Väldigt seg dator

[nokia9800]

Datorn är väldigt seg och firefox.exe visar 100%

 

Har scannat med Malebytes Anti-Maleware och SuperAntiSpyware

 

Panda Cloud Antivirus och Housecall hittar inget virus

[Cecilia]

Hur fungerar datorn om du inte startar Firefox?

 

Vad har du för tillägg och insticksmoduler installerade i Firefox (Verktyg - Tillägg)?

[nokia9800]

Den verkar fungera bra och med Windows explorer fungerar den med

 

Adblockplus, Bit Defender Quickscan,Javaconsole,Java Quick Starter,Microsoft.net FrameWork Assistent.

[MatsLo]

Ett tips är att avinstallera Firefox helt och göra en ny installation, nått verkar ju ha gått snett med Firefox eftersom det funkar bra med Explorer

[Cecilia]

Enklare till att börja med kan ju vara att se hur Firefox fungerar om man kör det utan några tillägg. Hittas i Start - Alla program - Mozilla Firefox - Mozilla Firefox (felsäkert läge)

[nokia9800]

Då visar firefox.exe 10-30% och plugin-container.exe 40-70% och datorn är seg

[Cecilia]

plugin-container.exe är det Firefox-program som hanterar t ex Flash och andra insticksmoduler. Flash hade du visst inte men du kan ju se hur det blir om du inaktiverar Java.

 

Vad har du för startsida i Firefox?

[nokia9800]

Det blir ingen skilnad om jag avaktiverar java

 

Jag har tradera som startsida

[Cecilia]

Vi kan se vad DDS visar till att börja med. Spara DDS på Skrivbordet.

http://download.bleepingcomputer.com/sUBs/dds.scr

 

Starta programmet genom att dubbelklicka på det.

Tryck Yes/Ja om frågan om Optional Scan dyker upp.

I ditt svar klistrar du in loggen DSS.txt. Medan du bifogar Attach.txt som en fil.

[nokia9800]

DDS (Ver_10-12-12.02) - NTFSx86

Run by Andreas Janson at 12:08:26,20 on 2010-12-22

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_22

Microsoft Windows XP Home Edition 5.1.2600.3.1252.46.1053.18.1271.581 [GMT 1:00]

 

AV: Panda Cloud Antivirus *Enabled/Updated* {5AD27692-540A-464E-B625-78275FA38393}

FW: Online Armor Firewall *Enabled*

 

============== Running Processes ===============

 

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program\Tall Emu\Online Armor\OAcat.exe

C:\Program\Tall Emu\Online Armor\oasrv.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program\Java\jre6\bin\jqs.exe

C:\Program\Panda Security\Panda Cloud Antivirus\PSANHost.exe

C:\Program\NDAS\System\ndassvc.exe

C:\Program\Simese\Simese.exe

C:\Program\SQUEEZ~2\server\Bin\MSWIN3~1\mysqld.exe

C:\Program\Simese\MySQL\mysqld.exe

C:\WINDOWS\system32\igfxtray.exe

C:\Program\Tall Emu\Online Armor\oaui.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program\Panda Security\Panda Cloud Antivirus\PSUNMain.exe

C:\Program\Delade filer\Java\Java Update\jusched.exe

C:\Program\Tall Emu\Online Armor\OAhlp.exe

C:\Program\Winamp\winampa.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program\Windows Live\Messenger\msnmsgr.exe

C:\Program\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program\Secunia\PSI\psi.exe

C:\Program\Internet Explorer\iexplore.exe

C:\Program\Internet Explorer\iexplore.exe

C:\Documents and Settings\Andreas Janson\Skrivbord\dds.scr

 

============== Pseudo HJT Report ===============

 

uStart Page = hxxp://eforum.idg.se/forum/25-virus-skadliga-program-botemedel/

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program\delade filer\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Winamp Toolbar Loader: {25cee8ec-5730-41bc-8b58-22ddc8ab8c20} - c:\program\winamp toolbar\winamptb.dll

BHO: Windows Live inloggningshjälpen: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program\delade filer\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program\java\jre6\bin\jp2ssv.dll

BHO: FlashFXP Helper for Internet Explorer: {e5a1691b-d188-4419-ad02-90002030b8ee} - c:\program\flashfxp\IEFlash.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Winamp Toolbar: {ebf2ba02-9094-4c5a-858b-bb198f3d8de2} - c:\program\winamp toolbar\winamptb.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe

uRun: [msnmsgr] "c:\program\windows live\messenger\msnmsgr.exe" /background

uRun: [sUPERAntiSpyware] c:\program\superantispyware\SUPERAntiSpyware.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [@OnlineArmor GUI] "c:\program\tall emu\online armor\oaui.exe"

mRun: [soundMan] SOUNDMAN.EXE

mRun: [PSUNMain] "c:\program\panda security\panda cloud antivirus\PSUNMain.exe" /Traybar

mRun: [sunJavaUpdateSched] "c:\program\delade filer\java\java update\jusched.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program\delade filer\adobe\arm\1.0\AdobeARM.exe"

mRun: [WinampAgent] c:\program\winamp\winampa.exe

mRun: [QuickTime Task] "c:\program\quicktime\QTTask.exe" -atboottime

dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE

StartupFolder: c:\docume~1\andrea~1\start-~1\program\autost~1\secuni~1.lnk - c:\program\secunia\psi\psi.exe

StartupFolder: c:\docume~1\alluse~1\start-~1\program\autost~1\ndas-a~1.lnk - c:\program\ndas\system\ndasmgmt.exe

IE: &Winamp Search - c:\documents and settings\all users\application data\winamp toolbar\ietoolbar\resources\en-us\local\search.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program\messenger\msmsgs.exe

DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1273668429105

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Notify: !SASWinLogon - c:\program\superantispyware\SASWINLO.dll

Notify: igfxcui - igfxsrvc.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: OA Shell Helper: {4f07da45-8170-4859-9b5f-037ef2970034} - c:\program\tallem~1\online~1\oaevent.dll

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program\superantispyware\SASSEH.DLL

Hosts: 192.168.1.105 popcorn localhost.drives

 

================= FIREFOX ===================

 

FF - ProfilePath - c:\docume~1\andrea~1\applic~1\mozilla\firefox\profiles\diu8etui.default\

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: browser.startup.homepage - hxxp://www.tradera.com/Fujitsu-MHT2040AH-40-GB-IDE-2-5-auktion_301835_124414967|http://www.tradera.com/Toshiba-MK8032GAX-80-GB-IDE-2-5-auktion_301835_124415689|http://www.tradera.com/Triax-Ufo-home-digital-auktion_170702_122236026|http://www.tradera.com/FM-sandare-med-RDS-funktion-USB-Fjarr-auktion_302306_124152850|http://www.tradera.com/Logitech-Squeezebox-Wi-Fi-Internet-Radio-Receiver-auktion_170607_124455653|http://www.tradera.com/Logitech-Squeezebox-Duet--auktion_170607_124457024|http://www.tradera.com/Logitech-Squeezebox-Wi-Fi-Internet-Radio-and-Wireless-Music--auktion_170109_124459000|http://www.tradera.com/POPCORN-HOUR-A-100-auktion_302385_124637123|http://www.tradera.com/Mediaspelare-Popcorn-Hour-A-100-auktion_1708_124698741

FF - component: c:\documents and settings\andreas janson\application data\mozilla\firefox\profiles\diu8etui.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll

FF - plugin: c:\documents and settings\andreas janson\application data\mozilla\firefox\profiles\diu8etui.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll

FF - plugin: c:\program\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program\mozilla firefox\plugins\npwachk.dll

FF - plugin: c:\program\personal\bin\np_prsnl.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

FF - Ext: BitDefender QuickScan: {e001c731-5e37-4538-a5cb-8168736a2360} - %profile%\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

 

============= SERVICES / DRIVERS ===============

 

R0 lfsfilt;Lean File Sharing;c:\windows\system32\drivers\lfsfilt.sys [2010-9-4 254440]

R0 lpx;LPX Protocol;c:\windows\system32\drivers\lpx.sys [2007-6-29 62056]

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2010-12-16 28552]

R1 ndasfat;NDAS FAT;c:\windows\system32\drivers\ndasfat.sys [2010-9-4 372584]

R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [2010-5-17 228216]

R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [2010-5-17 24440]

R1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [2010-5-17 29560]

R1 PSINKNC;PSINKNC;c:\windows\system32\drivers\PSINKNC.sys [2010-6-17 129992]

R1 SASDIFSV;SASDIFSV;c:\program\superantispyware\sasdifsv.sys [2010-2-17 12872]

R1 SASKUTIL;SASKUTIL;c:\program\superantispyware\SASKUTIL.SYS [2010-5-6 67656]

R2 NanoServiceMain;Panda Cloud Antivirus Service;c:\program\panda security\panda cloud antivirus\PSANHost.exe [2010-8-9 140608]

R2 OAcat;Online Armor Helper Service;c:\program\tall emu\online armor\oacat.exe [2010-5-17 1284600]

R2 PSINAflt;PSINAflt;c:\windows\system32\drivers\PSINAflt.sys [2010-5-27 141384]

R2 PSINFile;PSINFile;c:\windows\system32\drivers\PSINFile.sys [2010-7-21 97096]

R2 PSINProc;PSINProc;c:\windows\system32\drivers\PSINProc.sys [2010-4-30 111624]

R2 PSINProt;PSINProt;c:\windows\system32\drivers\PSINProt.sys [2010-7-21 112456]

R2 SimeseServer;Simese;c:\program\simese\Simese.exe [2010-8-10 899072]

R2 SqueezeMySQL;SqueezeMySQL;c:\program\squeez~2\server\bin\mswin3~1\mysqld.exe --defaults-file=c:\docume~1\alluse~1\applic~1\squeez~1\cache\my.cnf squeezemysql --> c:\program\squeez~2\server\bin\mswin3~1\mysqld.exe --defaults-file=c:\docume~1\alluse~1\applic~1\squeez~1\cache\my.cnf SqueezeMySQL [?]

R2 SvcOnlineArmor;Online Armor;c:\program\tall emu\online armor\oasrv.exe [2010-5-17 3364856]

R3 ndasbus;NDAS Bus Driver;c:\windows\system32\drivers\ndasbus.sys [2007-6-29 75880]

R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2010-7-7 14904]

S3 ndasscsi;NDAS SCSI Miniport Driver;c:\windows\system32\drivers\ndasscsi.sys [2007-6-29 187368]

S3 TdsNordecr;Nordea NCR1 SmartCard Reader;c:\windows\system32\drivers\nordecr.sys [2007-10-30 23040]

S3 VAC;S5L840F USB Device;c:\windows\system32\drivers\S5L840F.sys [2010-6-8 94829]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\wpffontcache_v0400.exe --> c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [?]

 

=============== Created Last 30 ================

 

2010-12-16 21:46:12 28552 ----a-w- c:\windows\system32\drivers\pavboot.sys

2010-12-15 21:03:01 45568 -c----w- c:\windows\system32\dllcache\wab.exe

2010-12-15 21:01:43 40960 -c----w- c:\windows\system32\dllcache\ndproxy.sys

2010-12-01 07:53:37 1892184 ----a-w- c:\windows\system32\D3DX9_42.dll

2010-12-01 07:53:34 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll

2010-12-01 07:53:21 -------- d-----w- c:\windows\Logs

2010-12-01 07:51:59 -------- d-----w- c:\program\Winamp Detect

2010-12-01 07:50:00 -------- d-----w- c:\docume~1\alluse~1\applic~1\Winamp Toolbar

2010-12-01 07:49:59 -------- d-----w- c:\program\Winamp Toolbar

2010-11-30 14:11:52 12800 ----a-w- c:\program\mozilla firefox\plugins\npwachk.dll

2010-11-29 16:38:30 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx

2010-11-29 16:38:30 69632 ----a-w- c:\windows\system32\QuickTime.qts

 

==================== Find3M ====================

 

2010-11-18 18:15:44 81920 ----a-w- c:\windows\system32\isign32.dll

2010-11-06 00:22:40 916480 ----a-w- c:\windows\system32\wininet.dll

2010-11-06 00:22:39 43520 ----a-w- c:\windows\system32\licmgr10.dll

2010-11-06 00:22:39 1469440 ------w- c:\windows\system32\inetcpl.cpl

2010-11-03 12:27:25 385024 ----a-w- c:\windows\system32\html.iec

2010-10-28 13:09:45 290048 ----a-w- c:\windows\system32\atmfd.dll

2010-10-26 14:00:01 1853312 ----a-w- c:\windows\system32\win32k.sys

2010-10-18 16:10:48 73728 ----a-w- c:\windows\system32\javacpl.cpl

2010-10-18 16:10:43 472808 ----a-w- c:\windows\system32\deployJava1.dll

 

============= FINISH: 12:16:23,87 ===============

 

Attach.txt

[Cecilia]

Pröva med att inaktivera BitDefender och WinAmap i Firefox tillägg. Det var ju inte så länge sedan du installerade Winamp-tillägget.

 

Om det inte hjälper så är det ominstallation av Firefox resp. att skapa en ny profil i Firefox som står på tur att pröva. http://kb.mozillazine.org/Profile_manager#Creating_a_new_profile

[nokia9800]

Det hjälpte inte att avaktivera BitDefender och WinAmap i Firefox tillägg.

 

Så jag skapade en ny profil i firefox och nu verkar datorn fungera bra igen.

 

Kan man flytta sparade bokmärken till den nya profilen?

[Cecilia]

Japp, och även annat som du kan tänkas ha sparat i profilen t ex lösenord och vad som ska utföras när du laddar ner filtyper. Se http://kb.mozillazine.org/Transferring_data_to_a_new_profile_-_Firefox och http://support.mozilla.com/en-US/kb/recovering%20important%20data%20from%20an%20old%20profile