virus i windows life messenger. Hjälp!

16 april, 2010

Problem med något slags virus kopplat till Windows life Messenger.

Det spökar! Efter det att jag chattat med en person, har jag fått in nåt skit i datorn. Det tycks kanske vara kopplat till CTT filer eller nåt sånt. Hur som helst - när jag försöker öppna Windows Life Messenger, ser allt normalt ut, men snabbt kommer ett meddelande om att Messenger har upptäckt ett problem och måste avslutas. Samtidigt kommer det upp en liten ruta längst ned (som vanligt alltså) om att en kontakt är "på tråden". Erik:)<mys_pojken20.hotmail.com står det snyggt och prydligt Hm!

Försöker man stänga rutan kommer ett meddelande om att programmet "Erik:)<mys_pojken20.hotmail.com" inte svarar.

Mitt antivirusprogram - det gratisnedladdade Avira Antivir Personal - rapporterade vid skanning: detection: ADSPY/RegistryVictor - alltså verkade det finnas ett virus. Jag klickade "reparera" - och körde en ny skanning. Då upptäcktes inget virus. Men problemet kvarstår. Visst ligger väl felet i "kontaktkalalogen" - i en sån där extension file av CCT-typ. Kontaktlistan kan jag nämligen inte öppna överhuvudtaget.

Usch, jag är en fattig pensionär, som inte har råd med en massa sofistikerade"städpatruller" - Är det någon som kan ha ett förbarmande med mig, och föreslå några åtgärder. Please help me! Mvh. Claes-Ove Karlsson

16 april, 2010

Kan du hitta någon logg i Antivir där det framgår i mer detalj vad som hittades, t ex filnamn eller registerpost?

Vi kan se vad DDS visar till att börja med. Spara DDS på Skrivbordet.

http://download.bleepingcomputer.com/sUBs/dds.scr

Starta programmet genom att dubbelklicka på det.

Tryck Yes/Ja om frågan om Optional Scan dyker upp.

I ditt svar klistrar du in loggen DSS.txt. Medan du bifogar Attach.txt som en fil.

------------------

Jag har tagit bort ditt andra inlägg eftersom det bara blir förvirrande att ha samma problem på två ställen.

Cecilia

Moderator

16 april, 2010

Kära Cecilia!

Jag vet inte om ditt svar rörde mitt problem, eftersom jag sav misstag har "lagt mig i debatten" för medlemmen Newbie, om jag föstår saken rätt. Meningen var, att jag skulle "starta ett nytt ämne" men fattar faktiskt inte själva formatmallen här.

Men eftersom jag inte vet, så tänket jag att det är likaså bra att "tken gör som dåren säger" *hihi -förlåt!*

DSS skanningen visar som följer: - Men VAR bifogar jag attachfilen??? I formatmallen hittar jag ju bara "infoga länk" -"infoga bild" - "infoga e-mailadress" - "infoga citat" - inte ett enda "gem" så långt ögat kan nå att klämma fast en bilaga i. Jag försöker med "infoga text" - måtte det inte bli alldeles galet.

DDS (Ver_10-03-17.01) - NTFSx86

Run by clovekarlsson at 15:04:18,17 on 2010-04-16

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17

Microsoft Windows XP Professional 5.1.2600.3.1252.46.1033.18.1791.880 [GMT 2:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\ehome\ehtray.exe

c:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE

C:\Program Files\Realtek\InstallShield\AzMixerSel.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Topcom Webtalker 100\CmSkype.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Kiwee Toolbar\3.2\kwtbaim.exe

C:\Program Files\Disk Cleaner\DiskCleanerService.exe

C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe

C:\WINDOWS\system32\PrintDisp.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\V0220Mon.exe

C:\WINDOWS\eHome\ehSched.exe

C:\PROGRA~1\MUSICM~1\MUSICM~2\mm_tray.exe

C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\APPS\SMP\SmpSys.exe

C:\APPS\SKYPE\Phone\Skype.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe

C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\infocard.exe

C:\Program Files\Disk Cleaner\DiskCleaner.Exe

C:\WINDOWS\system32\PrintCtrl.exe

C:\Program Files\Registry Helper\RegistryHelper.Exe

C:\Program Files\Registry Helper\RegistryHelperService.exe

C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

svchost.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe

C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE

C:\Program Files\Uniblue\RegistryBooster\registrybooster.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

C:\WINDOWS\system32\dllhost.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\APPS\SKYPE\Plugin Manager\skypePM.exe

c:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\3\3Connect\AutoUpdateSrv.exe

C:\Program Files\3\3Connect\wilog.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Documents and Settings\clovekarlsson\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.postarticles.net

uSearch Page = ${URL_SEARCHPAGE}

uWindow Title = Packard Bell

uSearch Bar = hxxp://format.packardbell.com/cgi-bin/redirect/?country=SE&range=AD&phase=6&key=SEARCH

mDefault_Page_URL = hxxp://uk.yahoo.com

mSearch Page = ${URL_SEARCHPAGE}

mStart Page = hxxp://uk.yahoo.com

uURLSearchHooks: agihelper.AGUtils: {0bc6e3fa-78ef-4886-842c-5a1258c4455a} - mscoree.dll

uURLSearchHooks: feedburner-SW Toolbar: {2e4c8982-9f6b-4bdb-be90-797d0ee5e322} - c:\program files\feedburner-sw\tbfeed.dll

BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll

BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: agihelper.AGUtils: {0bc6e3fa-78ef-4886-842c-5a1258c4455a} - mscoree.dll

BHO: feedburner-SW Toolbar: {2e4c8982-9f6b-4bdb-be90-797d0ee5e322} - c:\program files\feedburner-sw\tbfeed.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll

BHO: Windows Live inloggningshjälpen: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.4723.1820\swg.dll

BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\progra~1\yahoo!\companion\installs\cpn\YTSingleInstance.dll

TB: Kiwee Toolbar: {1c99b848-84cb-4ce4-8cd8-ed5719484d9f} - mscoree.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll

TB: feedburner-SW Toolbar: {2e4c8982-9f6b-4bdb-be90-797d0ee5e322} - c:\program files\feedburner-sw\tbfeed.dll

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll

TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File

TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File

uRun: [smpcSys] c:\apps\smp\SmpSys.exe

uRun: [skype] "c:\apps\skype\\phone\Skype.exe" /nosplash /minimized

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background

uRun: [PcSync] c:\program files\nokia\nokia pc suite 6\PcSync2.exe /NoDialog

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Creative Live! Cam Manager] "c:\program files\creative\creative live! cam\live! cam manager\CTLCMgr.exe"

uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messen~1\YahooMessenger.exe" -quiet

uRun: [LDM] c:\program files\logitech\desktop messenger\8876480\program\LogitechDesktopMessenger.exe

uRun: [Firewall Administrating] c:\windows\infocard.exe

uRun: [Disk Cleaner] "c:\program files\disk cleaner\DiskCleaner.Exe" /boot

uRun: [Registry Helper] "c:\program files\registry helper\RegistryHelper.Exe" /boot

uRunOnce: [uniblueRegistryBooster] "c:\program files\uniblue\registrybooster\launcher.exe" delay 20000

mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC

mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName

mRun: [ehTray] c:\windows\ehome\ehtray.exe

mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\CLIStart.exe"

mRun: [skyTel] SkyTel.EXE

mRun: [AzMixerSel] c:\program files\realtek\installshield\AzMixerSel.exe

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [DetectorApp] c:\program files\sonic\digitalmedia le v7\mydvd le\DetectorApp.exe

mRun: [iMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

mRun: [CmSkype] "c:\program files\topcom webtalker 100\CmSkype.exe"

mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot

mRun: [KiweeHook] "c:\program files\kiwee toolbar\3.2\kwtbaim.exe"

mRun: [NSLauncher] c:\program files\nokia\nokia software launcher\NSLauncher.exe /startup

mRun: [PrintDisp] c:\windows\system32\PrintDisp.exe

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [Alcmtr] ALCMTR.EXE

mRun: [AVFX Engine] c:\program files\creative\creative live! cam\videofx\StartFX.exe

mRun: [V0220Mon.exe] c:\windows\V0220Mon.exe

mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

mRun: [MMTray] c:\progra~1\musicm~1\musicm~2\mm_tray.exe

mRun: [mmtask] "c:\program files\musicmatch\musicmatch jukebox\mmtask.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [Firewall Administrating] c:\windows\infocard.exe

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~2.lnk - c:\program files\logitech\desktop messenger\8876480\program\LDMConf.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe

IE: E&xportera till Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL

DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: {E77F23EB-E7AB-4502-8F37-247DBAF1A147} - hxxp://gfx2.hotmail.com/mail/w4/pr01/photouploadcontrol/MSNPUpld.cab

DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su2/ocx/15111/CTPID.cab

TCP: {130FF749-3028-4708-A77A-EA40B34A9D77} = 80.251.201.177 80.251.201.178

Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: AtiExtEvent - Ati2evxx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\clovek~1\applic~1\mozilla\firefox\profiles\wx1yh6k8.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=VE3D01&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://search.imgag.com/?appid=kwtb&c=GNKWO50020&sbs=7&sc=2&f=homepage&vernum=3.2&uid=&did={1581d43a-e9e6-4ba3-a1e1-d6fdfa3d1b8a}&q=

FF - prefs.js: keyword.URL - hxxp://search.imgag.com/?appid=kwtb&component=UnifiedToolbarFF&c=GNKWO50020&sbs=1&sc=&f=web&vernum=3.2&uid=&did={1581d43a-e9e6-4ba3-a1e1-d6fdfa3d1b8a}&q=

FF - component: c:\documents and settings\clovekarlsson\application data\mozilla\firefox\profiles\wx1yh6k8.default\extensions\{bc04b34e-5dd8-465a-a5e0-86f7c11bc009}\components\FFExternalAlert.dll

FF - component: c:\documents and settings\clovekarlsson\application data\mozilla\firefox\profiles\wx1yh6k8.default\extensions\{bc04b34e-5dd8-465a-a5e0-86f7c11bc009}\components\RadioWMPCore.dll

FF - component: c:\documents and settings\clovekarlsson\application data\mozilla\firefox\profiles\wx1yh6k8.default\extensions\piclens@cooliris.com\components\coolirisstub.dll

FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll

FF - plugin: c:\documents and settings\clovekarlsson\application data\mozilla\firefox\profiles\wx1yh6k8.default\extensions\piclens@cooliris.com\plugins\npcoolirisplugin.dll

FF - plugin: c:\program files\google\update\1.2.183.23\npGoogleOneClick8.dll

FF - plugin: c:\program files\microsoft\office live\npOLW.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

FF - plugin: c:\program files\virtual earth 3d\npVE3D.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.visited_color", "#551A8B");

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.videoFeeds.handler", "ask");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-12-20 11608]

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-12-20 108289]

R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-12-20 185089]

R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-12-20 56816]

R2 Disk Cleaner Service;Disk Cleaner Service;c:\program files\disk cleaner\DiskCleanerService.exe [2010-4-13 79224]

R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]

R2 Printer Control;Printer Control;c:\windows\system32\PrintCtrl.exe [2010-2-23 73728]

R2 Registry Helper Service;Registry Helper Service;c:\program files\registry helper\RegistryHelperService.exe [2010-4-13 83328]

R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2009-12-20 30104]

R3 V0220Dev;Live! Cam Video IM;c:\windows\system32\drivers\V0220Dev.sys [2010-3-12 145472]

R3 V0220Vfx;V0220VFX;c:\windows\system32\drivers\V0220Vfx.sys [2010-3-12 6272]

S2 gupdate1ca86dff10c311c;Tjänsten Google Update (gupdate1ca86dff10c311c);c:\program files\google\update\GoogleUpdate.exe [2009-12-27 133104]

S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2009-12-20 30104]

=============== Created Last 30 ================

2010-04-16 07:21:25 0 d-----w- c:\docume~1\alluse~1\applic~1\Registry Helper

2010-04-16 07:13:54 0 d-----w- c:\program files\Registry Helper

2010-04-16 07:07:02 0 d-----w- c:\docume~1\alluse~1\applic~1\Disk Cleaner

2010-04-16 07:06:30 0 d-----w- c:\program files\Disk Cleaner

2010-04-16 06:30:34 0 d-----w- c:\program files\Uniblue

2010-04-16 06:17:29 0 d-----w- c:\program files\WinMaximizer

2010-04-16 06:17:05 0 d-----w- c:\docume~1\alluse~1\applic~1\WinMaximizer

2010-04-15 19:16:45 0 d-----w- c:\windows\system32\wbem\Repository

2010-04-15 19:15:53 0 d-----w- c:\docume~1\alluse~1\applic~1\Kiwee Toolbar

2010-04-15 19:15:52 0 d-----w- c:\program files\UnifiedToolbar

2010-04-15 19:15:50 0 d-----w- c:\docume~1\clovek~1\applic~1\AGI

2010-04-15 19:15:50 0 d-----w- c:\docume~1\alluse~1\applic~1\agi

2010-04-15 19:15:48 0 d-----w- c:\program files\Kiwee Toolbar

2010-04-15 19:15:48 0 d-----w- c:\program files\AGI

2010-04-15 08:27:36 3871 --sh--r- c:\documents and settings\clovekarlsson\winbrd.jpg

2010-04-15 08:26:36 1447 ------w- c:\documents and settings\clovekarlsson\mdusys.s

2010-04-15 08:26:36 0 ------w- c:\documents and settings\clovekarlsson\mdsys.s

2010-04-15 08:08:47 3871 --sh--r- c:\windows\winbrd.jpg

2010-04-15 08:07:47 1471 ----a-w- c:\windows\mdusys.s

2010-04-15 08:07:47 0 ----a-w- c:\windows\mdsys.s

2010-04-15 08:06:46 98958 --sh--r- c:\windows\infocard.exe

2010-04-13 19:46:50 69632 ----a-w- c:\windows\system32\CUUpdateComponent.ocx

2010-04-13 19:46:50 135168 ----a-w- c:\windows\system32\SafeAppRichList.ocx

2010-04-13 19:46:48 421888 ----a-w- c:\windows\system32\ComputerUpdaterLM.ocx

2010-04-13 19:44:36 389120 ----a-w- c:\windows\system32\DiskCleanerLM.ocx

2010-04-13 19:41:58 389120 ----a-w- c:\windows\system32\RegistryHelperLM.ocx

2010-04-10 14:39:25 0 d-----w- c:\program files\Virtual Earth 3D

2010-04-08 06:25:50 0 d-----w- c:\program files\Defraggler

2010-04-06 21:28:40 1225772 ----a-w- c:\documents and settings\clovekarlsson\Picture 072.jpg

2010-04-05 18:27:57 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys

2010-04-05 18:27:57 107368 ----a-w- c:\windows\system32\GEARAspi.dll

2010-04-05 18:27:01 0 d-----w- c:\program files\iPod

2010-04-05 18:26:53 0 d-----w- c:\program files\iTunes

2010-04-05 18:26:53 0 d-----w- c:\docume~1\alluse~1\applic~1\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

2010-04-05 18:26:00 0 d-----w- c:\program files\Bonjour

2010-04-01 10:05:54 0 d-----w- c:\program files\Ask.com

2010-03-31 22:02:32 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-03-25 13:18:13 262144 ----a-w- C:\ntuser.dat

2010-03-22 16:23:13 0 d-----w- c:\docume~1\clovek~1\applic~1\fltk.org

2010-03-22 16:23:13 0 d-----w- c:\docume~1\clovek~1\applic~1\flightgear.org

2010-03-22 16:22:24 0 d-----w- c:\program files\FlightGear

2010-03-21 08:11:48 503094 ----a-w- c:\documents and settings\clovekarlsson\01[1].bmp

2010-03-20 16:05:16 12 ----a-w- c:\documents and settings\clovekarlsson\intlname.ols

2010-03-17 19:53:42 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2010-03-17 19:53:42 69632 ----a-w- c:\windows\system32\QuickTime.qts

2010-03-17 13:44:50 0 d-----w- c:\program files\Registry Winner

==================== Find3M ====================

2010-03-16 15:38:47 118784 ------r- c:\windows\bwUnin-7.2.0.137-8876480SL.exe

2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\vbscript.dll

2010-03-10 06:15:52 420352 ----a-w- c:\windows\system32\dllcache\vbscript.dll

2010-02-25 09:54:36 11070976 ------w- c:\windows\system32\dllcache\ieframe.dll

2010-02-24 13:11:07 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-02-24 13:11:07 455680 ------w- c:\windows\system32\dllcache\mrxsmb.sys

2010-02-24 09:54:25 173056 ------w- c:\windows\system32\dllcache\ie4uinit.exe

2010-02-17 07:10:28 2189952 ------w- c:\windows\system32\dllcache\ntoskrnl.exe

2010-02-16 14:08:49 2146304 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-02-16 14:08:49 2146304 ------w- c:\windows\system32\dllcache\ntkrnlmp.exe

2010-02-16 13:25:04 2066816 ------w- c:\windows\system32\dllcache\ntkrnlpa.exe

2010-02-16 13:25:04 2024448 ----a-w- c:\windows\system32\ntkrnlpa.exe

2010-02-16 13:25:04 2024448 ------w- c:\windows\system32\dllcache\ntkrpamp.exe

2010-02-12 10:03:03 293376 ------w- c:\windows\system32\browserchoice.exe

2010-02-12 09:46:14 91424 ----a-w- c:\windows\system32\dnssd.dll

2010-02-12 09:46:14 107808 ----a-w- c:\windows\system32\dns-sd.exe

2010-02-12 04:33:11 100864 ----a-w- c:\windows\system32\6to4svc.dll

2010-02-12 04:33:11 100864 ------w- c:\windows\system32\dllcache\6to4svc.dll

2010-02-11 12:02:15 226880 ------w- c:\windows\system32\dllcache\tcpip6.sys

2010-01-20 17:32:18 496128 ----a-w- c:\windows\system32\dhRichClient3.dll

2010-01-20 17:32:16 23552 ----a-w- c:\windows\system32\DirectCOM.dll

2010-01-20 17:32:12 309248 ----a-w- c:\windows\system32\sqlite36_engine.dll

2010-01-18 11:07:58 411368 ----a-w- c:\windows\system32\deploytk.dll

============= FINISH: 15:04:48,89 ===============

attach.txt

16 april, 2010

Du behöver inte be om förlåt, jag förstår att det inte alltid är så lätt att hitta rätt.

Om du trycker på en av knapparna "Lägg till svar" eller "Använd full redigerare" så hittar du knappar för att bläddra fram bilder och bifoga dem. Se om du nu kan använda dem för att bifoga Attach.txt.

16 april, 2010

Tack, kära Cecilia, för din förståelse för en gammal gube.

Alltså vågar jag mig på ett nytt försök.

Så här såg Aviraskanningen ut, och det visus man upptäckte tror jag var i en av alla skannade directories - (vilket vet jag inte, vet bara att det plingade till ungefär mitt i skanningen och så stod det detected: ADSPY/RegistryVictor - (vad det nu kan betyda)

Avira AntiVir Personal

Report file date: den 16 april 2010 00:34

Scanning for 2001521 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal - FREE Antivirus

Serial number : 0000149996-ADJIE-0000001

Platform : Windows XP

Windows version : (Service Pack 3) [5.1.2600]

Boot mode : Normally booted

Username : SYSTEM

Computer name : SN122741820317

Version information:

BUILD.DAT : 9.0.0.422 21701 Bytes 2010-03-09 10:29:00

AVSCAN.EXE : 9.0.3.10 466689 Bytes 2009-12-27 20:14:51

AVSCAN.DLL : 9.0.3.0 40705 Bytes 2009-02-27 10:58:24

LUKE.DLL : 9.0.3.2 209665 Bytes 2009-02-20 11:35:49

LUKERES.DLL : 9.0.2.0 12033 Bytes 2009-02-27 10:58:52

VBASE000.VDF : 7.10.0.0 19875328 Bytes 2009-11-06 16:00:28

VBASE001.VDF : 7.10.1.0 1372672 Bytes 2009-11-19 16:00:28

VBASE002.VDF : 7.10.3.1 3143680 Bytes 2010-01-20 09:42:59

VBASE003.VDF : 7.10.3.75 996864 Bytes 2010-01-26 00:06:08

VBASE004.VDF : 7.10.4.203 1579008 Bytes 2010-03-05 00:36:39

VBASE005.VDF : 7.10.4.204 2048 Bytes 2010-03-05 00:36:39

VBASE006.VDF : 7.10.4.205 2048 Bytes 2010-03-05 00:36:39

VBASE007.VDF : 7.10.4.206 2048 Bytes 2010-03-05 00:36:39

VBASE008.VDF : 7.10.4.207 2048 Bytes 2010-03-05 00:36:39

VBASE009.VDF : 7.10.4.208 2048 Bytes 2010-03-05 00:36:39

VBASE010.VDF : 7.10.4.209 2048 Bytes 2010-03-05 00:36:40

VBASE011.VDF : 7.10.4.210 2048 Bytes 2010-03-05 00:36:40

VBASE012.VDF : 7.10.4.211 2048 Bytes 2010-03-05 00:36:40

VBASE013.VDF : 7.10.4.242 153088 Bytes 2010-03-08 14:40:58

VBASE014.VDF : 7.10.5.17 99328 Bytes 2010-03-10 14:40:59

VBASE015.VDF : 7.10.5.44 107008 Bytes 2010-03-11 10:35:20

VBASE016.VDF : 7.10.5.69 92672 Bytes 2010-03-12 10:35:18

VBASE017.VDF : 7.10.5.91 119808 Bytes 2010-03-15 10:35:20

VBASE018.VDF : 7.10.5.121 112640 Bytes 2010-03-18 10:35:28

VBASE019.VDF : 7.10.5.138 139776 Bytes 2010-03-18 10:35:31

VBASE020.VDF : 7.10.5.164 113152 Bytes 2010-03-22 10:35:28

VBASE021.VDF : 7.10.5.182 108032 Bytes 2010-03-23 11:07:34

VBASE022.VDF : 7.10.5.199 123904 Bytes 2010-03-24 05:22:08

VBASE023.VDF : 7.10.5.217 279552 Bytes 2010-03-25 11:07:11

VBASE024.VDF : 7.10.5.234 202240 Bytes 2010-03-26 11:07:23

VBASE025.VDF : 7.10.5.254 187904 Bytes 2010-03-30 10:07:25

VBASE026.VDF : 7.10.6.18 130560 Bytes 2010-04-01 10:07:27

VBASE027.VDF : 7.10.6.34 136192 Bytes 2010-04-06 10:07:32

VBASE028.VDF : 7.10.6.44 232448 Bytes 2010-04-07 10:07:31

VBASE029.VDF : 7.10.6.60 124416 Bytes 2010-04-12 10:07:33

VBASE030.VDF : 7.10.6.74 116224 Bytes 2010-04-14 10:07:36

VBASE031.VDF : 7.10.6.79 68096 Bytes 2010-04-15 10:07:36

Engineversion : 8.2.1.210

AEVDF.DLL : 8.1.1.3 106868 Bytes 2010-01-23 09:11:15

AESCRIPT.DLL : 8.1.3.24 1282425 Bytes 2010-04-02 10:07:33

AESCN.DLL : 8.1.5.0 127347 Bytes 2010-02-26 21:41:33

AESBX.DLL : 8.1.2.1 254323 Bytes 2010-03-18 10:36:44

AERDL.DLL : 8.1.4.3 541043 Bytes 2010-03-18 10:36:32

AEPACK.DLL : 8.2.1.1 426358 Bytes 2010-03-20 10:35:25

AEOFFICE.DLL : 8.1.0.41 201083 Bytes 2010-03-18 10:36:20

AEHEUR.DLL : 8.1.1.16 2503031 Bytes 2010-03-27 11:07:29

AEHELP.DLL : 8.1.11.3 242039 Bytes 2010-04-02 10:07:31

AEGEN.DLL : 8.1.3.6 373108 Bytes 2010-04-02 10:07:30

AEEMU.DLL : 8.1.1.0 393587 Bytes 2009-12-27 20:14:51

AECORE.DLL : 8.1.13.1 188790 Bytes 2010-04-02 10:07:29

AEBB.DLL : 8.1.0.3 53618 Bytes 2008-10-09 14:32:40

AVWINLL.DLL : 9.0.0.3 18177 Bytes 2008-12-12 08:47:59

AVPREF.DLL : 9.0.3.0 44289 Bytes 2009-12-27 20:14:51

AVREP.DLL : 8.0.0.7 159784 Bytes 2010-02-18 09:43:13

AVREG.DLL : 9.0.0.0 36609 Bytes 2008-12-05 10:32:09

AVARKT.DLL : 9.0.0.3 292609 Bytes 2009-03-24 15:05:41

AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 2009-01-30 10:37:08

SQLITE3.DLL : 3.6.1.0 326401 Bytes 2009-01-28 15:03:49

SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2009-02-02 08:21:33

NETNT.DLL : 9.0.0.0 11521 Bytes 2008-12-05 10:32:10

RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 2009-12-27 20:14:50

RCTEXT.DLL : 9.0.73.0 86785 Bytes 2009-12-27 20:14:50

Configuration settings for the scan:

Jobname.............................: Complete system scan

Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp

Logging.............................: low

Primary action......................: interactive

Secondary action....................: ignore

Scan master boot sector.............: on

Scan boot sector....................: on

Boot sectors........................: C:,

Process scan........................: on

Scan registry.......................: on

Search for rootkits.................: on

Integrity checking of system files..: off

Scan all files......................: All files

Scan archives.......................: on

Recursion depth.....................: 20

Smart extensions....................: on

Macro heuristic.....................: on

File heuristic......................: medium

Deviating risk categories...........: +APPL,+GAME,+JOKE,+PCK,+PFS,+SPR,

Start of the scan: den 16 april 2010 00:34

Starting search for hidden objects.

'55631' objects were checked, '0' hidden objects were found.

The scan of running processes will be started

Scan process 'Ymsgr_tray.exe' - '1' Module(s) have been scanned

Scan process 'wuauclt.exe' - '1' Module(s) have been scanned

Scan process 'update.exe' - '1' Module(s) have been scanned

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'skypePM.exe' - '1' Module(s) have been scanned

Scan process 'CLI.exe' - '1' Module(s) have been scanned

Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned

Scan process 'iPodService.exe' - '1' Module(s) have been scanned

Scan process 'KHALMNPR.EXE' - '1' Module(s) have been scanned

Scan process 'ehmsas.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'ServiceLayer.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'infocard.exe' - '1' Module(s) have been scanned

Scan process 'MPAPI3s.exe' - '1' Module(s) have been scanned

Scan process 'SetPoint.exe' - '1' Module(s) have been scanned

Scan process 'LogitechDesktopMessenger.exe' - '1' Module(s) have been scanned

Scan process 'CTLCMgr.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'PcSync2.exe' - '1' Module(s) have been scanned

Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned

Scan process 'Skype.exe' - '1' Module(s) have been scanned

Scan process 'SMPSYS.EXE' - '1' Module(s) have been scanned

Scan process 'dllhost.exe' - '1' Module(s) have been scanned

Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned

Scan process 'QTTask.exe' - '1' Module(s) have been scanned

Scan process 'mmtask.exe' - '1' Module(s) have been scanned

Scan process 'mm_tray.exe' - '1' Module(s) have been scanned

Scan process 'V0220Mon.exe' - '1' Module(s) have been scanned

Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned

Scan process 'StartFX.exe' - '1' Module(s) have been scanned

Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned

Scan process 'PrintDisp.exe' - '1' Module(s) have been scanned

Scan process 'NSLauncher.exe' - '1' Module(s) have been scanned

Scan process 'kwtbaim.exe' - '1' Module(s) have been scanned

Scan process 'realsched.exe' - '1' Module(s) have been scanned

Scan process 'CmSkype.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'DetectorApp.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'CLI.exe' - '1' Module(s) have been scanned

Scan process 'AzMixerSel.exe' - '1' Module(s) have been scanned

Scan process 'ehtray.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'wuauclt.exe' - '1' Module(s) have been scanned

Scan process 'mcrdsvc.exe' - '1' Module(s) have been scanned

Scan process 'YahooAUService.exe' - '1' Module(s) have been scanned

Scan process 'USBDeviceService.exe' - '1' Module(s) have been scanned

Scan process 'ULCDRSvr.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'SeaPort.exe' - '1' Module(s) have been scanned

Scan process 'PrintCtrl.exe' - '1' Module(s) have been scanned

Scan process 'MDM.EXE' - '1' Module(s) have been scanned

Scan process 'jqs.exe' - '1' Module(s) have been scanned

Scan process 'inetinfo.exe' - '1' Module(s) have been scanned

Scan process 'ehSched.exe' - '1' Module(s) have been scanned

Scan process 'ehrecvr.exe' - '1' Module(s) have been scanned

Scan process 'mscorsvw.exe' - '1' Module(s) have been scanned

Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned

Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

78 processes with 78 modules were scanned

Starting master boot sector scan:

Master boot sector HD0

[iNFO] No virus was found!

Master boot sector HD1

[iNFO] No virus was found!

Master boot sector HD2

[iNFO] No virus was found!

Master boot sector HD3

[iNFO] No virus was found!

Master boot sector HD4

[iNFO] No virus was found!

Master boot sector HD5

[iNFO] No virus was found!

Start scanning boot sectors:

Boot sector 'C:\'

[iNFO] No virus was found!

Starting to scan executable files (registry).

The registry was scanned ( '79' files ).

Starting the file scan:

Begin scan in 'C:\' <HDD>

C:\hiberfil.sys

[WARNING] The file could not be opened!

[NOTE] This file is a Windows system file.

[NOTE] This file cannot be opened for scanning.

C:\pagefile.sys

[WARNING] The file could not be opened!

[NOTE] This file is a Windows system file.

[NOTE] This file cannot be opened for scanning.

C:\Documents and Settings\clovekarlsson\My Documents\Hämtade filer\RegistryWinner_Setup.exe

[DETECTION] Contains recognition pattern of the ADSPY/RegistryVictor adware or spyware

Beginning disinfection:

C:\Documents and Settings\clovekarlsson\My Documents\Hämtade filer\RegistryWinner_Setup.exe

[DETECTION] Contains recognition pattern of the ADSPY/RegistryVictor adware or spyware

[NOTE] The file was moved to '4c2e9e6d.qua'!

End of the scan: den 16 april 2010 01:15

Used time: 40:00 Minute(s)

The scan has been done completely.

11335 Scanned directories

442621 Files were scanned

1 Viruses and/or unwanted programs were found

0 Files were classified as suspicious

0 files were deleted

0 Viruses and unwanted programs were repaired

1 Files were moved to quarantine

0 Files were renamed

2 Files cannot be scanned

442618 Files not concerned

11471 Archives were scanned

2 Warnings

3 Notes

55631 Objects were scanned with rootkit scan

0 Hidden objects were found

Det var väl det hela, och så hoppas jag att jag bifogat attachfilen på ett korrekt sätt den här gången.

Med vänlig hälsning

Claes-Ove Karlsson

16 april, 2010

Jättebra!

Här ser du filen som Antivir reagerade på:

C:\Documents and Settings\clovekarlsson\My Documents\Hämtade filer\RegistryWinner_Setup.exe

Det är nog en fil som du har laddat ner eftersom den ligger i en mapp som heter Hämtade filer. Verkar vara installationsfilen för ett falskt registerstädningsprogram som heter Registry Winner.

Över huvud taget så ska man vara väldigt försiktig med registerstädningsprogram. Förutom att det finns falska sådana så är det inget ovanligt att de förstör något i datorn.

Avinstallera följande i Kontrollpanelen - Lägg till och ta bort program:

Ask Toolbar

AVS Registry Cleaner version 1.2

AVS Update Manager 1.0

feedburner-SW Toolbar

J2SE Runtime Environment 5.0 Update 4

Kiwee Chatbar

Kiwee Toolbar for Firefox

Kiwee Toolbar for Internet Explorer

Uniblue RegistryBooster

WinMaximizer

Ladda ner Malwarebytes Anti-Malware (MBAM) från:

http://www.malwarebytes.org/mbam.php

Dubbelklicka på mbam-setup för att installera programmet.

Se till i slutet av installationen att det är bockar för:

Uppdatera Malwarebytes' Anti-Malware

Starta Malwarebytes' Anti-Malware

Tryck på Slutför

Om det finns någon uppdatering så kommer den att laddas ner och installeras.

När programmet startar så välj "Utför snabb skanning" och tryck på Skanna.

Skanningen tar ett tag.

När den är klar så tryck på OK och sedan "Visa resultat".

Bocka för allt och tryck sedan Ta bort markerade.

När borttagningen är klar så öppnar Anteckningar med en logg.

Eventuellt så kommer det upp en begäran om att starta om datorn (Restart). I så fall gör det.

Om det blir ett felmeddelande Error loading... efter omstarten så starta om datorn än en gång.

Om programmet inte kommer igång efter omstarten så starta det.

Om loggen inte kommer upp själv i Anteckningar så hittar du loggen på fliken Loggar i MBAM.

Kopiera loggen och klistra in den i ditt svar tillsammans med en ny DDS-logg.

17 april, 2010

Oh! Tusen tack Kära Cecilia! Men vem är du? - Hur fasen går det till? Jag hinner ju inte mer än göra de åtgärder, som du "kräver" av mig, så kommer ju svaret som ett "brev på E-posten"! Jag är full av beundran!

Jag skäms ju lite för att jag är så godtrogen - har ännu inte fattat att moderna tidens häst- & bilskojare, numer finns i databranchen. Jag hade i min enfald nästan alla de program, som Du beordrade mig att avinstallera - GENAST!

Sagt och gjort! Sedan körde jag en fullständig skanning med MWB, som hittade 41 infekterade och skadade filer, enligt rapporten nedan.

Allt verkar nu frid och fröjd. "Erik>myspojken" dyker inte längre upp och mitt Life Messenger verkar fungera som det skall.

Du bad mig sända en ny DDS-logg. Jag kanske kan avvakta med det, om nu allt fungerar - eller är det något du vill följa upp för att få bästa möjliga feed-back i det här ärendet?

Hur som helst - Jag är full av beundran över din snabba och eminenta hjälp - och oändligt tacksam är jag förvisso! Och till och med en idiot som jag,begrep ju dessutom dina instruktioner! Häpp

Med de allra Varmaste Hälsningar

Claes-Ove Karlsson.

PS! Det var ju ett härligt vårgöra att få hjälp med att rensa bort allt ogräs i programrabatten! Speciellt när jag inte ens visste vad som var ogräs! TACK!

17 april, 2010

Roligt att du uppskattar min hjälp!

Ibland har man tur och jag råkar vara vid datorn när någon skriver men bland tar det ett tag.

Tyvärr så är det så att man måste vara väldigt försiktig på internet, både med vilka webbsidor man besöker och med vad man laddar ner. Där finns mycket skumma saker.

Det vore bra om du klistrade in en ny DDS-logg, då kan jag se om där finns t ex någon mapp kvar som inte togs bort när programmet avinstallerades och berätta vad du ska göra för att få bort den.

17 april, 2010

Men det här är ju rent otroligt! Jag är mållös, inför din oerhörda hjälpsamhet

Vore jag yngre skulle jag nog våga mig på ett litet frieri *hihi*

Jag skickade inte loggen senast, för att jag inte visste om jag kunde besvära dig med ännu mer "göra", men du gav mig nytt mod, så här kommer den.

Med varma hälsningar

Claes-Ove Karlsson

17 april, 2010

Den loggen ser bra ut nu. Kan du klistra in den logg som heter DDS.txt också?

Nu kommer det att dröja innan jag svarar så därför får du en sak till att göra. Surfa till Secunias Software Inspector och låt den webbsidan kontrollera vilka program du har installerade som är gamla versioner med säkerhetshål. Du får själv välja om du vill ha ett program installerat (Personal-valet) som kan kolla upp fler program eller om du vill låta själva webbplatsen kolla upp datorn (Online-valet). Se om du kan uppdatera de program som den hittar. Om det är något problem så fråga.

17 april, 2010

Tack, Cecilia! Vilken klippa du är!

Jag ska genast följa ditt råd, och här senaste DDS-loggen.

Än en gång - TACK!

från den där besvärlige Claes-Ove

DDS (Ver_10-03-17.01) - NTFSx86

Run by clovekarlsson at 10:21:52,79 on 2010-04-17

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17

Microsoft Windows XP Professional 5.1.2600.3.1252.46.1033.18.1791.910 [GMT 2:00]

AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir Desktop\sched.exe

svchost.exe

C:\Program Files\Avira\AntiVir Desktop\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Disk Cleaner\DiskCleanerService.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\PrintCtrl.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

svchost.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe

C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Realtek\InstallShield\AzMixerSel.exe

C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Topcom Webtalker 100\CmSkype.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe

C:\WINDOWS\system32\PrintDisp.exe

c:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe

C:\WINDOWS\V0220Mon.exe

C:\PROGRA~1\MUSICM~1\MUSICM~2\mm_tray.exe

C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\APPS\SMP\SmpSys.exe

C:\APPS\SKYPE\Phone\Skype.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe

C:\PROGRA~1\Yahoo!\MESSEN~1\YahooMessenger.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Program Files\Disk Cleaner\DiskCleaner.Exe

C:\PROGRA~1\COMMON~1\Nokia\MPAPI\MPAPI3s.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE

C:\APPS\SKYPE\Plugin Manager\skypePM.exe

c:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\3\3Connect\AutoUpdateSrv.exe

C:\Program Files\3\3Connect\wilog.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\mshearts.exe

C:\Documents and Settings\clovekarlsson\My Documents\Downloads\dds(3).scr

============== Pseudo HJT Report ===============

uSearch Page = ${URL_SEARCHPAGE}

uWindow Title = Packard Bell

uSearch Bar = hxxp://format.packardbell.com/cgi-bin/redirect/?country=SE&range=AD&phase=6&key=SEARCH

uStart Page = hxxp://www.Google.com/

mDefault_Page_URL = hxxp://uk.yahoo.com

mSearch Page = ${URL_SEARCHPAGE}

mStart Page = hxxp://uk.yahoo.com

BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll

BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll

BHO: Windows Live inloggningshjälpen: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.4723.1820\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll

TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll

TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File

TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

uRun: [smpcSys] c:\apps\smp\SmpSys.exe

uRun: [skype] "c:\apps\skype\\phone\Skype.exe" /nosplash /minimized

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background

uRun: [PcSync] c:\program files\nokia\nokia pc suite 6\PcSync2.exe /NoDialog

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [Creative Live! Cam Manager] "c:\program files\creative\creative live! cam\live! cam manager\CTLCMgr.exe"

uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messen~1\YahooMessenger.exe" -quiet

uRun: [LDM] c:\program files\logitech\desktop messenger\8876480\program\LogitechDesktopMessenger.exe

uRun: [Disk Cleaner] "c:\program files\disk cleaner\DiskCleaner.Exe" /boot

mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC

mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName

mRun: [ehTray] c:\windows\ehome\ehtray.exe

mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\CLIStart.exe"

mRun: [skyTel] SkyTel.EXE

mRun: [AzMixerSel] c:\program files\realtek\installshield\AzMixerSel.exe

mRun: [DetectorApp] c:\program files\sonic\digitalmedia le v7\mydvd le\DetectorApp.exe

mRun: [iMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE /Spoil /RemAdvDef /Migration32"

mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min

mRun: [CmSkype] "c:\program files\topcom webtalker 100\CmSkype.exe"

mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot

mRun: [NSLauncher] c:\program files\nokia\nokia software launcher\NSLauncher.exe /startup

mRun: [PrintDisp] c:\windows\system32\PrintDisp.exe

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [Alcmtr] ALCMTR.EXE

mRun: [AVFX Engine] c:\program files\creative\creative live! cam\videofx\StartFX.exe

mRun: [V0220Mon.exe] c:\windows\V0220Mon.exe

mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

mRun: [MMTray] c:\progra~1\musicm~1\musicm~2\mm_tray.exe

mRun: [mmtask] "c:\program files\musicmatch\musicmatch jukebox\mmtask.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [sunJavaUpdateSched] c:\program files\java\jre6\bin\jusched.exe

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~2.lnk - c:\program files\logitech\desktop messenger\8876480\program\LDMConf.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe

IE: E&xportera till Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll