Outerinfo annonsprogram

[mats clinth]

 

Hej

Ett program som kallar sig outerinfo har installerat sig på min dator. Det är ett annonsprogram som jag inte lyckas avinstallera den vanliga vägen det kommer tillbaka hela tiden. Det känns inte bra och jag vet inte vad det ställer till med, är det nån som har tips om hur man får bort detta

Med Vänliga Hälsningar Mats

 

[Zipp.]

 

Ladda ner HijackThis.exe och scanna datorn med det.

Skicka hit loggen sen så tar vi en titt hur den ser ut.

 

http://www.thespykiller.co.uk/files/HJTsetup.exe

 

[mats clinth]

 

Hej Här kommer loggen sent om sider.

Varje gång jag går ut på internet kommer det upp meddelanden från virus programmet om något som heter purity scan adware och det här outerinfo ominstallerar sig själv hela tiden. Virusprogrammet säger sig också ha decifinerat outerinfo men det finns hela tiden kvar

Med Vänliga Hälsningar Mats

 

 

 

Logfile of HijackThis v1.99.1

Scan saved at 14:14:09, on 2007-01-19

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.5730.0011)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\SYSTEM32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

D:\Program\Panda\PavProt.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program\Microsoft IntelliType Pro\type32.exe

C:\Program\Microsoft IntelliPoint\point32.exe

C:\WINDOWS\system32\rundll32.exe

D:\Adobe foto\3.0\Apps\apdproxy.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program\Java\jre1.5.0_10\bin\jusched.exe

C:\Program\Multimedia Card Reader\shwicon2k.exe

D:\Program\SlySoft\CloneCD\CloneCDTray.exe

C:\WINDOWS\system32\svchost.exe

C:\Program\Delade filer\LightScribe\LSSrvc.exe

D:\Program\Panda\APVXDWIN.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program\Messenger\MSMSGS.EXE

D:\Program\Panda\PaSSrv.exe

C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe

C:\Program\Personal\bin\Personal.exe

D:\Program\Panda\Firewall\PavFires.exe

C:\DOCUME~1\Mats\MINADO~1\RACLE~1\wucrtupd.exe

D:\Program\Panda\SRVLOAD.EXE

D:\Program\Panda\PavFnSvr.exe

D:\Program\Panda\Pavkre.exe

D:\Program\Panda\WebProxy.exe

C:\Program\Delade filer\Panda Software\PavShld\pavprsrv.exe

D:\Program\Panda\pavsrv51.exe

D:\Program\Panda\prevsrv.exe

D:\Program\Panda\AVENGINE.EXE

D:\Program\Panda\PsImSvc.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\alg.exe

C:\Program\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\wuauclt.exe

D:\Program\Panda\avciman.exe

D:\Program\hijack this\Hijackthis\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.start.se/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157'>http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896'>http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar

R3 - URLSearchHook: (no name) - {576BDE8C-411F-16E8-6F24-6DE4C7BBB3C5} - (no file)

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {576BDE8C-411F-16E8-6F24-6DE4C7BBB3C5} - (no file)

O2 - BHO: (no name) - {6A373B7E-496E-424f-A9BE-486A5E9AB018} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_10\bin\ssv.dll

O2 - BHO: (no name) - {AB36B1F6-2D6C-7396-15D3-02F2C65B47C8} - C:\WINDOWS\system32\qqxh.dll

O2 - BHO: CDLPObj Object - {BE2ED590-CA49-46B5-8CCE-244FB2E0D1AA} - C:\WINDOWS\DLP.dll

O2 - BHO: (no name) - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - (no file)

O3 - Toolbar: BitComet Toolbar - {2E608F70-C430-4bc5-96F6-608E02EBA5B2} - (no file)

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - d:\Program\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: (no name) - {C1B4DEC2-2623-438e-9CA2-C9043AB28508} - (no file)

O4 - HKLM\..\Run: [type32] "C:\Program\Microsoft IntelliType Pro\type32.exe"

O4 - HKLM\..\Run: [intelliPoint] "C:\Program\Microsoft IntelliPoint\point32.exe"

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Adobe foto\3.0\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program\Java\jre1.5.0_10\bin\jusched.exe"

O4 - HKLM\..\Run: [sunkist2k] C:\Program\Multimedia Card Reader\shwicon2k.exe

O4 - HKLM\..\Run: [CloneCDTray] "d:\Program\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program\Delade filer\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [sCANINICIO] "D:\Program\Panda\Inicio.exe"

O4 - HKLM\..\Run: [APVXDWIN] "D:\Program\Panda\APVXDWIN.EXE" /s

O4 - HKLM\..\RunServices: [PANDA ANTISPAM SERVER SERVICE] "D:\Program\Panda\PasSrv.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\MSMSGS.EXE" /background

O4 - HKCU\..\Run: [Nttc] "C:\WINDOWS\RACLE~1\rundll.exe" -vt yazb

O4 - HKCU\..\Run: [Naao] "C:\DOCUME~1\Mats\MINADO~1\RACLE~1\wucrtupd.exe" -vt yazb

O4 - Startup: Adobe Gamma.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Personal.lnk = C:\Program\Personal\bin\Personal.exe

O8 - Extra context menu item: E&xportera till Microsoft Excel - res://D:\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://d:\Program\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://d:\Program\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Preview - res://d:\Program\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Print - res://d:\Program\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra button: Referensinformation - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1140804767656

O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1143054212515

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program\Delade filer\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: COM+ Messages - Unknown owner - C:\WINDOWS\system32\svchosts.exe" -e mc-110-12-0001670 (file missing)

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program\Delade filer\LightScribe\LSSrvc.exe

O23 - Service: NBService - Nero AG - D:\Program\Ahead Nero.v7.2.7.0.Multilanguage\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: Panda Antispam Server Service (PASSRV) - Unknown owner - D:\Program\Panda\PaSSrv.exe

O23 - Service: Panda Firewall Service (PAVFIRES) - Panda Software - D:\Program\Panda\Firewall\PavFires.exe

O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software - D:\Program\Panda\PavFnSvr.exe

O23 - Service: Panda Pavkre (Pavkre) - Panda Software - D:\Program\Panda\Pavkre.exe

O23 - Service: Panda PavProt (PavProt) - Panda Software - D:\Program\Panda\PavProt.exe

O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program\Delade filer\Panda Software\PavShld\pavprsrv.exe

O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software - D:\Program\Panda\pavsrv51.exe

O23 - Service: Panda Preventium+ Service (PREVSRV) - Panda Software - D:\Program\Panda\prevsrv.exe

O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software Internacional - D:\Program\Panda\PsImSvc.exe

 

 

[Zipp.]

 

Ladda ner combofix.exe på skrivbordet

 

http://download.bleepingcomputer.com/sUBs/combofix.exe

 

kör den och följ anvisningar.

När den är färdig så ska en logg komma ut skicka hit den.

VIKTIGT = klicka inte på Combofix fönster med musen när den körs annars kan den hänga upp sig.