c:\windows\Wpicuf.exe

2010-06-19 19:54 . 2010-06-21 23:49 168448 -c--a-w- c:\windows\Wpicue.exe

2010-06-19 19:54 . 2010-06-21 16:14 168448 -c--a-w- c:\windows\Wpicud.exe

2010-06-19 19:54 . 2010-06-21 09:02 168448 -c--a-w- c:\windows\Wpicuc.exe

2010-06-19 19:54 . 2010-06-20 10:47 168448 -c--a-w- c:\windows\Wpicub.exe

2010-06-19 19:53 . 2010-06-19 19:53 168448 -c--a-w- c:\windows\Wpicua.exe

2010-06-19 12:08 . 2010-06-19 12:08 -------- dc----w- c:\program\Saitek

2010-06-18 19:34 . 2010-02-27 14:29 -------- dc----w- c:\program\Windows Live Safety Center

2010-06-18 11:40 . 2004-08-04 12:00 84650 -c--a-w- c:\windows\system32\perfc01D.dat

2010-06-18 11:40 . 2004-08-04 12:00 446102 -c--a-w- c:\windows\system32\perfh01D.dat

2010-06-17 16:11 . 2010-01-17 17:51 -------- dc----w- c:\documents and settings\bou\Application Data\DivX

2010-06-17 10:44 . 2010-06-17 10:44 -------- dc----w- c:\program\SystemRequirementsLab

2010-06-17 10:16 . 2010-06-17 10:16 -------- dc----w- c:\program\Microsoft Games

2010-06-16 23:04 . 2010-02-11 20:41 -------- dc----w- c:\program\Windows Live

2010-06-16 23:03 . 2010-06-16 23:03 -------- dc----w- c:\program\Microsoft SQL Server Compact Edition

2010-06-16 17:39 . 2010-06-16 17:39 56997 -c--a-w- c:\documents and settings\All Users\Application Data\DivX\WebPlayer\Uninstaller.exe

2010-06-16 17:39 . 2010-06-16 17:39 53600 -c--a-w- c:\documents and settings\All Users\Application Data\DivX\Update\Uninstaller.exe

2010-06-16 17:38 . 2010-06-16 17:38 57054 -c--a-w- c:\documents and settings\All Users\Application Data\DivX\DSDesktopComponents\Uninstaller.exe

2010-06-16 17:38 . 2010-06-16 17:38 54166 -c--a-w- c:\documents and settings\All Users\Application Data\DivX\DSAVCDecoder\Uninstaller.exe

2010-06-16 17:38 . 2010-06-16 17:38 57532 -c--a-w- c:\documents and settings\All Users\Application Data\DivX\DSASPDecoder\Uninstaller.exe

2010-06-16 17:38 . 2010-06-16 17:38 56458 -c--a-w- c:\documents and settings\All Users\Application Data\DivX\DivXDecoderShortcut\Uninstaller.exe

2010-06-16 17:38 . 2010-06-16 17:38 54174 -c--a-w- c:\documents and settings\All Users\Application Data\DivX\DSAACDecoder\Uninstaller.exe

2010-06-16 17:38 . 2010-06-16 17:38 54128 -c--a-w- c:\documents and settings\All Users\Application Data\DivX\Converter\Uninstaller.exe

2010-06-08 09:30 . 2010-03-24 20:19 311296 -c--a-w- c:\windows\system32\TubeFinder.exe

2010-06-08 09:00 . 2010-02-26 13:07 -------- dc----w- c:\documents and settings\bou\Application Data\Media Player Classic

2010-06-05 10:53 . 2010-06-05 10:53 -------- dc----w- c:\documents and settings\bou\Application Data\StageManager.BD092818F67280F4B42B04877600987F0111B594.1

2010-06-05 10:07 . 2010-05-22 14:55 -------- dc----w- c:\documents and settings\All Users\Application Data\regid.1986-12.com.adobe

2010-06-02 02:55 . 2010-06-23 12:23 74072 -c--a-w- c:\windows\system32\XAPOFX1_5.dll

2010-06-02 02:55 . 2010-06-23 12:23 527192 -c--a-w- c:\windows\system32\XAudio2_7.dll

2010-06-02 02:55 . 2010-06-23 12:23 239960 -c--a-w- c:\windows\system32\xactengine3_7.dll

2010-05-29 10:14 . 2010-05-29 10:07 -------- dc----w- c:\program\Dream Aquarium

2010-05-27 20:32 . 2007-12-19 09:45 245936 -c--a-w- c:\windows\system32\drivers\SynTP.sys

2010-05-27 20:31 . 2008-03-28 00:04 120104 -c--a-w- c:\windows\system32\SynTPCo4.dll

2010-05-27 20:31 . 2007-12-19 09:45 165160 ----a-w- c:\windows\system32\SynTPAPI.dll

2010-05-27 20:31 . 2007-12-19 09:45 210216 -c--a-w- c:\windows\system32\SynCtrl.dll

2010-05-27 20:31 . 2007-12-19 09:45 173352 ----a-w- c:\windows\system32\SynCOM.dll

2010-05-26 09:41 . 2010-06-23 12:23 248672 -c--a-w- c:\windows\system32\d3dx11_43.dll

2010-05-26 09:41 . 2010-06-23 12:23 2106216 -c--a-w- c:\windows\system32\D3DCompiler_43.dll

2010-05-26 09:41 . 2010-06-23 12:23 1868128 -c--a-w- c:\windows\system32\d3dcsx_43.dll

2010-05-26 09:41 . 2010-06-23 12:23 470880 -c--a-w- c:\windows\system32\d3dx10_43.dll

2010-05-26 09:41 . 2010-06-23 12:23 1998168 -c--a-w- c:\windows\system32\D3DX9_43.dll

2010-05-25 20:59 . 2010-05-01 15:48 -------- dc----w- c:\program\Easy-Hide-IP

2010-05-25 20:59 . 2010-05-25 20:59 -------- dc----w- c:\program\Common Files

2010-05-25 20:54 . 2010-05-09 14:41 -------- dc----w- c:\program\AllWebMenus3

2010-05-25 20:54 . 2010-05-09 16:40 -------- dc----w- c:\program\Gigaset QuickSync(2)

2010-05-25 20:38 . 2010-02-25 16:29 -------- dc----w- c:\program\Sony Ericsson

2010-05-25 20:29 . 2010-05-21 22:07 -------- dc----w- c:\documents and settings\bou\Application Data\GetRightToGo

2010-05-25 20:29 . 2010-05-21 22:11 -------- dc----w- c:\program\Driver Checker

2010-05-25 20:26 . 2010-05-22 13:39 -------- dc----w- c:\program\Delade filer\Adobe AIR(2)

2010-05-25 20:06 . 2010-02-25 16:34 -------- dc----w- c:\program\QuickTime

2010-05-25 20:05 . 2010-05-25 19:38 -------- dc----w- c:\documents and settings\All Users\Application Data\NOS

2010-05-17 19:00 . 2010-03-29 16:49 59052 -c-ha-w- c:\windows\system32\mlfcache.dat

2010-05-06 10:36 . 2004-08-04 12:00 916480 ----a-w- c:\windows\system32\wininet.dll

2010-05-02 08:10 . 2004-08-04 12:00 1851264 ----a-w- c:\windows\system32\win32k.sys

2010-04-28 05:44 . 2010-06-16 23:04 54760 -c--a-w- c:\windows\system32\drivers\fssfltr_tdi.sys

2010-04-25 10:55 . 2010-04-25 09:16 79488 -c--a-w- c:\documents and settings\bou\Application Data\Sun\Java\jre1.6.0_20\gtapi.dll

2010-04-25 10:55 . 2010-04-25 09:16 152576 -c--a-w- c:\documents and settings\bou\Application Data\Sun\Java\jre1.6.0_20\lzma.dll

2010-04-17 18:59 . 2010-04-17 18:08 80 -csh--r- c:\windows\system32\D59F6963CD.dll

.

(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))

.

*Not* Tomma poster & legitima standardposter visas inte.

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program\Synaptics\SynTP\SynTPEnh.exe" [2010-05-27 1721640]

"NDPS"="c:\windows\system32\dpmw32.exe" [2004-05-17 32859]

"ZENRC Tray Icon"="c:\windows\system32\zentray.exe" [2005-01-17 40960]

"NWTRAY"="NWTRAY.EXE" [2002-03-12 28672]

"HP Software Update"="c:\program\HP\HP Software Update\HPWuSchd2.exe" [2010-06-09 49208]

"Norman ZANDA"="c:\program\NORMAN\Npm\bin\ZLH.EXE" [2009-10-06 275840]

"StartCCC"="c:\program\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]

"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143872]

"SoundMAXPnP"="c:\program\Analog Devices\Core\smax4pnp.exe" [2007-01-05 872448]

"NNTray"="c:\program\Net Nanny\nnstart.exe" [2002-09-24 61440]

"SunJavaUpdateSched"="c:\program\Delade filer\Java\Java Update\jusched.exe" [2010-02-18 248040]

"SwitchBoard"="c:\program\Delade filer\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]

"AdobeCS5ServiceManager"="c:\program\Delade filer\Adobe\CS5ServiceManager\CS5ServiceManager.exe" [2010-02-22 406992]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start-meny\Program\Autostart\

NalView.lnk - c:\program\Novell\ZENworks\NalView.exe [2005-9-8 35840]

PASPortal.lnk - c:\windows\Installer\{D4AB1A2A-72A8-4801-B238-0CB789C992FE}\NewShortcut1.exe [2008-5-8 40960]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"CompatibleRUPSecurity"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoWelcomeScreen"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\NetIdentity Notification]

2005-01-10 11:36 24576 -c--a-w- c:\windows\system32\Novell\xtnotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\TPSvc]

2007-05-02 02:21 364544 -c--a-r- c:\windows\system32\TPSvc.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Authentication Packages REG_MULTI_SZ msv1_0 nwv1_0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start-meny^Program^Autostart^HP Photosmart Premier Snabbstart.lnk]

path=c:\documents and settings\All Users\Start-meny\Program\Autostart\HP Photosmart Premier Snabbstart.lnk

backup=c:\windows\pss\HP Photosmart Premier Snabbstart.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start-meny^Program^Autostart^Windows Search.lnk]

path=c:\documents and settings\All Users\Start-meny\Program\Autostart\Windows Search.lnk

backup=c:\windows\pss\Windows Search.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^bou^Start-meny^Program^Autostart^Telia Mobilt bredband.lnk]

path=c:\documents and settings\bou\Start-meny\Program\Autostart\Telia Mobilt bredband.lnk

backup=c:\windows\pss\Telia Mobilt bredband.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-12-18 07:58 40368 -c--a-w- c:\program\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeBridge]

2010-03-09 02:28 11989960 -c--a-w- c:\program\Adobe\Adobe Bridge CS5\Bridge.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]

2010-02-22 02:57 406992 -c--a-w- c:\program\Delade filer\Adobe\CS5ServiceManager\CS5ServiceManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-14 16:05 15360 -c--a-w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]

2010-06-03 00:50 1144104 ----a-w- c:\program\DivX\DivX Update\DivXUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]

2010-04-16 20:12 3872080 -c--a-w- c:\program\Windows Live\Messenger\msnmsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]

2009-03-05 14:07 2260480 -c----w- c:\program\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Synchronization Manager]

2008-04-14 16:05 143872 -c--a-w- c:\windows\system32\mobsync.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"WMPNetworkSvc"=2 (0x2)

"idsvc"=3 (0x3)

"gusvc"=3 (0x3)

"wlidsvc"=2 (0x2)

"ose"=3 (0x3)

"Bonjour Service"=2 (0x2)

"gupdate"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Novell\\GroupWise\\grpwise.exe"=

"c:\\Novell\\GroupWise\\notify.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Documents and Settings\\bou\\Skrivbord\\uTorrent.exe"=

"c:\\Program\\Sony Ericsson\\Update Service\\Update Service.exe"=

"c:\\Program\\Bonjour\\mDNSResponder.exe"=

"c:\\WINDOWS\\system32\\dpmw32.exe"=

"c:\\Program\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program\\Windows Live\\Sync\\WindowsLiveSync.exe"=

"c:\\WINDOWS\\system32\\PnkBstrA.exe"=

"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

"c:\\Program\\Ace Translator\\AceTrans.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

"5353:TCP"= 5353:TCP:Adobe CSI CS4

"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2010-04-24 28552]

R1 NGS;Norman General Security Driver;c:\program\NORMAN\nvc\bin\ngs.sys [2010-01-11 25032]

R2 BlankScr;HBDevice;c:\windows\system32\drivers\blankscr.sys [2005-01-17 6899]

R2 Ndiskio;Ndiskio;c:\program\NORMAN\Nse\Bin\Ndiskio.sys [2010-01-11 24168]

R2 Remote Management Agent;Novell ZENworks Remote Management Agent;c:\program\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe [2005-09-01 163840]

R2 USB Drive Letter Mananger;USBDLM;c:\program\USBDLM\USBDLM.exe [2006-05-24 64000]

R2 XTAgent;Novell XTier Agent Services;c:\windows\system32\Novell\xtagent.exe [2005-01-10 61440]

R3 Darpan;Darpan;c:\windows\system32\drivers\Darpan.sys [2005-01-10 2773]

R3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [2006-10-03 17149]

R3 nsesvc;Norman Scanner Engine Service;c:\program\NORMAN\Nse\Bin\Nsesvc.exe [2010-01-11 283976]

R3 NvcMFlt;NvcMFlt;c:\windows\system32\drivers\nvcw32mf.sys [2010-01-11 21832]

R3 nvcoas;Norman Virus Control on-access component;c:\program\NORMAN\nvc\bin\Nvcoas.exe [2010-01-11 185672]

R3 NVCScheduler;Norman Virus Control Scheduler;c:\program\NORMAN\nvc\bin\Nvcsched.exe [2010-01-11 148808]

S2 hgfs;hgfs;c:\windows\system32\DRIVERS\hgfs.sys --> c:\windows\system32\DRIVERS\hgfs.sys [?]

S3 ATHFMWDL;NETGEAR WG111T bootloader driver;c:\windows\system32\drivers\Athfmwdl.sys [2006-03-22 43392]

S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2010-02-25 13224]

S3 s3legacy;s3legacy;c:\windows\system32\drivers\s3legacy.sys [2007-07-05 65664]

S3 SwitchBoard;SwitchBoard;c:\program\Delade filer\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-08-04 14336]

S4 gupdate;Tjänsten Google Update (gupdate);c:\program\Google\Update\GoogleUpdate.exe [2010-03-02 135664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

WINRM REG_MULTI_SZ WINRM

.

Innehållet i mappen 'Schemalagda aktiviteter':

2010-07-23 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2010-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program\Google\Update\GoogleUpdate.exe [2010-03-02 17:11]

2010-07-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program\Google\Update\GoogleUpdate.exe [2010-03-02 17:11]

2010-07-23 c:\windows\Tasks\User_Feed_Synchronization-{3D3AEC52-0069-4C6A-A4F2-9862916322C8}.job

- c:\windows\system32\msfeedssync.exe [2007-08-13 03:31]

2010-07-23 c:\windows\Tasks\User_Feed_Synchronization-{695BC004-ABC9-4A06-ADF4-485202981975}.job

- c:\windows\system32\msfeedssync.exe [2007-08-13 03:31]

.

------- Extra genomsökning -------

.

uStart Page = hxxp://www.google.se/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyServer = 127.0.0.1:8080

uInternet Settings,ProxyOverride = local

IE: E&xportera till Microsoft Excel - c:\program\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Sothink SWF Catcher - c:\program\Delade filer\SourceTec\SWF Catcher\InternetExplorer.htm

DPF: {140E4DF8-9E14-4A34-9577-C77561ED7883} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.1.71.0.cab

DPF: {83A4D5A6-E2C1-4EDD-AD48-1A1C50BD06EF} - hxxp://www.nattstad.se/ImageUploader6.cab

FF - ProfilePath - c:\documents and settings\bou\Application Data\Mozilla\Firefox\Profiles\9l2eva6x.default\

FF - prefs.js: browser.startup.homepage - hxxp://www2.firesearch.com/

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.

------- Filassociationer -------

.

regfile\shell\edit\command=%SystemRoot%\system32\NOTEPAD.EXE %1

.

- - - - FÖRÄLDRALÖSA POSTER SOM TAGITS BORT - - - -

HKLM-Run-adsnwk - c:\windows\system32\adsnwk.exe

HKLM-Run-FU_JFM - c:\program\FinalUninstaller\JFM.exe

MSConfigStartUp-Adobe ARM - c:\program\Delade filer\Adobe\ARM\1.0\AdobeARM.exe

MSConfigStartUp-Adobe Photo Downloader - c:\program\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

MSConfigStartUp-AdobeCS4ServiceManager - c:\program\Delade filer\Adobe\CS4ServiceManager\CS4ServiceManager.exe

MSConfigStartUp-AGEIA PhysX SysTray - c:\program\AGEIA Technologies\TrayIcon.exe

MSConfigStartUp-IDMan - c:\temp\Rar$EX02.015\idm 5.18\IDMan.exe

MSConfigStartUp-m7 - c:\progra~1\common~1\m7\in.vbs

MSConfigStartUp-Sony Ericsson PC Suite - c:\program\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe

MSConfigStartUp-swg - c:\program\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

AddRemove-Agere Systems Soft Modem - c:\windows\agrsmdel

AddRemove-Svenska Spels Poker - c:\casino\SVENSK~1\UNWISE.EXE

AddRemove-uTorrent - u:\\uTorrent.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-07-23 21:33

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

NNTray = c:\program\Net Nanny\nnstart.exe???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LÅSTA REGISTERNYCKLAR ---------------------

[HKEY_USERS\S-1-5-21-2814842062-1513136318-2222897245-1045\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder]

@Denied: (A C D 2 3 6) (Everyone)

@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\€–€|ÿÿÿÿÀ•€|ù•6~*]

"D140710900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

"D140110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLer som "laddats" under processer som körs ---------------------

- - - - - - - > 'winlogon.exe'(872)

c:\program\Novell\ZENworks\ZENPOL32.DLL

c:\windows\system32\xmlparse.dll

c:\windows\system32\msi.dll

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'Explorer.exe'(3896)

c:\program\WINDOW~2\wmpband.dll

c:\windows\system32\msi.dll

c:\windows\system32\NLS\SVENSKA\NWSHLXNR.DLL

c:\windows\system32\NLS\SVENSKA\NOVNPNTR.DLL

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Andra processer som körs ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program\NORMAN\Npm\bin\ELOGSVC.EXE

c:\program\NORMAN\npm\bin\zanda.exe

c:\windows\system32\agrsmsvc.exe

c:\program\Java\jre6\bin\jqs.exe

c:\program\Delade filer\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program\Novell\ZENworks\nalntsrv.exe

c:\windows\system32\PnkBstrA.exe

c:\windows\system32\PnkBstrB.exe

c:\program\Novell\ZENworks\wm.exe

c:\program\NORMAN\Npm\bin\NJEEVES.EXE

c:\program\Novell\ZENworks\WMRUNDLL.EXE

c:\windows\system32\NWTRAY.EXE

c:\program\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

c:\windows\system32\msiexec.exe

c:\program\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

c:\program\NORMAN\Nvc\bin\cclaw.exe

c:\program\DataStudio\PASPortal.exe

.

**************************************************************************

.

Sluttid: 2010-07-23 21:42:14 - datorn startades om.

ComboFix-quarantined-files.txt 2010-07-23 19:42

Före genomsökningen: 64 613 941 248 byte ledigt

Efter genomsökningen: 65 233 313 792 byte ledigt

WindowsXP-KB310994-SP2-Home-BootDisk-SVE.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - AE3DC8D7F051866BF7362490207FBACA

:thumbsup: TACK!

24 juli, 2010

ComboFix rekommenderas aldrig som första program att köra. Först vill se en översikt över datorn. Spara DDS på Skrivbordet.

http://download.bleepingcomputer.com/sUBs/dds.scr

Starta programmet genom att dubbelklicka på det.

Tryck Yes/Ja om frågan om Optional Scan dyker upp.

I ditt svar klistrar du in loggen DSS.txt. Medan du bifogar Attach.txt som en fil.

24 juli, 2010

ComboFix rekommenderas aldrig som första program att köra. Först vill se en översikt över datorn. Spara DDS på Skrivbordet.

http://download.bleepingcomputer.com/sUBs/dds.scr

Starta programmet genom att dubbelklicka på det.

Tryck Yes/Ja om frågan om Optional Scan dyker upp.

I ditt svar klistrar du in loggen DSS.txt. Medan du bifogar Attach.txt som en fil.

hej!

här är dds loggen:

DDS (Ver_10-03-17.01) - NTFSx86

Run by bou at 19:20:14,21 on 2010-07-24

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.3.1252.46.1053.18.1919.1137 [GMT 2:00]

AV: Norman Virus Control *On-access scanning disabled* (Updated) {EB9EFB40-AE72-4C43-B204-0FCD0E92D5F1}

============== Running Processes ===============

C:\WINDOWS\System32\Novell\XTAgent.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\WINDOWS\system32\Ati2evxx.exe

C:\PROGRAM\NORMAN\Npm\bin\ELOGSVC.EXE

C:\PROGRAM\NORMAN\npm\bin\zanda.exe

C:\WINDOWS\system32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\System32\svchost.exe -k eapsvcs

svchost.exe

C:\WINDOWS\System32\svchost.exe -k dot3svc

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\WINDOWS\system32\agrsmsvc.exe

C:\Program\Java\jre6\bin\jqs.exe

C:\Program\Delade filer\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program\Novell\ZENworks\nalntsrv.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\PnkBstrB.exe

C:\Program\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program\USBDLM\USBDLM.exe

C:\Program\Novell\ZENworks\wm.exe

C:\PROGRAM\NORMAN\Npm\bin\NJEEVES.EXE

C:\Program\Novell\ZENworks\WMRUNDLL.EXE

C:\PROGRAM\NORMAN\Nvc\BIN\NVCSCHED.EXE

C:\PROGRAM\NORMAN\Nvc\bin\nvcoas.exe

C:\Program\Google\Update\GoogleUpdate.exe

C:\WINDOWS\Explorer.EXE

C:\Program\Synaptics\SynTP\SynTPEnh.exe

C:\WINDOWS\system32\dpmw32.exe

C:\WINDOWS\system32\NWTRAY.EXE

C:\Program\HP\HP Software Update\HPWuSchd2.exe

C:\PROGRAM\NORMAN\Npm\bin\ZLH.EXE

C:\Program\Analog Devices\Core\smax4pnp.exe

C:\Program\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

C:\PROGRAM\NORMAN\Nvc\bin\cclaw.exe

C:\Program\Windows Live\Messenger\msnmsgr.exe

C:\Program\DataStudio\PASPortal.exe

C:\Program\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\Internet Explorer\iexplore.exe

C:\Documents and Settings\bou\Lokala inställningar\Temporary Internet Files\Content.IE5\UAO8I3H8\dds[1].scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.se/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyServer = 127.0.0.1:8080

uInternet Settings,ProxyOverride = local

BHO: Länkhjälp till Adobe PDF Reader: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program\delade filer\adobe\acrobat\activex\AcroIEHelper.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program\spybot~1\SDHelper.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - No File

TB: {00000000-5736-4205-0008-F7ED0776FB27} - No File

uRun: [msnmsgr] "c:\program\windows live\messenger\msnmsgr.exe" /background

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe

mRun: [NDPS] c:\windows\system32\dpmw32.exe

mRun: [ZENRC Tray Icon] c:\windows\system32\zentray.exe

mRun: [NWTRAY] NWTRAY.EXE

mRun: [HP Software Update] c:\program\hp\hp software update\HPWuSchd2.exe

mRun: [Norman ZANDA] "c:\program\norman\npm\bin\ZLH.EXE" /LOAD /SPLASH

mRun: [startCCC] "c:\program\ati technologies\ati.ace\core-static\CLIStart.exe"

mRun: [synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon

mRun: [soundMAXPnP] c:\program\analog devices\core\smax4pnp.exe

mRun: [NNTray] c:\program\net nanny\nnstart.exe

mRun: [sunJavaUpdateSched] "c:\program\delade filer\java\java update\jusched.exe"

mRun: [switchBoard] c:\program\delade filer\adobe\switchboard\SwitchBoard.exe

mRun: [AdobeCS5ServiceManager] "c:\program\delade filer\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\nalview.lnk - c:\program\novell\zenworks\NalView.exe

StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\paspor~1.lnk - c:\windows\installer\{d4ab1a2a-72a8-4801-b238-0cb789c992fe}\NewShortcut1.exe

mPolicies-explorer: NoWelcomeScreen = 1 (0x1)

mPolicies-system: CompatibleRUPSecurity = 1 (0x1)

IE: E&xportera till Microsoft Excel - c:\program\micros~2\office11\EXCEL.EXE/3000

IE: Sothink SWF Catcher - c:\program\delade filer\sourcetec\swf catcher\InternetExplorer.htm

IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe

IE: {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - c:\program\delade filer\sourcetec\swf catcher\InternetExplorer.htm

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program\windows live\writer\WriterBrowserExtension.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\program\micros~4\office11\REFIEBAR.DLL

IE: {C1994287-422F-47aa-8E5E-6323E210A125} - {4B5F7606-8666-4D5A-9780-DB92A9D8812B} - c:\program\novell\zenworks\AxNalServer.dll

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program\spybot~1\SDHelper.dll

DPF: {140E4DF8-9E14-4A34-9577-C77561ED7883} - hxxp://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.1.71.0.cab

DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab

DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab

DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {83A4D5A6-E2C1-4EDD-AD48-1A1C50BD06EF} - hxxp://www.nattstad.se/ImageUploader6.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} - hxxp://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

Notify: AtiExtEvent - Ati2evxx.dll

Notify: NetIdentity Notification - c:\windows\system32\novell\XtNotify.dll

Notify: TPSvc - TPSvc.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

LSA: Authentication Packages = msv1_0 nwv1_0

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\bou\applic~1\mozilla\firefox\profiles\9l2eva6x.default\

FF - prefs.js: browser.startup.homepage - hxxp://www2.firesearch.com/

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

============= SERVICES / DRIVERS ===============

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2010-4-24 28552]

R0 vmscsi;vmscsi;c:\windows\system32\drivers\vmscsi.sys [2006-2-16 10880]

R1 NGS;Norman General Security Driver;c:\program\norman\nvc\bin\ngs.sys [2010-1-11 25032]

R2 BlankScr;HBDevice;c:\windows\system32\drivers\blankscr.sys [2005-1-17 6899]

R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2010-6-17 54760]

R2 Ndiskio;Ndiskio;c:\program\norman\nse\bin\Ndiskio.sys [2010-1-11 24168]

R2 Norman ZANDA;Norman ZANDA;c:\program\norman\npm\bin\Zanda.exe [2010-1-11 411016]

R2 Remote Management Agent;Novell ZENworks Remote Management Agent;c:\program\novell\zenworks\remotemanagement\rmagent\ZenRem32.exe [2005-9-1 163840]

R2 USB Drive Letter Mananger;USBDLM;c:\program\usbdlm\USBDLM.exe [2006-5-24 64000]

R2 XTAgent;Novell XTier Agent Services;c:\windows\system32\novell\xtagent.exe [2005-1-10 61440]

R3 Darpan;Darpan;c:\windows\system32\drivers\Darpan.sys [2005-1-10 2773]

R3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [2006-10-3 17149]

R3 nsesvc;Norman Scanner Engine Service;c:\program\norman\nse\bin\Nsesvc.exe [2010-1-11 283976]

R3 NvcMFlt;NvcMFlt;c:\windows\system32\drivers\nvcw32mf.sys [2010-1-11 21832]

R3 nvcoas;Norman Virus Control on-access component;c:\program\norman\nvc\bin\Nvcoas.exe [2010-1-11 185672]

R3 NVCScheduler;Norman Virus Control Scheduler;c:\program\norman\nvc\bin\Nvcsched.exe [2010-1-11 148808]

S2 hgfs;hgfs;c:\windows\system32\drivers\hgfs.sys --> c:\windows\system32\drivers\hgfs.sys [?]

S3 ATHFMWDL;NETGEAR WG111T bootloader driver;c:\windows\system32\drivers\Athfmwdl.sys [2006-3-22 43392]

S3 fsssvc;Tjänsten Windows Live Family Safety;c:\program\windows live\family safety\fsssvc.exe [2010-4-28 704872]

S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2010-2-25 13224]

S3 s3legacy;s3legacy;c:\windows\system32\drivers\s3legacy.sys [2007-7-5 65664]

S3 SwitchBoard;SwitchBoard;c:\program\delade filer\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-8-4 14336]

S4 gupdate;Tjänsten Google Update (gupdate);c:\program\google\update\GoogleUpdate.exe [2010-3-2 135664]

============== File Associations ===============

regfile\shell\edit\command=%SystemRoot%\system32\NOTEPAD.EXE %1

=============== Created Last 30 ================

2010-07-24 17:20:13 0 dc----w- c:\temp\A.tmp

2010-07-24 16:24:45 0 dc----w- c:\temp\WPDNSE

2010-07-24 16:11:37 16384 -c--atw- c:\temp\Perflib_Perfdata_144.dat

2010-07-23 21:28:27 0 dc----w- c:\program\VirtualDJ

2010-07-23 19:37:30 0 dc----w- c:\windows\system32\Fonts

2010-07-23 19:32:23 16384 -c--atw- c:\temp\Perflib_Perfdata_154.dat

2010-07-23 19:20:22 0 dcsha-r- C:\cmdcons

2010-07-23 17:22:16 77312 -c--a-w- c:\windows\MBR.exe

2010-07-23 17:22:16 256512 -c--a-w- c:\windows\PEV.exe

2010-07-23 17:22:15 98816 -c--a-w- c:\windows\sed.exe

2010-07-23 17:22:15 161792 -c--a-w- c:\windows\SWREG.exe

2010-07-23 10:36:49 0 dc----w- c:\temp\div9.tmp

2010-07-21 10:05:08 0 dc----w- c:\temp\div3.tmp

2010-07-19 22:09:44 0 dc----w- c:\documents and settings\bou\Lokala instï¿½llningar

2010-07-19 22:03:13 0 dc----w- c:\docume~1\bou\applic~1\MozillaControl

2010-07-19 22:03:02 0 dc----w- c:\temp\{1D2C96C3-A3F3-49E7-B839-95279DED837F}

2010-07-19 22:01:57 0 dc----w- c:\program\Mozilla ActiveX Control v1.7.12

2010-07-19 21:57:51 0 dc----w- c:\program\Graboid

2010-07-19 20:12:43 0 dc----w- c:\temp\divBA.tmp

2010-07-14 18:13:10 62 -c--a-w- c:\windows\MyProg.ini

2010-07-14 15:11:53 744448 -c----w- c:\windows\system32\dllcache\helpsvc.exe

2010-07-14 15:08:53 0 dc----w- c:\temp\msohtml1

2010-07-14 15:08:53 0 dc----w- c:\temp\msohtml

2010-07-14 14:57:37 0 dc----w- c:\temp\VBE

2010-07-14 13:37:47 0 dc----w- c:\temp\iss1D.tmp

2010-07-14 13:19:10 0 dc----w- c:\temp\div16.tmp

2010-07-14 13:18:38 0 dc----w- c:\temp\is-TE48T.tmp

2010-07-14 12:58:46 0 dc----w- c:\temp\comtypes_cache

2010-07-14 11:51:31 0 dc----w- c:\windows\system32\wbem\Repository

2010-07-14 11:11:04 766976 -c--a-w- c:\windows\system32\drivers\djscd.sys

2010-07-14 11:02:49 0 dc----w- c:\temp\hsperfdata_bou

2010-07-14 10:58:40 0 dc----w- c:\temp\div5.tmp

2010-07-13 21:02:22 0 dc----w- c:\temp\MessengerCache

2010-07-13 19:01:04 0 dc----w- c:\docume~1\alluse~1\applic~1\wanted_demo

2010-07-13 18:48:05 0 dc----w- c:\program\WarnerBros

2010-07-13 14:52:44 0 dc----w- c:\windows\system32\AGEIA

2010-07-13 14:46:24 0 dc----w- c:\program\delade filer\Wise Installation Wizard

2010-07-13 09:47:29 0 dc----w- c:\temp\divA.tmp

2010-07-12 14:56:41 0 dc----w- c:\program\Thomas Wright Consulting

2010-07-11 11:08:50 0 dc----w- c:\windows\BBSTORE

2010-07-11 11:08:37 314368 -c--a-w- c:\windows\IsUninst.exe

2010-07-11 11:08:32 0 -c--a-w- c:\windows\SETUP32.INI

2010-07-11 10:51:23 0 dc----w- c:\program\Telia

2010-07-10 19:16:02 0 dc----w- c:\windows\system32\winrm

2010-07-10 19:15:49 0 dc-h--w- c:\windows\$968930Uinstall_KB968930$

2010-07-10 14:17:02 0 dc----w- c:\program\MAGIX

2010-07-10 14:17:02 0 dc----w- c:\docume~1\alluse~1\applic~1\MAGIX

2010-07-10 13:53:58 0 dc----w- c:\program\Ace Translator

2010-07-10 11:29:36 0 dc----w- c:\docume~1\alluse~1\applic~1\Boss Media

2010-07-08 19:56:02 0 dc----w- c:\windows\uninstall

2010-07-08 17:14:48 0 dc----w- c:\docume~1\bou\applic~1\Need for Speed World

2010-07-08 14:39:11 0 dc----w- c:\program\Ask.com

2010-07-08 14:39:02 0 dc----w- c:\program\Adobe PhotoShop CS3

2010-07-08 14:38:57 0 dc----w- c:\program\Vuze_Remote

2010-07-08 14:38:57 0 dc----w- c:\program\Windows Desktop Search

2010-07-08 14:38:57 0 dc----w- c:\program\PhotoFiltre

2010-07-08 14:38:56 0 dc----w- c:\program\Xara

2010-07-08 14:38:53 0 dc----w- c:\program\Uniblue

2010-07-08 14:38:52 0 dc----w- c:\program\UnHackMe

2010-07-08 14:38:51 0 dc----r- c:\program\Net Nanny

2010-07-08 14:36:30 0 dc----w- c:\program\delade filer\Adobe AIR

2010-07-08 13:13:55 0 dc----w- c:\docume~1\bou\applic~1\AdobeSupportAdvisor.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1

2010-07-08 13:13:34 0 dc----w- c:\program\AdobeSupportAdvisor

2010-07-08 13:13:24 0 dc----w- c:\program\delade filer\Adobe AIR(3)

2010-07-07 10:29:29 0 dc----w- c:\program\Activision

2010-07-04 20:04:27 0 dc----w- c:\docume~1\bou\applic~1\PlatinumHideIP

2010-07-04 20:04:27 0 dc----w- c:\docume~1\alluse~1\applic~1\PlatinumHideIP

2010-07-04 18:41:17 0 dc----w- c:\docume~1\bou\applic~1\DVD Flick

2010-07-04 18:40:59 28672 -c--a-w- c:\windows\system32\mousewheel.ocx

2010-07-04 18:40:59 212240 -c--a-w- c:\windows\system32\richtx32.ocx

2010-07-04 18:40:59 0 dc----w- c:\program\DVD Flick

2010-07-03 23:20:53 138056 -c--a-w- c:\windows\system32\drivers\PnkBstrK.sys

2010-07-03 23:20:53 138056 -c--a-w- c:\docume~1\bou\applic~1\PnkBstrK.sys

2010-07-03 23:20:38 189248 -c--a-w- c:\windows\system32\PnkBstrB.exe

2010-07-03 23:20:35 75064 -c--a-w- c:\windows\system32\PnkBstrA.exe

2010-07-03 23:20:34 2434856 -c--a-w- c:\windows\system32\pbsvc_bc2.exe

2010-07-01 19:53:46 0 dc----w- c:\docume~1\bou\applic~1\CheeseSoft

2010-07-01 19:53:39 0 dc----w- c:\program\FinalUninstaller

2010-06-27 15:36:35 0 dc----w- c:\program\Spybot - Search & Destroy

2010-06-27 15:36:35 0 dc----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy

2010-06-26 19:39:21 2 -cshatr- c:\windows\winstart.bat

2010-06-26 00:06:16 0 dc----w- c:\program\Conduit

==================== Find3M ====================

2010-06-21 19:14:46 0 -c-ha-w- c:\windows\system32\drivers\Msft_Kernel_SynTP_01009.Wdf

2010-06-21 19:14:41 0 -c-ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01009_Coinstaller_Critical.Wdf

2010-06-19 19:54:39 168448 -c--a-w- c:\windows\Wpicug.exe

2010-06-19 19:54:39 168448 -c--a-w- c:\windows\Wpicuf.exe

2010-06-19 19:54:39 168448 -c--a-w- c:\windows\Wpicue.exe

2010-06-19 19:54:39 168448 -c--a-w- c:\windows\Wpicud.exe

2010-06-19 19:54:39 168448 -c--a-w- c:\windows\Wpicuc.exe

2010-06-19 19:54:39 168448 -c--a-w- c:\windows\Wpicub.exe

2010-06-19 19:53:48 168448 -c--a-w- c:\windows\Wpicua.exe

2010-06-18 11:40:29 84650 -c--a-w- c:\windows\system32\perfc01D.dat

2010-06-18 11:40:29 446102 -c--a-w- c:\windows\system32\perfh01D.dat

2010-06-09 23:01:10 9200 -c----w- c:\windows\system32\drivers\cdralw2k.sys

2010-06-09 23:01:10 9072 -c----w- c:\windows\system32\drivers\cdr4_xp.sys

2010-06-09 23:01:10 45648 -c----w- c:\windows\system32\drivers\PxHelp20.sys

2010-06-09 23:01:10 133616 -c----w- c:\windows\system32\pxafs.dll

2010-06-09 23:01:10 126448 -c----w- c:\windows\system32\pxinsi64.exe

2010-06-09 23:01:10 123888 -c----w- c:\windows\system32\pxcpyi64.exe

2010-06-08 09:30:38 311296 -c--a-w- c:\windows\system32\TubeFinder.exe

2010-06-02 02:55:30 74072 -c--a-w- c:\windows\system32\XAPOFX1_5.dll

2010-06-02 02:55:30 527192 -c--a-w- c:\windows\system32\XAudio2_7.dll

2010-06-02 02:55:30 239960 -c--a-w- c:\windows\system32\xactengine3_7.dll

2010-05-27 20:32:58 245936 -c--a-w- c:\windows\system32\drivers\SynTP.sys

2010-05-27 20:31:32 165160 ----a-w- c:\windows\system32\SynTPAPI.dll

2010-05-27 20:31:32 120104 -c--a-w- c:\windows\system32\SynTPCo4.dll

2010-05-27 20:31:28 210216 -c--a-w- c:\windows\system32\SynCtrl.dll

2010-05-27 20:31:26 173352 ----a-w- c:\windows\system32\SynCOM.dll

2010-05-26 09:41:02 470880 -c--a-w- c:\windows\system32\d3dx10_43.dll

2010-05-26 09:41:02 248672 -c--a-w- c:\windows\system32\d3dx11_43.dll

2010-05-26 09:41:02 2106216 -c--a-w- c:\windows\system32\D3DCompiler_43.dll

2010-05-26 09:41:02 1998168 -c--a-w- c:\windows\system32\D3DX9_43.dll

2010-05-26 09:41:02 1868128 -c--a-w- c:\windows\system32\d3dcsx_43.dll

2010-05-17 19:00:47 59052 -c-ha-w- c:\windows\system32\mlfcache.dat

2010-05-06 10:36:51 916480 ----a-w- c:\windows\system32\wininet.dll

2010-05-02 08:10:15 1851264 ----a-w- c:\windows\system32\win32k.sys

2010-04-17 18:59:57 80 -csh--r- c:\windows\system32\D59F6963CD.dll

2010-03-03 21:38:59 245760 -csha-w- c:\windows\system32\config\systemprofile\ietldcache\index.dat

2010-02-23 19:07:22 32768 -csha-w- c:\windows\system32\config\systemprofile\lokala inställningar\tidigare\history.ie5\mshist012010022320100224\index.dat

============= FINISH: 19:20:51,47 ===============

Attach.txt

24 juli, 2010

uInternet Settings,ProxyServer = 127.0.0.1:8080

Har du själv ställt in att en Proxy Server ska användas?

På sidan http://www.virustotal.com trycker du på Bläddra-knappen och klistrar in ett av följande filnamn i rutan, tryck på Öppna och sedan Skicka Fil. Vänta tills resultatet är klart (Närvarande status blir genomförd). Klistra in en länk till resultatet här. Upprepa med nästa filnamn.

c:\windows\system32\drivers\djscd.sys

c:\windows\Wpicuc.exe

c:\windows\system32\D59F6963CD.dll

c:\windows\system32\mlfcache.dat

Vad finns i denna mapp?

2010-06-26 00:06:16 0 dc----w- c:\program\Conduit

Har du ändrat så att mappen c:\temp ska användas som mapp för tillfälliga filer?

24 juli, 2010

Jag ser i loggen att det finns en gammal java-version med säkerhetshål i

datorn,avinstallera den i Kontrollpanelen Lägg till eller ta bort program,

hämta sedan uppdaterad Java http://www.java.com/sv/

25 juli, 2010

uInternet Settings,ProxyServer = 127.0.0.1:8080

Har du själv ställt in att en Proxy Server ska användas?

På sidan http://www.virustotal.com trycker du på Bläddra-knappen och klistrar in ett av följande filnamn i rutan, tryck på Öppna och sedan Skicka Fil. Vänta tills resultatet är klart (Närvarande status blir genomförd). Klistra in en länk till resultatet här. Upprepa med nästa filnamn.

c:\windows\system32\drivers\djscd.sys

c:\windows\Wpicuc.exe

c:\windows\system32\D59F6963CD.dll

c:\windows\system32\mlfcache.dat

Vad finns i denna mapp?

2010-06-26 00:06:16 0 dc----w- c:\program\Conduit

Har du ändrat så att mappen c:\temp ska användas som mapp för tillfälliga filer?

Länk 1: http://www.virustotal.com/sv/analisis/4f3cc3292d02a47fd5bc029ecba70917745024867604d3393b512f5d392884e7-1280013778

Länk 2: http://www.virustotal.com/sv/analisis/8b3de3f83cbed34c29d9d27effd6bcd74534b8fcb65c6ea4dbe09b8ba40135ed-1277581823

Länk 3: http://www.virustotal.com/sv/analisis/742ac021f3d05d40282569ece8001feca9179af2c0c076734303d7881e10ea98-1277581762

Länk 4: http://www.virustotal.com/sv/analisis/dc722f6f1e422e47d298e77c1afe4eeab1f8bb33e97da5b9782de3e0b5a06a8b-1280061125

Jag har ingen aning om Proxy Servern (?)

I mappen c:\program\Conduit finns en mapp till som heter Community Alerts o i den mappen finns en dll-fil som heter Alert.dll

25 juli, 2010

Ett besvärligt rootkit verkar det vara.

1.

Ta bort den ComboFix du har på Skrivbordet och ladda ner en ny:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Stäng av alla program du ser inklusive antivirusprogram och antispionprogram men lämna brandväggen på.

Hur? Se http://www.bleepingcomputer.com/forums/topic114351.html'>http://www.bleepingcomputer.com/forums/topic114351.html

Kör ComboFix och följ anvisningarna som visas.

Om det kommer upp en fråga om du vill installera återställningskonsolen så svara ja.

VIKTIGT! Klicka inte på ComboFix-fönstret med musen när den körs annars kan den hänga upp sig.

När den är färdig så ska en logg komma upp, klistra in den i ditt svar. Kontrollera att antivirusprogram mm är igång innan du ansluter till internet.

Om du får problem med att komma ut på internet:

Kontrollpanelen - Nätverksanslutningar

högerklicka på din internetanslutning och välj Reparera och/eller starta om datorn.

2.

Spara denna fil på Skrivbordet:

http://rootrepeal.googlepages.com/RootRepeal.zip

Packa upp zip-filen (extrahera) så att du får en programfil.

Dra ut internetanslutningen. Stäng av alla program du ser inklusive brandvägg, antivirusprogram och antispionprogram.

Hur? Se http://www.bleepingcomputer.com/forums/topic114351.html

Starta RootRepeal (i Vista och Windows 7 som vanligt genom att högerklicka på ikonen och välja Kör som administratör).

Välj Report-fliken och tryck på Scan.

Bocka för alla sju valen och tryck sedan på Yes/Ja.

Välj C: och tryck Ok.

Det tar ett tag för RootRepeal att söka igenom C:.

När sökningen är klar så tryck på Save Report och spara den med namnet rootrepeal.log. Klistra in innehållet i rootrepeal.log i ditt svar.

3.

Spara Gmer på Skrivbordet från:

http://www2.gmer.net/download.php

Den har ett slumpmässigt namn så notera vad programmet sparas som.

Dra ur internetanslutningen.

Stäng alla program, även antivirusprogram och brandvägg.

Starta det nedladdade programmet.

En första snabbskanning startar.

Om det kommer upp en WARNING som nämner ROOTKIT och frågar om "fully scan" så välj Nej/No. Spara loggen och klistra in i ditt svar. Gör inte mer.

Om frågan inte kommer så välj fliken Rootkit/Malware, kontrollera att allt är förbockat till höger utom Show All och andra partitioner än C:\. Tryck på Scan. Låt datorn stå ifred medan Gmer håller på och det kan ta några timmar.

Tryck på Save och spara resultatet på Skrivbordet.

Sätt igång antivirusprogram och brandvägg innan du ansluter till internet.

Klistra in resultatet i ditt svar.

25 juli, 2010

Ett besvärligt rootkit verkar det vara.

1.

Ta bort den ComboFix du har på Skrivbordet och ladda ner en ny:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Stäng av alla program du ser inklusive antivirusprogram och antispionprogram men lämna brandväggen på.

Hur? Se http://www.bleepingcomputer.com/forums/topic114351.html'>http://www.bleepingcomputer.com/forums/topic114351.html

Kör ComboFix och följ anvisningarna som visas.

Om det kommer upp en fråga om du vill installera återställningskonsolen så svara ja.

VIKTIGT! Klicka inte på ComboFix-fönstret med musen när den körs annars kan den hänga upp sig.

När den är färdig så ska en logg komma upp, klistra in den i ditt svar. Kontrollera att antivirusprogram mm är igång innan du ansluter till internet.

Om du får problem med att komma ut på internet:

Kontrollpanelen - Nätverksanslutningar

högerklicka på din internetanslutning och välj Reparera och/eller starta om datorn.

2.

Spara denna fil på Skrivbordet:

http://rootrepeal.googlepages.com/RootRepeal.zip

Packa upp zip-filen (extrahera) så att du får en programfil.

Dra ut internetanslutningen. Stäng av alla program du ser inklusive brandvägg, antivirusprogram och antispionprogram.

Hur? Se http://www.bleepingcomputer.com/forums/topic114351.html

Starta RootRepeal (i Vista och Windows 7 som vanligt genom att högerklicka på ikonen och välja Kör som administratör).

Välj Report-fliken och tryck på Scan.

Bocka för alla sju valen och tryck sedan på Yes/Ja.

Välj C: och tryck Ok.

Det tar ett tag för RootRepeal att söka igenom C:.

När sökningen är klar så tryck på Save Report och spara den med namnet rootrepeal.log. Klistra in innehållet i rootrepeal.log i ditt svar.

3.

Spara Gmer på Skrivbordet från:

http://www2.gmer.net/download.php

Den har ett slumpmässigt namn så notera vad programmet sparas som.

Dra ur internetanslutningen.

Stäng alla program, även antivirusprogram och brandvägg.

Starta det nedladdade programmet.

En första snabbskanning startar.

Om det kommer upp en WARNING som nämner ROOTKIT och frågar om "fully scan" så välj Nej/No. Spara loggen och klistra in i ditt svar. Gör inte mer.

Om frågan inte kommer så välj fliken Rootkit/Malware, kontrollera att allt är förbockat till höger utom Show All och andra partitioner än C:\. Tryck på Scan. Låt datorn stå ifred medan Gmer håller på och det kan ta några timmar.

Tryck på Save och spara resultatet på Skrivbordet.

Sätt igång antivirusprogram och brandvägg innan du ansluter till internet.

Klistra in resultatet i ditt svar.

Jag har bifogat alla tre loggarna:

Combofix log.txt

RootRepeal report.txt

Gmer_ log.txt

26 juli, 2010

Jag klistrar in loggarna så att datt det är lätt att söka på det som står i och lätt att senare gå tillbaks och jämföra.

ComboFix 10-07-24.03 - bou 2010-07-25 18:18:25.3.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.46.1053.18.1919.1339 [GMT 2:00]

Körs från: c:\documents and settings\bou\Skrivbord\ComboFix.exe

AV: Norman Virus Control *On-access scanning disabled* (Updated) {EB9EFB40-AE72-4C43-B204-0FCD0E92D5F1}

* Resident AV is active

.

(((((((((((((((((((((((( Filer Skapade från 2010-06-25 till 2010-07-25 ))))))))))))))))))))))))))))))

.

2010-07-25 16:26 . 2010-07-25 16:26 53248 -c--a-w- c:\temp\catchme.dll

2010-07-25 16:18 . 2010-07-25 16:18 -------- dc----w- c:\temp\WPDNSE

2010-07-25 16:13 . 2010-07-25 16:13 16384 -c--atw- c:\temp\Perflib_Perfdata_73c.dat

2010-07-24 23:25 . 2010-07-24 23:25 503808 -c--a-w- c:\documents and settings\bou\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-7e9a8723-n\msvcp71.dll

2010-07-24 23:25 . 2010-07-24 23:25 499712 -c--a-w- c:\documents and settings\bou\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-7e9a8723-n\jmc.dll

2010-07-24 23:25 . 2010-07-24 23:25 348160 -c--a-w- c:\documents and settings\bou\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-7e9a8723-n\msvcr71.dll

2010-07-24 23:25 . 2010-07-24 23:25 12800 -c--a-w- c:\documents and settings\bou\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3f92c13a-n\decora-d3d.dll

2010-07-24 23:25 . 2010-07-24 23:25 61440 -c--a-w- c:\documents and settings\bou\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-3f92c13a-n\decora-sse.dll

2010-07-24 23:25 . 2010-06-22 02:36 423656 -c--a-w- c:\windows\system32\deployJava1.dll

2010-07-24 17:20 . 2010-07-25 15:31 -------- dc----w- c:\temp\A.tmp

2010-07-23 21:28 . 2010-07-23 21:28 -------- dc----w- c:\program\VirtualDJ