olmarik.zc virusproblem

[JIMBOOZONE]

Här kommer loggen från combofix:

 

ComboFix 10-11-17.04 - JIMMY 2010-11-18 18:57:48.4.4 - x86

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.46.1053.18.3061.2101 [GMT 1:00]

Körs från: c:\users\JIMMY\Desktop\ComboFix.exe

Använda kommandoväxlar :: c:\users\JIMMY\Desktop\CFScript.txt

* Resident AV is active

 

.

 

(((((((((((((((((((((((( Filer Skapade från 2010-10-18 till 2010-11-18 ))))))))))))))))))))))))))))))

.

 

2010-11-18 18:01 . 2010-11-18 18:01 -------- d-----w- c:\users\ZANDRA\AppData\Local\temp

2010-11-18 18:01 . 2010-11-18 18:01 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-11-17 18:27 . 2010-11-17 18:27 -------- d-----w- c:\program files\7-Zip

2010-11-17 18:12 . 2010-11-17 18:13 -------- d-----w- c:\programdata\WinZip

2010-11-17 17:25 . 2010-10-07 23:21 6146896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9F0B7322-D20F-4BC8-A973-F76E914C9036}\mpengine.dll

2010-11-14 19:03 . 2010-11-18 18:01 -------- d-----w- c:\users\JIMMY\AppData\Local\temp

2010-11-14 11:31 . 2010-11-14 11:31 -------- d-----w- c:\users\JIMMY\AppData\Roaming\Malwarebytes

2010-11-14 11:31 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-11-14 11:31 . 2010-11-14 11:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-11-14 11:31 . 2010-11-14 11:31 -------- d-----w- c:\programdata\Malwarebytes

2010-11-14 11:31 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-11-08 17:08 . 2010-11-08 17:08 -------- d-----w- C:\Antivirus REMOVAL TOOLS 2010

2010-11-07 10:48 . 2010-11-07 10:48 -------- d-----w- c:\users\JIMMY\AppData\Local\ESET

2010-11-06 10:37 . 2010-11-06 10:37 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll

2010-11-06 10:37 . 2010-11-06 10:37 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll

2010-11-04 11:25 . 2010-11-04 11:26 -------- d-----w- c:\users\ZANDRA\AppData\Roaming\Winamp

2010-11-04 11:19 . 2010-11-04 11:23 -------- d-----w- c:\users\ZANDRA\AppData\Roaming\Azureus

2010-10-29 10:17 . 2010-08-04 06:18 641536 ----a-w- c:\windows\system32\CPFilters.dll

2010-10-29 10:17 . 2010-08-04 06:17 417792 ----a-w- c:\windows\system32\msdri.dll

2010-10-29 10:17 . 2010-08-04 06:15 204288 ----a-w- c:\windows\system32\MSNP.ax

2010-10-29 10:17 . 2010-08-04 06:15 199680 ----a-w- c:\windows\system32\mpg2splt.ax

2010-10-29 10:17 . 2010-07-13 05:22 26504 ----a-w- c:\windows\system32\drivers\Diskdump.sys

2010-10-24 11:24 . 2010-10-24 11:24 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll

2010-10-24 11:24 . 2010-10-24 11:24 346944 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll

2010-10-23 12:14 . 2010-10-23 12:16 -------- d-----w- c:\program files\AdvancedDVDPlayer

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-11-17 18:28 . 2010-11-17 18:14 3451223 ----a-w- C:\Qoobox.zip

2010-11-05 21:25 . 2010-02-07 20:19 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll

2010-10-19 09:41 . 2010-02-12 08:00 222080 ------w- c:\windows\system32\MpSigStub.exe

2010-09-15 02:50 . 2010-09-28 18:29 472808 ----a-w- c:\windows\system32\deployJava1.dll

2010-09-08 04:30 . 2010-10-13 16:00 978432 ----a-w- c:\windows\system32\wininet.dll

2010-09-08 04:28 . 2010-10-13 16:00 44544 ----a-w- c:\windows\system32\licmgr10.dll

2010-09-08 03:22 . 2010-10-13 16:00 386048 ----a-w- c:\windows\system32\html.iec

2010-09-08 02:48 . 2010-10-13 16:00 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2010-09-02 07:05 . 2010-09-02 07:05 1247744 ----a-w- c:\windows\system32\drivers\athr.sys

2010-09-01 04:23 . 2010-10-13 16:00 12625408 ----a-w- c:\windows\system32\wmploc.DLL

2010-09-01 02:34 . 2010-10-13 16:00 2327552 ----a-w- c:\windows\system32\win32k.sys

2010-08-31 04:32 . 2010-10-13 16:00 954752 ----a-w- c:\windows\system32\mfc40.dll

2010-08-31 04:32 . 2010-10-13 16:00 954288 ----a-w- c:\windows\system32\mfc40u.dll

2010-08-27 05:46 . 2010-10-13 16:00 168448 ----a-w- c:\windows\system32\srvsvc.dll

2010-08-27 03:31 . 2010-10-13 16:00 310784 ----a-w- c:\windows\system32\drivers\srv.sys

2010-08-27 03:30 . 2010-10-13 16:00 308736 ----a-w- c:\windows\system32\drivers\srv2.sys

2010-08-27 03:30 . 2010-10-13 16:00 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys

2010-08-26 04:39 . 2010-10-13 16:00 109056 ----a-w- c:\windows\system32\t2embed.dll

2010-08-21 05:36 . 2010-10-13 15:59 738816 ----a-w- c:\windows\system32\wmpmde.dll

2010-08-21 05:36 . 2010-10-13 16:00 224256 ----a-w- c:\windows\system32\schannel.dll

2010-08-21 05:33 . 2010-10-13 16:00 530432 ----a-w- c:\windows\system32\comctl32.dll

2010-08-21 05:32 . 2010-09-19 11:42 316928 ----a-w- c:\windows\system32\spoolsv.exe

2008-08-16 16:42 . 2008-08-16 16:42 13112 ----a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll

2008-08-16 16:42 . 2008-08-16 16:42 70456 ----a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll

2008-08-16 16:42 . 2008-08-16 16:42 91448 ----a-w- c:\program files\mozilla firefox\plugins\confmgr.dll

2008-08-16 16:42 . 2008-08-16 16:42 20800 ----a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll

2008-08-16 16:43 . 2008-08-16 16:43 206136 ----a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll

2008-08-16 16:42 . 2008-08-16 16:42 31032 ----a-w- c:\program files\mozilla firefox\plugins\icafile.dll

2008-08-16 16:42 . 2008-08-16 16:42 40248 ----a-w- c:\program files\mozilla firefox\plugins\icalogon.dll

2008-05-21 07:41 . 2008-05-21 07:41 479232 ----a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll

2008-05-21 07:41 . 2008-05-21 07:41 548864 ----a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll

2008-05-21 07:41 . 2008-05-21 07:41 626688 ----a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll

2008-06-05 12:58 . 2008-06-05 12:58 648504 ----a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll

2008-08-16 16:42 . 2008-08-16 16:42 23864 ----a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll

.

 

(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Not* Tomma poster & legitima standardposter visas inte.

REGEDIT4

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote\tbVuze.dll" [2009-12-31 2349080]

 

[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}]

2009-12-31 10:53 2349080 ----a-w- c:\program files\Vuze_Remote\tbVuze.dll

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote\tbVuze.dll" [2009-12-31 2349080]

 

[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{BA14329E-9550-4989-B3F2-9732E92D17CC}"= "c:\program files\Vuze_Remote\tbVuze.dll" [2009-12-31 2349080]

 

[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Steam"="c:\program files\steam\steam.exe" [2010-11-17 1242448]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-12-15 8120864]

"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]

"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-06-03 103720]

"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]

"UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]

"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]

"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]

"UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]

"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-07-21 210216]

"APLangApp"="c:\program files\AnyPC Client\APLangApp.exe" [2009-11-20 13312]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-04 13830760]

"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-05-18 202256]

"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]

"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-10 689488]

"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-17 1848648]

"IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE" [2007-05-20 124512]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-09-29 2054360]

 

c:\users\ZANDRA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

 

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-10-2 795936]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer9"=wdmaud.drv

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

 

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate;Tjänsten Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-08 135664]

R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [2009-07-24 101248]

R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 125696]

R3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]

R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-02-12 1181328]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]

R3 WatAdminSvc;Aktiveringsteknologier för Windows-tjänst;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-21 1343400]

S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-09-23 64288]

S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-09-29 108792]

S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2009-05-28 10752]

S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-09-29 735960]

S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2009-09-29 95896]

S2 OberonGameConsoleService;Oberon Media Game Console service;c:\program files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [2009-08-13 44312]

S2 Rezip;Rezip;c:\windows\SYSTEM32\Rezip.exe [2009-03-05 311296]

S2 waclient;Portwise Access Client Driver;c:\windows\system32\drivers\waclient.sys [2010-08-05 34296]

S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-07-01 43944]

S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 29472]

S3 KMWDFilter1X;KM DRIVER;c:\windows\system32\DRIVERS\RP24GV1.sys [2009-10-28 16896]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-06-27 66080]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2010-02-15 322336]

 

.

Innehållet i mappen 'Schemalagda aktiviteter':

 

2010-11-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-08 19:42]

 

2010-11-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-08 19:42]

.

.

------- Extra genomsökning -------

.

uStart Page = hxxp://www.google.se/

IE: E&xportera till Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

IE: Skicka bild till &Bluetooth-enhet... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Skicka sida till &Bluetooth-enhet... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

DPF: {3195CF7C-E9E2-49B2-8B61-14F285298E1C} - hxxps://molnet.tranas.se/wa/AccessClientLoader.cab

FF - ProfilePath - c:\users\JIMMY\AppData\Roaming\Mozilla\Firefox\Profiles\fv4rxgmc.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.se/

FF - component: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll

FF - component: c:\users\JIMMY\AppData\Roaming\Mozilla\Firefox\Profiles\fv4rxgmc.default\extensions\flashcatch-amo@flashcatch.com\components\FlashCatch.dll

FF - component: c:\users\JIMMY\AppData\Roaming\Mozilla\Firefox\Profiles\fv4rxgmc.default\extensions\flashcatch-amo@flashcatch.com\components\FlashCatch191.dll

FF - component: c:\users\JIMMY\AppData\Roaming\Mozilla\Firefox\Profiles\fv4rxgmc.default\extensions\flashcatch-amo@flashcatch.com\components\FlashCatch192.dll

 

---- FIREFOX POLICY ----

c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");

.

.

--------------------- LÅSTA REGISTERNYCKLAR ---------------------

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe,-101"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil10l_ActiveX.exe"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

--------------------- DLLer som "laddats" under processer som körs ---------------------

 

- - - - - - - > 'Explorer.exe'(3704)

c:\program files\WIDCOMM\Bluetooth Software\btmmhook.dll

.

Sluttid: 2010-11-18 19:03:31

ComboFix-quarantined-files.txt 2010-11-18 18:03

ComboFix2.txt 2010-11-16 20:44

ComboFix3.txt 2010-11-14 19:03

 

Före genomsökningen: 64 302 546 944 byte ledigt

Efter genomsökningen: 64 239 042 560 byte ledigt

 

- - End Of File - - E3417CA8BFC521638C0115FB5ACA53D6

 

 

 

[JIMBOOZONE]

Har du en länk till DDS?

[Cecilia]

Förlåt det hade ju blivit fel i CFScript. En gång till med tre rader:

 

Kopiera alla rader i rutan:

RegLock::
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}][HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

och klistra in i Anteckningar. Kontrollera att det ser exakt likadant ut, t ex när det gäller radbrytningar.

Spara filen på Skrivbordet med namnet CFScript.

 

Förbered datorn på samma sätt som tidigare för ComboFix.

Dra CFScript med musen och släpp den ovanpå ComboFix-ikonen på Skrivbordet så startar programmet på ett särskilt sätt.

Klistra in loggen som kommer ut.

[Cecilia]

Spara DDS på Skrivbordet.

http://download.bleepingcomputer.com/sUBs/dds.scr

 

Starta programmet genom att dubbelklicka på det.

Tryck Yes/Ja om frågan om Optional Scan dyker upp.

I ditt svar klistrar du in loggen DSS.txt. Medan du bifogar Attach.txt som en fil (klicka på Använd full redigerare).

[JIMBOOZONE]

HÄR kommer logg 2!

 

Med combofix 3rader

 

ComboFix 10-11-17.04 - JIMMY 2010-11-18 19:30:16.5.4 - x86

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.46.1053.18.3061.2123 [GMT 1:00]

Körs från: c:\users\JIMMY\Desktop\ComboFix.exe

Använda kommandoväxlar :: c:\users\JIMMY\Desktop\CFScript.txt

* Resident AV is active

 

.

 

(((((((((((((((((((((((( Filer Skapade från 2010-10-18 till 2010-11-18 ))))))))))))))))))))))))))))))

.

 

2010-11-18 18:34 . 2010-11-18 18:34 -------- d-----w- c:\users\ZANDRA\AppData\Local\temp

2010-11-18 18:34 . 2010-11-18 18:34 -------- d-----w- c:\users\Default\AppData\Local\temp

2010-11-17 18:27 . 2010-11-17 18:27 -------- d-----w- c:\program files\7-Zip

2010-11-17 18:12 . 2010-11-17 18:13 -------- d-----w- c:\programdata\WinZip

2010-11-17 17:25 . 2010-10-07 23:21 6146896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{9F0B7322-D20F-4BC8-A973-F76E914C9036}\mpengine.dll

2010-11-14 19:03 . 2010-11-18 18:34 -------- d-----w- c:\users\JIMMY\AppData\Local\temp

2010-11-14 11:31 . 2010-11-14 11:31 -------- d-----w- c:\users\JIMMY\AppData\Roaming\Malwarebytes

2010-11-14 11:31 . 2010-04-29 14:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-11-14 11:31 . 2010-11-14 11:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-11-14 11:31 . 2010-11-14 11:31 -------- d-----w- c:\programdata\Malwarebytes

2010-11-14 11:31 . 2010-04-29 14:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-11-08 17:08 . 2010-11-08 17:08 -------- d-----w- C:\Antivirus REMOVAL TOOLS 2010

2010-11-07 10:48 . 2010-11-07 10:48 -------- d-----w- c:\users\JIMMY\AppData\Local\ESET

2010-11-06 10:37 . 2010-11-06 10:37 103864 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll

2010-11-06 10:37 . 2010-11-06 10:37 103864 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll

2010-11-04 11:25 . 2010-11-04 11:26 -------- d-----w- c:\users\ZANDRA\AppData\Roaming\Winamp

2010-11-04 11:19 . 2010-11-04 11:23 -------- d-----w- c:\users\ZANDRA\AppData\Roaming\Azureus

2010-10-29 10:17 . 2010-08-04 06:18 641536 ----a-w- c:\windows\system32\CPFilters.dll

2010-10-29 10:17 . 2010-08-04 06:17 417792 ----a-w- c:\windows\system32\msdri.dll

2010-10-29 10:17 . 2010-08-04 06:15 204288 ----a-w- c:\windows\system32\MSNP.ax

2010-10-29 10:17 . 2010-08-04 06:15 199680 ----a-w- c:\windows\system32\mpg2splt.ax

2010-10-29 10:17 . 2010-07-13 05:22 26504 ----a-w- c:\windows\system32\drivers\Diskdump.sys

2010-10-24 11:24 . 2010-10-24 11:24 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\Markup.dll

2010-10-24 11:24 . 2010-10-24 11:24 346944 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll

2010-10-23 12:14 . 2010-10-23 12:16 -------- d-----w- c:\program files\AdvancedDVDPlayer

 

.

(((((((((((((((((((((((((((((((((((((((( Find3M Rapport )))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-11-17 18:28 . 2010-11-17 18:14 3451223 ----a-w- C:\Qoobox.zip

2010-11-05 21:25 . 2010-02-07 20:19 48648 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\Markup.dll

2010-10-19 09:41 . 2010-02-12 08:00 222080 ------w- c:\windows\system32\MpSigStub.exe

2010-09-15 02:50 . 2010-09-28 18:29 472808 ----a-w- c:\windows\system32\deployJava1.dll

2010-09-08 04:30 . 2010-10-13 16:00 978432 ----a-w- c:\windows\system32\wininet.dll

2010-09-08 04:28 . 2010-10-13 16:00 44544 ----a-w- c:\windows\system32\licmgr10.dll

2010-09-08 03:22 . 2010-10-13 16:00 386048 ----a-w- c:\windows\system32\html.iec

2010-09-08 02:48 . 2010-10-13 16:00 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2010-09-02 07:05 . 2010-09-02 07:05 1247744 ----a-w- c:\windows\system32\drivers\athr.sys

2010-09-01 04:23 . 2010-10-13 16:00 12625408 ----a-w- c:\windows\system32\wmploc.DLL

2010-09-01 02:34 . 2010-10-13 16:00 2327552 ----a-w- c:\windows\system32\win32k.sys

2010-08-31 04:32 . 2010-10-13 16:00 954752 ----a-w- c:\windows\system32\mfc40.dll

2010-08-31 04:32 . 2010-10-13 16:00 954288 ----a-w- c:\windows\system32\mfc40u.dll

2010-08-27 05:46 . 2010-10-13 16:00 168448 ----a-w- c:\windows\system32\srvsvc.dll

2010-08-27 03:31 . 2010-10-13 16:00 310784 ----a-w- c:\windows\system32\drivers\srv.sys

2010-08-27 03:30 . 2010-10-13 16:00 308736 ----a-w- c:\windows\system32\drivers\srv2.sys

2010-08-27 03:30 . 2010-10-13 16:00 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys

2010-08-26 04:39 . 2010-10-13 16:00 109056 ----a-w- c:\windows\system32\t2embed.dll

2010-08-21 05:36 . 2010-10-13 15:59 738816 ----a-w- c:\windows\system32\wmpmde.dll

2010-08-21 05:36 . 2010-10-13 16:00 224256 ----a-w- c:\windows\system32\schannel.dll

2010-08-21 05:33 . 2010-10-13 16:00 530432 ----a-w- c:\windows\system32\comctl32.dll

2010-08-21 05:32 . 2010-09-19 11:42 316928 ----a-w- c:\windows\system32\spoolsv.exe

2008-08-16 16:42 . 2008-08-16 16:42 13112 ----a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll

2008-08-16 16:42 . 2008-08-16 16:42 70456 ----a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll

2008-08-16 16:42 . 2008-08-16 16:42 91448 ----a-w- c:\program files\mozilla firefox\plugins\confmgr.dll

2008-08-16 16:42 . 2008-08-16 16:42 20800 ----a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll

2008-08-16 16:43 . 2008-08-16 16:43 206136 ----a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll

2008-08-16 16:42 . 2008-08-16 16:42 31032 ----a-w- c:\program files\mozilla firefox\plugins\icafile.dll

2008-08-16 16:42 . 2008-08-16 16:42 40248 ----a-w- c:\program files\mozilla firefox\plugins\icalogon.dll

2008-05-21 07:41 . 2008-05-21 07:41 479232 ----a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll

2008-05-21 07:41 . 2008-05-21 07:41 548864 ----a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll

2008-05-21 07:41 . 2008-05-21 07:41 626688 ----a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll

2008-06-05 12:58 . 2008-06-05 12:58 648504 ----a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll

2008-08-16 16:42 . 2008-08-16 16:42 23864 ----a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll

.

 

(((((((((((((((((((((((((((((((((( Startpunkter i registret )))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Not* Tomma poster & legitima standardposter visas inte.

REGEDIT4

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote\tbVuze.dll" [2009-12-31 2349080]

 

[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]

 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ba14329e-9550-4989-b3f2-9732e92d17cc}]

2009-12-31 10:53 2349080 ----a-w- c:\program files\Vuze_Remote\tbVuze.dll

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{ba14329e-9550-4989-b3f2-9732e92d17cc}"= "c:\program files\Vuze_Remote\tbVuze.dll" [2009-12-31 2349080]

 

[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{BA14329E-9550-4989-B3F2-9732E92D17CC}"= "c:\program files\Vuze_Remote\tbVuze.dll" [2009-12-31 2349080]

 

[HKEY_CLASSES_ROOT\clsid\{ba14329e-9550-4989-b3f2-9732e92d17cc}]

 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Steam"="c:\program files\steam\steam.exe" [2010-11-17 1242448]

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-12-15 8120864]

"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]

"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-06-03 103720]

"UpdateP2GoShortCut"="c:\program files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]

"UpdatePDRShortCut"="c:\program files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" [2008-01-04 222504]

"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2009-04-15 91432]

"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2009-04-15 50472]

"UpdatePPShortCut"="c:\program files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]

"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-07-21 210216]

"APLangApp"="c:\program files\AnyPC Client\APLangApp.exe" [2009-11-20 13312]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-04 13830760]

"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-05-18 202256]

"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]

"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-03-10 689488]

"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-17 1848648]

"IJNetworkScanUtility"="c:\program files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE" [2007-05-20 124512]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-20 932288]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-09-29 2054360]

 

c:\users\ZANDRA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]

 

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-10-2 795936]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 0 (0x0)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

"PromptOnSecureDesktop"= 0 (0x0)

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"mixer9"=wdmaud.drv

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp

 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

 

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate;Tjänsten Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-02-08 135664]

R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [2009-07-24 101248]

R3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2009-10-26 125696]

R3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\DRIVERS\KMWDFILTER.sys [2009-04-29 25088]

R3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-02-12 1181328]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-13 139776]

R3 WatAdminSvc;Aktiveringsteknologier för Windows-tjänst;c:\windows\system32\Wat\WatAdminSvc.exe [2010-05-21 1343400]

S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-09-23 64288]

S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-09-29 108792]

S1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\Drivers\SABI.sys [2009-05-28 10752]

S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-09-29 735960]

S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2009-09-29 95896]

S2 OberonGameConsoleService;Oberon Media Game Console service;c:\program files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [2009-08-13 44312]

S2 Rezip;Rezip;c:\windows\SYSTEM32\Rezip.exe [2009-03-05 311296]

S2 waclient;Portwise Access Client Driver;c:\windows\system32\drivers\waclient.sys [2010-08-05 34296]

S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2009-07-01 43944]

S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2009-04-07 29472]

S3 KMWDFilter1X;KM DRIVER;c:\windows\system32\DRIVERS\RP24GV1.sys [2009-10-28 16896]

S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-06-27 66080]

S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x86.sys [2010-02-15 322336]

 

.

Innehållet i mappen 'Schemalagda aktiviteter':

 

2010-11-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-08 19:42]

 

2010-11-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-08 19:42]

.

.

------- Extra genomsökning -------

.

uStart Page = hxxp://www.google.se/

IE: E&xportera till Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

IE: Skicka bild till &Bluetooth-enhet... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

IE: Skicka sida till &Bluetooth-enhet... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

DPF: {3195CF7C-E9E2-49B2-8B61-14F285298E1C} - hxxps://molnet.tranas.se/wa/AccessClientLoader.cab

FF - ProfilePath - c:\users\JIMMY\AppData\Roaming\Mozilla\Firefox\Profiles\fv4rxgmc.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.se/

FF - component: c:\programdata\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll

FF - component: c:\users\JIMMY\AppData\Roaming\Mozilla\Firefox\Profiles\fv4rxgmc.default\extensions\flashcatch-amo@flashcatch.com\components\FlashCatch.dll

FF - component: c:\users\JIMMY\AppData\Roaming\Mozilla\Firefox\Profiles\fv4rxgmc.default\extensions\flashcatch-amo@flashcatch.com\components\FlashCatch191.dll

FF - component: c:\users\JIMMY\AppData\Roaming\Mozilla\Firefox\Profiles\fv4rxgmc.default\extensions\flashcatch-amo@flashcatch.com\components\FlashCatch192.dll

 

---- FIREFOX POLICY ----

c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");

.

.

--------------------- LÅSTA REGISTERNYCKLAR ---------------------

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

 

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

 

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

--------------------- DLLer som "laddats" under processer som körs ---------------------

 

- - - - - - - > 'Explorer.exe'(5752)

c:\program files\WIDCOMM\Bluetooth Software\btmmhook.dll

.

Sluttid: 2010-11-18 19:35:49

ComboFix-quarantined-files.txt 2010-11-18 18:35

ComboFix2.txt 2010-11-18 18:03

ComboFix3.txt 2010-11-16 20:44

ComboFix4.txt 2010-11-14 19:03

 

Före genomsökningen: 64 303 718 400 byte ledigt

Efter genomsökningen: 64 237 322 240 byte ledigt

 

- - End Of File - - E7AC420B4262696279C16AEAB3B29CC0

 

 

 

[JIMBOOZONE]

DDS LOGG

 

 

DDS (Ver_10-11-10.01) - NTFSx86

Run by JIMMY at 19:54:15,44 on 2010-11-18

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_22

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.46.1053.18.3061.1994 [GMT 1:00]

 

 

============== Running Processes ===============

 

C:\windows\system32\wininit.exe

C:\windows\system32\lsm.exe

C:\windows\system32\svchost.exe -k DcomLaunch

C:\windows\system32\nvvsvc.exe

C:\windows\system32\svchost.exe -k RPCSS

C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\windows\system32\svchost.exe -k netsvcs

C:\windows\system32\svchost.exe -k LocalService

C:\windows\system32\svchost.exe -k NetworkService

C:\windows\system32\nvvsvc.exe

C:\windows\System32\spoolsv.exe

C:\windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe

C:\windows\system32\taskeng.exe

C:\windows\system32\Dwm.exe

C:\windows\system32\taskhost.exe

C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe

C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe

C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe

C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE

C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\windows\SYSTEM32\Rezip.exe

C:\Program Files\CyberLink\Shared files\RichVideo.exe

C:\windows\system32\svchost.exe -k imgsvc

C:\windows\System32\svchost.exe -k secsvcs

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\windows\system32\SearchIndexer.exe

C:\windows\system32\svchost.exe -k bthsvcs

C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\windows\System32\svchost.exe -k LocalServicePeerNet

C:\windows\system32\DllHost.exe

C:\windows\system32\taskhost.exe

C:\windows\system32\wuauclt.exe

C:\windows\Explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\windows\system32\vssvc.exe

C:\windows\System32\svchost.exe -k swprv

C:\Users\JIMMY\Desktop\dds.scr

C:\windows\system32\conhost.exe

C:\windows\system32\wbem\wmiprvse.exe

 

============== Pseudo HJT Report ===============

 

uStart Page = hxxp://www.google.se/

uURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\tbVuze.dll

mURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\tbVuze.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: Inloggningshjälp för Windows Live ID: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5805.1910\swg.dll

BHO: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\tbVuze.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - c:\program files\vuze_remote\tbVuze.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [steam] "c:\program files\steam\steam.exe" -silent

mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s

mRun: [updateLBPShortCut] "c:\program files\cyberlink\labelprint\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\labelprint" updatewithcreateonce "software\cyberlink\labelprint\2.5"

mRun: [CLMLServer] "c:\program files\cyberlink\power2go\CLMLSvc.exe"

mRun: [updateP2GoShortCut] "c:\program files\cyberlink\power2go\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\power2go" updatewithcreateonce "software\cyberlink\power2go\6.0"

mRun: [updatePDRShortCut] "c:\program files\cyberlink\powerdirector\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\powerdirector" updatewithcreateonce "software\cyberlink\powerdirector\7.0"

mRun: [RemoteControl8] "c:\program files\cyberlink\powerdvd8\PDVD8Serv.exe"

mRun: [PDVD8LanguageShortcut] "c:\program files\cyberlink\powerdvd8\language\Language.exe"

mRun: [updatePPShortCut] "c:\program files\cyberlink\powerproducer\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\powerproducer" updatewithcreateonce "software\cyberlink\powerproducer\5.0"

mRun: [updatePSTShortCut] "c:\program files\cyberlink\dvd suite\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\dvd suite" updatewithcreateonce "software\cyberlink\PowerStarter"

mRun: [APLangApp] "c:\program files\anypc client\APLangApp.exe"

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [uCam_Menu] "c:\program files\cyberlink\youcam\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\youcam" updatewithcreateonce "software\cyberlink\youcam\2.0"

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot

mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin

mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon

mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon

mRun: [iJNetworkScanUtility] c:\program files\canon\canon ij network scan utility\CNMNSUT.EXE

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: E&xportera till Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

IE: Skicka bild till &Bluetooth-enhet... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm

IE: Skicka sida till &Bluetooth-enhet... - c:\program files\widcomm\bluetooth software\btsendto_ie.htm

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL

DPF: {3195CF7C-E9E2-49B2-8B61-14F285298E1C} - hxxps://molnet.tranas.se/wa/AccessClientLoader.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

 

================= FIREFOX ===================

 

FF - ProfilePath - c:\users\jimmy\appdata\roaming\mozilla\firefox\profiles\fv4rxgmc.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.se/

FF - component: c:\programdata\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll

FF - component: c:\users\jimmy\appdata\roaming\mozilla\firefox\profiles\fv4rxgmc.default\extensions\flashcatch-amo@flashcatch.com\components\FlashCatch.dll

FF - component: c:\users\jimmy\appdata\roaming\mozilla\firefox\profiles\fv4rxgmc.default\extensions\flashcatch-amo@flashcatch.com\components\FlashCatch191.dll

FF - component: c:\users\jimmy\appdata\roaming\mozilla\firefox\profiles\fv4rxgmc.default\extensions\flashcatch-amo@flashcatch.com\components\FlashCatch192.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

 

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.visited_color", "#551A8B");

c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.videoFeeds.handler", "ask");

 

============= SERVICES / DRIVERS ===============

 

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-2-12 64288]

R1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\drivers\SABI.sys [2010-1-5 10752]

R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]

R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-9-29 735960]

R2 epfwwfpr;epfwwfpr;c:\windows\system32\drivers\epfwwfpr.sys [2009-9-29 95896]

R2 OberonGameConsoleService;Oberon Media Game Console service;c:\program files\samsung casual games\gameconsole\OberonGameConsoleService.exe [2010-2-7 44312]

R2 Rezip;Rezip;c:\windows\system32\Rezip.exe [2010-1-5 311296]

R2 waclient;Portwise Access Client Driver;c:\windows\system32\drivers\waclient.sys [2010-3-6 34296]

R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-1-6 43944]

R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2010-2-7 29472]

R3 KMWDFilter1X;KM DRIVER;c:\windows\system32\drivers\RP24GV1.sys [2009-10-28 16896]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2010-1-6 66080]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk62x86.sys [2010-2-15 322336]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate;Tjänsten Google Update (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-8 135664]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2010-2-7 54632]

S3 fsssvc;Tjänsten Windows Live Family Safety;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]

S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [2010-7-17 101248]

S3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [2010-1-6 125696]

S3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\drivers\KMWDFILTER.sys [2009-4-29 25088]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-9-24 1181328]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2009-6-10 139776]

S3 WatAdminSvc;Aktiveringsteknologier för Windows-tjänst;c:\windows\system32\wat\WatAdminSvc.exe [2010-5-21 1343400]

 

=============== Created Last 30 ================

 

2010-11-18 18:34:59 -------- d-sh--w- C:\$RECYCLE.BIN

2010-11-17 17:25:46 6146896 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{9f0b7322-d20f-4bc8-a973-f76e914c9036}\mpengine.dll

2010-11-14 19:03:55 -------- d-----w- c:\users\jimmy\appdata\local\temp

2010-11-14 18:55:19 98816 ----a-w- c:\windows\sed.exe

2010-11-14 18:55:19 89088 ----a-w- c:\windows\MBR.exe

2010-11-14 18:55:19 256512 ----a-w- c:\windows\PEV.exe

2010-11-14 18:55:19 161792 ----a-w- c:\windows\SWREG.exe

2010-11-14 11:31:58 -------- d-----w- c:\users\jimmy\appdata\roaming\Malwarebytes

2010-11-14 11:31:48 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-11-14 11:31:47 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-11-14 11:31:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-11-14 11:31:47 -------- d-----w- c:\progra~2\Malwarebytes

2010-11-08 17:08:04 -------- d-----w- C:\Antivirus REMOVAL TOOLS 2010

2010-11-07 10:48:38 -------- d-----w- c:\users\jimmy\appdata\local\ESET

2010-11-06 10:37:34 103864 ----a-w- c:\program files\mozilla firefox\plugins\nppdf32.dll

2010-11-06 10:37:34 103864 ----a-w- c:\program files\internet explorer\plugins\nppdf32.dll

2010-10-29 10:17:23 641536 ----a-w- c:\windows\system32\CPFilters.dll

2010-10-29 10:17:23 417792 ----a-w- c:\windows\system32\msdri.dll

2010-10-29 10:17:23 204288 ----a-w- c:\windows\system32\MSNP.ax

2010-10-29 10:17:23 199680 ----a-w- c:\windows\system32\mpg2splt.ax

2010-10-29 10:17:17 26504 ----a-w- c:\windows\system32\drivers\Diskdump.sys

2010-10-24 11:24:51 48648 ----a-w- c:\progra~2\microsoft\ehome\packages\mceclientux\updateablemarkup-2\Markup.dll

2010-10-24 11:24:47 346944 ----a-w- c:\progra~2\microsoft\ehome\packages\mcespotlight\mcespotlight-2\SpotlightResources.dll

2010-10-23 12:14:04 -------- d-----w- c:\program files\AdvancedDVDPlayer

 

==================== Find3M ====================

 

2010-10-19 09:41:44 222080 ------w- c:\windows\system32\MpSigStub.exe

2010-09-15 02:50:37 472808 ----a-w- c:\windows\system32\deployJava1.dll

2010-09-08 04:30:04 978432 ----a-w- c:\windows\system32\wininet.dll

2010-09-08 04:28:15 44544 ----a-w- c:\windows\system32\licmgr10.dll

2010-09-08 03:22:31 386048 ----a-w- c:\windows\system32\html.iec

2010-09-08 02:48:16 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2010-09-01 04:23:49 12625408 ----a-w- c:\windows\system32\wmploc.DLL

2010-09-01 02:34:52 2327552 ----a-w- c:\windows\system32\win32k.sys

2010-08-31 04:32:30 954752 ----a-w- c:\windows\system32\mfc40.dll

2010-08-31 04:32:30 954288 ----a-w- c:\windows\system32\mfc40u.dll

2010-08-27 05:46:48 168448 ----a-w- c:\windows\system32\srvsvc.dll

2010-08-26 04:39:58 109056 ----a-w- c:\windows\system32\t2embed.dll

2010-08-21 05:36:33 738816 ----a-w- c:\windows\system32\wmpmde.dll

2010-08-21 05:36:24 224256 ----a-w- c:\windows\system32\schannel.dll

2010-08-21 05:33:24 530432 ----a-w- c:\windows\system32\comctl32.dll

2010-08-21 05:32:37 316928 ----a-w- c:\windows\system32\spoolsv.exe

 

============= FINISH: 19:54:32,04 ===============

 

 

Attach.txt

[Cecilia]

Har du gjort något mer försök med SystemLook?

[Cecilia]

Jag förstår inte varför forumet vill göra om mina tre rader till CFScript till två, men det gick ju bra ändå

 

Avinstallera Vuze_Remote Toolbar

 

I Firefox - Verktyg - Tillägg - Insticksmoduler ser du ut att ha en gammal Java-version kvar, SE 6 U21, förutom den senaste SE 6 U22. Klicka på den gamla och sedan Inaktivera eftersom det är en säkerhetsrisk.

 

Kopiera alla rader i rutan:

DEQUARANTINE::
C:\Qoobox\Quarantine\C\Windows\Sec\172100logo.bmp.vir
C:\Qoobox\Quarantine\C\Windows\Sec\banner.png.vir
C:\Qoobox\Quarantine\C\Windows\Sec\Computer.png.vir
C:\Qoobox\Quarantine\C\Windows\Sec\Media _S_ Logo.png.vir
C:\Qoobox\Quarantine\C\Windows\Sec\Samsung.png.vir
C:\Qoobox\Quarantine\C\Windows\Sec\Samsung2.png.vir
C:\Qoobox\Quarantine\C\Windows\Sec\SamsungLogo.png.vir
C:\Qoobox\Quarantine\C\Windows\Sec\Thumbs.db.vir
C:\Qoobox\Quarantine\C\Windows\Sec\Wallpapers\Thumbs.db.vir
C:\Qoobox\Quarantine\C\Windows\Sec\Wallpapers\wallpaper.jpg.vir
C:\Qoobox\Quarantine\C\Windows\Sec\Wallpapers\wallpaper1.jpg.vir
C:\Qoobox\Quarantine\C\Windows\Sec\Wallpapers\Wallpaper2.jpg.vir
Quit::

och klistra in i Anteckningar. Kontrollera att det ser exakt likadant ut, t ex när det gäller radbrytningar.

Spara filen på Skrivbordet med namnet CFScript.

 

Förbered datorn på samma sätt som tidigare för ComboFix.

Dra CFScript med musen och släpp den ovanpå ComboFix-ikonen på Skrivbordet så startar programmet på ett särskilt sätt.

Klistra in loggen som kommer ut.

[JIMBOOZONE]

Nu körde jag systemlook på samma sätt som i inlägg #37, och här är loggen:

 

SystemLook 04.09.10 by jpshortstuff

Log created at 20:23 on 19/11/2010 by JIMMY

Administrator - Elevation successful

 

========== filefind ==========

 

Searching for "tcpip.sys"

C:\Windows\ERDNT\cache\tcpip.sys --a---- 1285712 bytes [20:42 16/11/2010] [01:19 14/07/2009] 2CC3D75488ABD3EC628BBB9A4FC84EFC

C:\Windows\System32\drivers\tcpip.sys --a---- 1285712 bytes [07:06 18/08/2010] [01:19 14/07/2009] 2CC3D75488ABD3EC628BBB9A4FC84EFC

C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.16385_none_b2f46875c7b9d667\tcpip.sys --a---- 1285712 bytes [23:13 13/07/2009] [01:19 14/07/2009] 2CC3D75488ABD3EC628BBB9A4FC84EFC

C:\Windows\winsxs\x86_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7600.20733_none_b3b219fae0b0af43\tcpip.sys --a---- 1288576 bytes [07:06 18/08/2010] [06:06 14/06/2010] A39EA325C081AD27461F630C8E3E56E0

 

-= EOF =-

 

Blev det rätt?

 

 

[Cecilia]

Ja, det ser bra ut. Ingen av de skadliga tcpip.sys-filerna är kvar.

[JIMBOOZONE]

OK, skönt!

 

Här kommer loggen från combofix nu:

 

 

 

C:\Qoobox\Quarantine\C\Windows\Sec\172100logo.bmp.vir -> C:\Windows\Sec\172100logo.bmp ( 51656 bytes )

 

C:\Qoobox\Quarantine\C\Windows\Sec\banner.png.vir -> C:\Windows\Sec\banner.png ( 60830 bytes )

 

C:\Qoobox\Quarantine\C\Windows\Sec\Computer.png.vir -> C:\Windows\Sec\Computer.png ( 24847 bytes )

 

C:\Qoobox\Quarantine\C\Windows\Sec\Media _S_ Logo.png.vir -> C:\Windows\Sec\Media _S_ Logo.png ( 3845 bytes )

 

C:\Qoobox\Quarantine\C\Windows\Sec\Samsung.png.vir -> C:\Windows\Sec\Samsung.png ( 14742 bytes )

 

C:\Qoobox\Quarantine\C\Windows\Sec\Samsung2.png.vir -> C:\Windows\Sec\Samsung2.png ( 16018 bytes )

 

C:\Qoobox\Quarantine\C\Windows\Sec\SamsungLogo.png.vir -> C:\Windows\Sec\SamsungLogo.png ( 4214 bytes )

 

C:\Qoobox\Quarantine\C\Windows\Sec\Thumbs.db.vir -> C:\Windows\Sec\Thumbs.db ( 16384 bytes )

 

C:\Qoobox\Quarantine\C\Windows\Sec\Wallpapers\Thumbs.db.vir -> C:\Windows\Sec\Wallpapers\Thumbs.db ( 15360 bytes )

 

C:\Qoobox\Quarantine\C\Windows\Sec\Wallpapers\wallpaper.jpg.vir -> C:\Windows\Sec\Wallpapers\wallpaper.jpg ( 624506 bytes )

 

C:\Qoobox\Quarantine\C\Windows\Sec\Wallpapers\wallpaper1.jpg.vir -> C:\Windows\Sec\Wallpapers\wallpaper1.jpg ( 865120 bytes )

 

C:\Qoobox\Quarantine\C\Windows\Sec\Wallpapers\Wallpaper2.jpg.vir -> C:\Windows\Sec\Wallpapers\Wallpaper2.jpg ( 614090 bytes )

 

 

 

 

[Cecilia]

Ser ju utmärkt ut

 

Klistra in en ny DDS-logg, men inte Attach-loggen, för att se att avinstallationen av Vuze toolbar hade avsedd effekt.

[JIMBOOZONE]

Här är loggen!

 

 

DDS (Ver_10-11-10.01) - NTFSx86

Run by JIMMY at 1:37:36,88 on 2010-11-20

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_22

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.46.1053.18.3061.1910 [GMT 1:00]

 

 

============== Running Processes ===============

 

C:\windows\system32\wininit.exe

C:\windows\system32\lsm.exe

C:\windows\system32\svchost.exe -k DcomLaunch

C:\windows\system32\nvvsvc.exe

C:\windows\system32\svchost.exe -k RPCSS

C:\windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\windows\system32\svchost.exe -k netsvcs

C:\windows\system32\svchost.exe -k LocalService

C:\windows\system32\svchost.exe -k NetworkService

C:\windows\System32\spoolsv.exe

C:\windows\system32\nvvsvc.exe

C:\windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe

C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe

C:\windows\SYSTEM32\Rezip.exe

C:\Program Files\CyberLink\Shared files\RichVideo.exe

C:\windows\system32\svchost.exe -k imgsvc

C:\windows\System32\svchost.exe -k secsvcs

C:\windows\system32\svchost.exe -k bthsvcs

C:\windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\windows\system32\taskhost.exe

C:\windows\system32\taskeng.exe

C:\windows\system32\Dwm.exe

C:\windows\Explorer.EXE

C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe

C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe

C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe

C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE

C:\Program Files\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Eset\ESET NOD32 Antivirus\egui.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe

C:\windows\System32\svchost.exe -k LocalServicePeerNet

C:\windows\system32\DllHost.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\windows\system32\SearchIndexer.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\WUDFHost.exe

C:\windows\system32\SearchProtocolHost.exe

C:\windows\system32\SearchFilterHost.exe

C:\windows\System32\svchost.exe -k WerSvcGroup

C:\windows\system32\taskeng.exe

C:\Users\JIMMY\Desktop\dds.scr

C:\windows\system32\conhost.exe

C:\windows\system32\wbem\wmiprvse.exe

 

============== Pseudo HJT Report ===============

 

uStart Page = hxxp://www.google.se/

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\programdata\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5805.1910\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

uRun: [steam] "c:\program files\steam\steam.exe" -silent

mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s

mRun: [updateLBPShortCut] "c:\program files\cyberlink\labelprint\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\labelprint" updatewithcreateonce "software\cyberlink\labelprint\2.5"

mRun: [CLMLServer] "c:\program files\cyberlink\power2go\CLMLSvc.exe"

mRun: [updateP2GoShortCut] "c:\program files\cyberlink\power2go\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\power2go" updatewithcreateonce "software\cyberlink\power2go\6.0"

mRun: [updatePDRShortCut] "c:\program files\cyberlink\powerdirector\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\powerdirector" updatewithcreateonce "software\cyberlink\powerdirector\7.0"

mRun: [RemoteControl8] "c:\program files\cyberlink\powerdvd8\PDVD8Serv.exe"

mRun: [PDVD8LanguageShortcut] "c:\program files\cyberlink\powerdvd8\language\Language.exe"

mRun: [updatePPShortCut] "c:\program files\cyberlink\powerproducer\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\powerproducer" updatewithcreateonce "software\cyberlink\powerproducer\5.0"

mRun: [updatePSTShortCut] "c:\program files\cyberlink\dvd suite\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\dvd suite" updatewithcreateonce "software\cyberlink\PowerStarter"

mRun: [APLangApp] "c:\program files\anypc client\APLangApp.exe"

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [uCam_Menu] "c:\program files\cyberlink\youcam\muitransfer\muistartmenu.exe" "c:\program files\cyberlink\youcam" updatewithcreateonce "software\cyberlink\youcam\2.0"

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot

mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin

mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon

mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon

mRun: [iJNetworkScanUtility] c:\program files\canon\canon ij network scan utility\CNMNSUT.EXE

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe

mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableLUA = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

mPolicies-system: PromptOnSecureDesktop = 0 (0x0)

IE: E&xportera till Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

IE: Skicka bild till &Bluetooth-enhet... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm

IE: Skicka sida till &Bluetooth-enhet... - c:\program files\widcomm\bluetooth software\btsendto_ie.htm

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL

DPF: {3195CF7C-E9E2-49B2-8B61-14F285298E1C} - hxxps://molnet.tranas.se/wa/AccessClientLoader.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

 

================= FIREFOX ===================

 

FF - ProfilePath - c:\users\jimmy\appdata\roaming\mozilla\firefox\profiles\fv4rxgmc.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.google.se/

FF - component: c:\programdata\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll

FF - component: c:\users\jimmy\appdata\roaming\mozilla\firefox\profiles\fv4rxgmc.default\extensions\flashcatch-amo@flashcatch.com\components\FlashCatch.dll

FF - component: c:\users\jimmy\appdata\roaming\mozilla\firefox\profiles\fv4rxgmc.default\extensions\flashcatch-amo@flashcatch.com\components\FlashCatch191.dll

FF - component: c:\users\jimmy\appdata\roaming\mozilla\firefox\profiles\fv4rxgmc.default\extensions\flashcatch-amo@flashcatch.com\components\FlashCatch192.dll

FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft\office live\npOLW.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npicaN.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

FF - plugin: c:\programdata\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}

 

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.visited_color", "#551A8B");

c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".se");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.videoFeeds.handler", "ask");

 

============= SERVICES / DRIVERS ===============

 

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2010-2-12 64288]

R1 SABI;SAMSUNG Kernel Driver For Windows 7;c:\windows\system32\drivers\SABI.sys [2010-1-5 10752]

R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]

R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-9-29 735960]

R2 epfwwfpr;epfwwfpr;c:\windows\system32\drivers\epfwwfpr.sys [2009-9-29 95896]

R2 OberonGameConsoleService;Oberon Media Game Console service;c:\program files\samsung casual games\gameconsole\OberonGameConsoleService.exe [2010-2-7 44312]

R2 Rezip;Rezip;c:\windows\system32\Rezip.exe [2010-1-5 311296]

R2 waclient;Portwise Access Client Driver;c:\windows\system32\drivers\waclient.sys [2010-3-6 34296]

R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-1-6 43944]

R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2010-2-7 29472]

R3 KMWDFilter1X;KM DRIVER;c:\windows\system32\drivers\RP24GV1.sys [2009-10-28 16896]

R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2010-1-6 66080]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336]

R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\drivers\yk62x86.sys [2010-2-15 322336]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate;Tjänsten Google Update (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-8 135664]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2010-11-19 39272]

S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-9-23 1493352]

S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [2010-7-17 101248]

S3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [2010-1-6 125696]

S3 KMWDFILTERx86;HIDServiceDesc;c:\windows\system32\drivers\KMWDFILTER.sys [2009-4-29 25088]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-9-24 1181328]

S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2009-6-10 139776]

S3 WatAdminSvc;Aktiveringsteknologier för Windows-tjänst;c:\windows\system32\wat\WatAdminSvc.exe [2010-5-21 1343400]

 

=============== Created Last 30 ================

 

2010-11-19 19:40:14 -------- d-----w- c:\windows\Sec

2010-11-19 19:39:00 98816 ----a-w- c:\windows\sed.exe

2010-11-19 19:39:00 89088 ----a-w- c:\windows\MBR.exe

2010-11-19 19:39:00 256512 ----a-w- c:\windows\PEV.exe

2010-11-19 19:39:00 161792 ----a-w- c:\windows\SWREG.exe

2010-11-19 19:38:55 -------- d-s---w- C:\ComboFix

2010-11-19 19:34:57 -------- d-----w- c:\windows\sv

2010-11-19 19:34:47 39272 ----a-w- c:\windows\system32\drivers\fssfltr.sys

2010-11-19 19:33:24 69464 ----a-w- c:\windows\system32\XAPOFX1_3.dll

2010-11-19 19:33:24 515416 ----a-w- c:\windows\system32\XAudio2_5.dll

2010-11-19 19:33:24 453456 ----a-w- c:\windows\system32\d3dx10_42.dll

2010-11-19 19:11:10 469256 ----a-w- c:\program files\common files\windows live\.cache\85e6e13e1cb881d2b\InstallManager_WLE_WLE.exe

2010-11-19 19:10:53 15712 ----a-w- c:\program files\common files\windows live\.cache\7cb973101cb881d1f\MeshBetaRemover.exe

2010-11-19 19:10:40 94040 ----a-w- c:\program files\common files\windows live\.cache\748ab81f1cb881d18\DSETUP.dll

2010-11-19 19:10:40 525656 ----a-w- c:\program files\common files\windows live\.cache\748ab81f1cb881d18\DXSETUP.exe

2010-11-19 19:10:40 1691480 ----a-w- c:\program files\common files\windows live\.cache\748ab81f1cb881d18\dsetup32.dll

2010-11-19 19:10:39 94040 ----a-w- c:\program files\common files\windows live\.cache\7413b3511cb881d17\DSETUP.dll

2010-11-19 19:10:39 525656 ----a-w- c:\program files\common files\windows live\.cache\7413b3511cb881d17\DXSETUP.exe

2010-11-19 19:10:39 1691480 ----a-w- c:\program files\common files\windows live\.cache\7413b3511cb881d17\dsetup32.dll

2010-11-19 19:10:04 -------- d-----w- c:\users\jimmy\appdata\local\Windows Live

2010-11-19 19:09:43 3181568 ----a-w- c:\windows\system32\mf.dll

2010-11-19 19:09:43 196608 ----a-w- c:\windows\system32\mfreadwrite.dll

2010-11-19 19:09:42 1619456 ----a-w- c:\windows\system32\WMVDECOD.DLL

2010-11-19 19:09:39 6273872 ----a-w- c:\progra~2\microsoft\windows defender\definition updates\{1217230d-9bb1-4971-99fb-429cc555bb2e}\mpengine.dll

2010-11-18 18:34:59 -------- d-sh--w- C:\$RECYCLE.BIN

2010-11-14 19:03:55 -------- d-----w- c:\users\jimmy\appdata\local\temp

2010-11-14 11:31:58 -------- d-----w- c:\users\jimmy\appdata\roaming\Malwarebytes

2010-11-14 11:31:48 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-11-14 11:31:47 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-11-14 11:31:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-11-14 11:31:47 -------- d-----w- c:\progra~2\Malwarebytes

2010-11-08 17:08:04 -------- d-----w- C:\Antivirus REMOVAL TOOLS 2010

2010-11-07 10:48:38 -------- d-----w- c:\users\jimmy\appdata\local\ESET

2010-11-06 10:37:34 103864 ----a-w- c:\program files\mozilla firefox\plugins\nppdf32.dll

2010-11-06 10:37:34 103864 ----a-w- c:\program files\internet explorer\plugins\nppdf32.dll

2010-10-29 10:17:23 641536 ----a-w- c:\windows\system32\CPFilters.dll

2010-10-29 10:17:23 417792 ----a-w- c:\windows\system32\msdri.dll

2010-10-29 10:17:23 204288 ----a-w- c:\windows\system32\MSNP.ax

2010-10-29 10:17:23 199680 ----a-w- c:\windows\system32\mpg2splt.ax

2010-10-29 10:17:17 26504 ----a-w- c:\windows\system32\drivers\Diskdump.sys

2010-10-24 11:24:51 48648 ----a-w- c:\progra~2\microsoft\ehome\packages\mceclientux\updateablemarkup-2\Markup.dll

2010-10-24 11:24:47 346944 ----a-w- c:\progra~2\microsoft\ehome\packages\mcespotlight\mcespotlight-2\SpotlightResources.dll

2010-10-23 12:14:04 -------- d-----w- c:\program files\AdvancedDVDPlayer

 

==================== Find3M ====================

 

2010-10-19 09:41:44 222080 ------w- c:\windows\system32\MpSigStub.exe

2010-09-22 23:47:28 49016 ----a-w- c:\windows\system32\sirenacm.dll

2010-09-22 23:32:56 301936 ----a-w- c:\windows\WLXPGSS.SCR

2010-09-21 13:03:14 208768 ----a-w- c:\windows\system32\LIVESSP.DLL

2010-09-15 02:50:37 472808 ----a-w- c:\windows\system32\deployJava1.dll

2010-09-08 04:30:04 978432 ----a-w- c:\windows\system32\wininet.dll

2010-09-08 04:28:15 44544 ----a-w- c:\windows\system32\licmgr10.dll

2010-09-08 03:22:31 386048 ----a-w- c:\windows\system32\html.iec

2010-09-08 02:48:16 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2010-09-01 04:23:49 12625408 ----a-w- c:\windows\system32\wmploc.DLL

2010-09-01 02:34:52 2327552 ----a-w- c:\windows\system32\win32k.sys

2010-08-31 04:32:30 954752 ----a-w- c:\windows\system32\mfc40.dll

2010-08-31 04:32:30 954288 ----a-w- c:\windows\system32\mfc40u.dll

2010-08-27 05:46:48 168448 ----a-w- c:\windows\system32\srvsvc.dll

2010-08-26 04:39:58 109056 ----a-w- c:\windows\system32\t2embed.dll

 

============= FINISH: 1:38:02,52 ===============

 

 

 

[Cecilia]

Det såg ju bra ut. Nu återstår bara en sista städomgång:

 

1. Ta bort samtliga systemåterställningspunkter eftersom dessa kan vara infekterade.

Börja med att skapa en ny systemåterställningspunkt:

XP:

Start - Program- Tillbehör - Systemverktyg - Systemåterställning

Välj att skapa en ny återställningspunkt och tryck på Nästa.

Vista och Windows 7:

Högerklick på Datorn - Egenskaper - Systemskydd

Tryck på Skapa.

 

Ta sedan bort alla gamla systemåterställningspunkter genom att köra diskrensningsprogrammet.

Högerklicka på C: i Den här datorn/Utforskaren och välj Egenskaper.

På fliken Allmänt finns det en knapp som heter Diskrensning. Välj den.

Efter några minuter kommer programmet upp och då väljer du en flik som heter Fler alternativ eller något likande. Tryck på den Rensa-knapp som tar bort alla systemåterställningspunkter utom den senaste.

 

2. Ladda ner avinstallationsprogrammet OTC till Skrivbordet.

http://oldtimer.geekstogo.com/OTC.exe

Dubbelklicka på filen för att starta programmet.

Tryck på knappen CleanUp! och ComboFix m.fl. rensningsprogram kommer att avinstalleras efter en omstart av datorn. Om något sådant program är kvar efter det så fråga hur du ska ta bort det. Ta bort eventuella loggar.

 

3. Spara TFC (Temporary File Cleaner) av OldTimer på Skrivbordet.

http://oldtimer.geekstogo.com/TFC.exe

 

Stäng alla program och fönster.

Kör TFC (om du har Vista eller Windows 7 så högerklicka på filen och välj Kör som administratör).

Klicka på Start-knappen för att starta städningen.

Det kan ta några minuter och låt datorn vara ifred under tiden.

 

När det är klart är det meningen att datorn ska startas om automatiskt. Om den inte gör det så startar du om datorn själv. Ta bort TFC-filen.

 

4. Byt alla lösenord som du använder i datorn och på internet eftersom dessa kan ha kommit i orätta händer.

http://mnin.blogspot.com/2009/02/why-i-enjoyed-tiggersyzor.html beskriver ett skadligt program som spionerar genom att ta skärmbilder, logga tangentbordsnedtryckningar och läsa lösenord som är lagrade i webbläsare, epostprogram etc.

 

5. Förbättra skyddet i datorn, se mina Råd för en säkrare dator: http://sites.google.com/site/ceblstockholm/home

Kontrollera på Esets webbplats att du har senaste versionen av Nod32 eftersom varje ny version innehåller förbättrad skydd mot de senaste typerna av skadliga program. Det ser ut som att din version är mer än ett år gammal och de flesta antivirusföretag brukar släppa en ny version en gång om året.

[JIMBOOZONE]

HEJ IGEN!

 

Jag vill börja med att tacka för den tid som du lagt ner på att hjälpa mig med detta!

Jag ger dig en stor eloge för det.

Jag var allt lite bekymrad i början, då jag letade efter info om vad jag kunde göra åt detta virus....

Jag insåg att det skulle ta mycket tid i anspråk, och att det var ett knepigt virus att ta bort, men det gick tillslut!

Tack vare dig Cecilia! TACK!

 

Nu hoppas jag att det inte skall hända på länge!

 

Nu har jag gjort det sista av "operationer" och skall se till att byta lite lösenord m.m. samt fixa till lite drivrutiner som fått sig en törn och behöver uppdateras! (dubbelfingerscroll på musplattan bla.)

 

Mvh J