PRIVACY PROTECTION!

[evolancer12]

Hej!

 

jag behöver akut hjälp.

skulle ladda ner ett mod till call of duty mw2 (det var ej något cheat) sedan så scannade jag filen. Men NEJ det hjälpte inte så nu har privacy protection angripit min dator. Inget program går att gå in på. Är privacy protection ett fake program?? skannade tills det stog något likande ''97threaths found'' Jag har testat att lägga över olika program till usb minne men dom går inte att öppna. När jag t ex ska öppna f-secure eller något annat program så står det ''programmets namn''.exe could not open

 

Vad skall jag göra??. Hjälp!!

[Cecilia]

Starta om datorn i felsäkert läge med nätverk (tryck F8 upprepade gånger under uppstarten och välj felsäkert läge med nätverk i menyn).

 

Går det nu att följa anvisningarna i tråden Till dig med virus eller andra skadliga program i datorn?

Går det att starta andra program?

[Cecilia]

Jag tycker att HijackThis visar alldeles för lite av vad som pågår i datorn för att veta om det är något skadligt kvar i datorn. DDS och OTL är betydligt bättre. Man bör även göra en rootkit-undersökning efter denna typ av infektion.

[evolancer12]

okej men nu har jag lyckats starta programmen, skall ännu göra de ni sagt men igår scannade jag med f-secure. och den gick igenom rootkist (vad nu de är?) och 3 virus upptäcktes. backdoor

trojan

trojan

[Cecilia]

Inte är du dum

Det är bara att fråga på.

 

När du startar (om) datorn trycker du på F8 upprepade gånger tills en meny visas och i den väljer du Felsäkert läge med nätverk.

[evolancer12]

Inte är du dum

Det är bara att fråga på.

 

När du startar (om) datorn trycker du på F8 upprepade gånger tills en meny visas och i den väljer du Felsäkert läge med nätverk.

 

aa jag såg det, hade läst lite fel liksom för snabbt

[evolancer12]

Malwarebytes' Anti-Malware 1.51.2.1300

www.malwarebytes.org

 

Databasversion: 8346

 

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

 

2011-12-10 11:40:00

mbam-log-2011-12-10 (11-40-00).txt

 

Skanningstyp: Snabbskanning

Antal skannade objekt: 197822

Förfluten tid: 12 minut(er), 8 sekund(er)

 

Infekterade minnesprocesser: 0

Infekterade minnesmoduler: 0

Infekterade registernycklar: 0

Infekterade registervärden: 0

Infekterade registerdataposter: 1

Infekterade mappar: 0

Infekterade filer: 1

 

Infekterade minnesprocesser:

(Inga skadliga poster hittades)

 

Infekterade minnesmoduler:

(Inga skadliga poster hittades)

 

Infekterade registernycklar:

(Inga skadliga poster hittades)

 

Infekterade registervärden:

(Inga skadliga poster hittades)

 

Infekterade registerdataposter:

HKEY_CLASSES_ROOT\regfile\shell\open\command\(default) (Broken.OpenCommand) -> Bad: ("regedit.exe" "%1") Good: (regedit.exe "%1") -> Quarantined and deleted successfully.

 

Infekterade mappar:

(Inga skadliga poster hittades)

 

Infekterade filer:

c:\Users\henke\AppData\Local\Temp\6AE7.tmp (Rogue.PrivacyProtection) -> Quarantined and deleted successfully.

 

 

Detta var allt.

[Cecilia]

Fungerar det att starta program i normalt läge eller behövs fortfarande felsäkert läge?

Kan du göra det som jag skrev i inlägg 2 (om normalt läge fungerar så använd det)?

[evolancer12]

.

DDS (Ver_2011-08-26.01) - NTFSx86 NETWORK

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_26

Run by henke at 11:47:37 on 2011-12-10

Microsoft Windows 7 Home Premium 6.1.7600.0.1252.46.1053.18.3583.2588 [GMT 1:00]

.

AV: F-Secure Client Security 9.00 *Enabled/Updated* {15414183-282E-D62C-CA37-EF24860A2F17}

SP: F-Secure Client Security 9.00 *Enabled/Updated* {AE20A067-0E14-D9A2-F087-D456FD8D65AA}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\Explorer.EXE

C:\Windows\system32\ctfmon.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2786678

uDefault_Page_URL = hxxp://www.asus.com

uURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll

mURLSearchHooks: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll

BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\adobe contribute cs5\plugins\ieplugin\contributeieplugin.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll

BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - d:\bitcomet\tools\BitCometBHO_1.3.7.16.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

BHO: Skype Browser Helper: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.7.7018.1622\swg.dll

BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll

BHO: Browsing Protection Class: {c6867eb7-8350-4856-877f-93cf8ae3dc9c} - c:\program files\f-secure\nrs\iescript\baselitmus.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\adobe contribute cs5\plugins\ieplugin\contributeieplugin.dll

TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll

TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll

TB: Conduit Engine: {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\ConduitEngine.dll

TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll

TB: Browsing Protection Toolbar: {265eee8e-3228-44d3-aea5-f7fdf5860049} - c:\program files\f-secure\nrs\iescript\baselitmus.dll

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"

uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background

uRun: [sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun

uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden

uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\DTLite.exe" -autorun

uRun: [RGSC] d:\rockstar games social club\RGSCLauncher.exe /silent

uRun: [OscarEditor] "c:\program files\anti-vibrate oscar editor\OscarEditor.exe" Minimum

uRun: [steam] "c:\program files\steam\steam.exe" -silent

uRun: [RegistryBooster] "c:\program files\uniblue\registrybooster\launcher.exe" delay 20000

uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"

uRun: [VOIPlay] "c:\program files\voiplay\voiplay.exe"

mRun: [setwallpaper] c:\programdata\SetWallpaper.cmd

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

mRun: [QuickTime Task] "D:\QTTask.exe" -atboottime

mRun: [F-Secure Manager] "c:\program files\f-secure\common\FSM32.EXE" /splash

mRun: [F-Secure TNB] "c:\program files\f-secure\fsgui\TNBUtil.exe" /CHECKALL /WAITFORSW

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"

mRun: [AdobeCS5ServiceManager] "c:\program files\common files\adobe\cs5servicemanager\CS5ServiceManager.exe" -launchedbylogin

mRun: [switchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [Logitech Download Assistant] c:\windows\system32\rundll32.exe c:\windows\system32\LogiLDA.dll,LogiFetch

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

StartupFolder: c:\users\henke\appdata\roaming\micros~1\windows\startm~1\programs\startup\skrmur~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: E&xportera till Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: Free YouTube to MP3 Converter - c:\users\henke\appdata\roaming\dvdvideosoftiehelpers\freeyoutubetomp3converter.htm

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html

IE: La&dda ner allt med BitComet - d:\bitcomet\BitComet.exe/AddAllLink.htm

IE: Ladda ner alla &videor med BitComet - d:\bitcomet\BitComet.exe/AddVideo.htm

IE: Ladda ner med &BitComet - d:\bitcomet\BitComet.exe/AddLink.htm

IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://d:\bitcomet\tools\BitCometBHO_1.3.7.16.dll/206

IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\users\henke\appdata\roaming\microsoft\windows\start menu\programs\imvu\Run IMVU.lnk

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{5DF14E7B-EF36-4698-8069-AE92AED74118} : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{5DF14E7B-EF36-4698-8069-AE92AED74118}\4554C4542394E4455425E45445D273731363 : DhcpNameServer = 192.168.1.1

TCP: Interfaces\{6B9F7832-E8F0-4B7C-BDE9-3C1B7165333F} : DhcpNameServer = 213.248.100.54 213.248.83.34 213.248.100.54

TCP: Interfaces\{9FA0DFC6-1051-4845-A13B-4F8EED93F651} : DhcpNameServer = 195.67.199.21 192.168.1.1

TCP: Interfaces\{9FA0DFC6-1051-4845-A13B-4F8EED93F651}\D41637475627 : DhcpNameServer = 195.67.199.21 192.168.1.1

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\henke\appdata\roaming\mozilla\firefox\profiles\v70vou59.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.playzeek.com/#index.php?key=frontpage

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&q=

FF - component: c:\program files\adobe\adobe contribute cs5\plugins\firefoxplugin\{01a8ca0a-4c96-465b-a49b-65c46fad54f9}\components\Contribute.dll

FF - component: c:\program files\f-secure\nrs\litmus-ff@f-secure.com\components\litmus-ff.dll

FF - component: c:\users\henke\appdata\roaming\mozilla\firefox\profiles\v70vou59.default\extensions\dttoolbar@toolbarnet.com\components\DTToolbarFF.dll

FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npContribute.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\voiplay\npvoiplay.dll

FF - plugin: c:\users\henke\appdata\locallow\unity\webplayer\loader\npUnity3D32.dll

FF - plugin: d:\plugins\npqtplugin.dll

FF - plugin: d:\plugins\npqtplugin2.dll

FF - plugin: d:\plugins\npqtplugin3.dll

FF - plugin: d:\plugins\npqtplugin4.dll

FF - plugin: d:\plugins\npqtplugin5.dll

FF - plugin: d:\plugins\npqtplugin6.dll

FF - plugin: d:\plugins\npqtplugin7.dll

.

============= SERVICES / DRIVERS ===============

.

R1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\drivers\dtsoftbus01.sys [2011-2-17 218688]

R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]

R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\drivers\Rt86win7.sys [2009-6-10 139776]

R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336]

S0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [2010-3-12 42672]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 F-Secure Gatekeeper Handler Starter;FSGKHS;c:\program files\f-secure\anti-virus\fsgk32st.exe [2010-3-12 219760]

S2 gupdate;Tjänsten Google Update (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-12 135664]

S2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-12-10 366152]

S2 NAUpdate;Nero Update;c:\program files\nero\update\NASvc.exe [2010-5-4 503080]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\f-secure\anti-virus\minifilter\fsgk.sys [2010-3-12 148632]

S3 F-Secure Network Request Broker;F-Secure Network Request Broker;c:\program files\f-secure\common\FNRB32.exe [2010-3-12 166512]

S3 FSORSPClient;F-Secure ORSP Client;c:\program files\f-secure\orsp client\fsorsp.exe [2010-3-12 61088]

S3 gupdatem;Tjänsten Google Update (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-2-12 135664]

S3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\drivers\ewusbdev.sys [2010-5-6 101248]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-10 22216]

S3 netr28u;RT2870 USB Wireless LAN Card Driver for Vista;c:\windows\system32\drivers\netr28u.sys [2009-6-10 657408]

S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\drivers\SiSGB6.sys [2009-6-10 48128]

S3 SwitchBoard;SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]

S3 WatAdminSvc;Aktiveringsteknologier för Windows-tjänst;c:\windows\system32\wat\WatAdminSvc.exe [2010-5-21 1343400]

.

=============== Created Last 30 ================

.

2011-12-10 10:22:14 -------- d-----w- c:\users\henke\appdata\roaming\Malwarebytes

2011-12-10 10:21:31 -------- d-----w- c:\programdata\Malwarebytes

2011-12-10 10:21:23 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-12-10 10:21:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-12-09 23:01:55 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{218af209-b10b-4e38-990c-07348897cc05}\offreg.dll

2011-12-09 22:48:45 -------- d-----w- c:\users\henke\appdata\local\{4C308AED-24B3-4CFA-8B31-C9493326D922}

2011-12-09 22:48:12 -------- d-----w- c:\users\henke\appdata\local\{FE9F6726-D5C5-49A1-B4BB-31886CCE5C34}

2011-12-09 21:25:47 -------- d-----w- c:\programdata\SUPERSetup

2011-12-09 14:51:58 6823496 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{218af209-b10b-4e38-990c-07348897cc05}\mpengine.dll

2011-12-09 14:45:24 -------- d-----w- c:\users\henke\appdata\local\{0B49C6AF-A369-448F-9EFB-34E0DCD76A40}

2011-12-08 17:30:43 -------- d-----w- c:\users\henke\appdata\local\{8D60567B-5167-44E6-91C5-122CF4D3ECA1}

2011-12-08 17:30:28 -------- d-----w- c:\users\henke\appdata\local\{5CD4BA51-520B-4D2A-80B4-1CFBF0516774}

2011-12-08 17:04:51 -------- d-----w- c:\users\henke\appdata\local\{1D3A95A3-B5F9-4717-9CA5-C1F867218DC7}

2011-12-08 17:04:39 -------- d-----w- c:\users\henke\appdata\local\{4041FFA4-0EF1-4DAC-915A-54D63A5DA68B}

2011-12-07 15:01:29 -------- d-----w- c:\users\henke\appdata\local\{363F1BED-5954-4F5B-804E-B8F012C747D6}

2011-12-07 15:01:16 -------- d-----w- c:\users\henke\appdata\local\{0EE71EC0-A112-4051-B215-C3B28837721F}

2011-12-05 14:51:20 -------- d-----w- c:\users\henke\appdata\local\{F98B0D90-DC30-4E0D-90DF-BD1D3817199F}

2011-12-05 14:51:01 -------- d-----w- c:\users\henke\appdata\local\{361A7305-A0DB-4FCF-9E7E-C94A405C47BB}

2011-12-04 10:21:48 -------- d-----w- c:\users\henke\appdata\local\{41456273-EDC8-4AA3-89AA-DA40A59FA810}

2011-12-04 10:21:34 -------- d-----w- c:\users\henke\appdata\local\{CD14FE33-F0E4-4F70-8EF4-882F662CD378}

2011-12-03 09:18:28 -------- d-----w- c:\users\henke\appdata\local\{B738EBB8-64EA-4A1E-8704-2120ADC0B52E}

2011-12-03 09:18:14 -------- d-----w- c:\users\henke\appdata\local\{F2E59C21-8F76-46EF-AF8F-E39BC42D6DD9}

2011-12-02 14:39:26 -------- d-----w- c:\users\henke\appdata\local\{294FC309-6816-409E-AF5A-BEA6DD0E3C08}

2011-12-02 14:39:12 -------- d-----w- c:\users\henke\appdata\local\{6903BBAA-E037-42E3-A016-F4AB5BC6EB50}

2011-12-01 14:54:10 -------- d-----w- c:\users\henke\appdata\local\{B1EC630B-8B76-4BC5-AEED-65ED944B4506}

2011-12-01 14:53:58 -------- d-----w- c:\users\henke\appdata\local\{4EB7466F-047A-4B6B-83B6-1CE1E3C72BEB}

2011-11-29 18:20:54 158056 ----a-w- c:\programdata\microsoft\windows\sqm\manifest\Sqm10139.bin

2011-11-29 16:01:00 -------- d-----w- c:\users\henke\appdata\local\{8FE9E0C1-9BC9-4C98-A342-AB45DB35F873}

2011-11-29 16:00:47 -------- d-----w- c:\users\henke\appdata\local\{6AD4DF52-139E-4AC9-960A-6FFA67459F5B}

2011-11-28 14:56:17 -------- d-----w- c:\users\henke\appdata\local\{92F38F8E-B888-46A1-B341-6C50E3D91721}

2011-11-28 14:56:01 -------- d-----w- c:\users\henke\appdata\local\{83165EB0-83AA-44A7-8708-1619B5165351}

2011-11-27 11:29:18 -------- d-----w- c:\users\henke\appdata\local\{2547F4A9-1999-42A0-A9D9-7D8E071AA314}

2011-11-27 11:29:06 -------- d-----w- c:\users\henke\appdata\local\{B7780602-C3B2-495B-B07E-CB8A3605A8AE}

2011-11-26 10:51:04 -------- d-----w- c:\users\henke\appdata\local\{A29A7ABC-463C-466B-8F77-EF1A269D4C1D}

2011-11-26 10:50:48 -------- d-----w- c:\users\henke\appdata\local\{364D60A0-E431-436E-90DE-15D5AD765E8F}

2011-11-25 14:44:21 -------- d-----w- c:\users\henke\appdata\local\{1C363818-B9EC-4330-ADF9-98B662052169}

2011-11-25 14:44:09 -------- d-----w- c:\users\henke\appdata\local\{7D6C3F81-66CF-41F4-A80B-2127A564086C}

2011-11-24 18:07:14 -------- d-----w- c:\users\henke\appdata\local\{4CD8DC09-5C47-47FE-92CC-D6054D6F3BC1}

2011-11-24 18:07:01 -------- d-----w- c:\users\henke\appdata\local\{CE9C5047-B3B6-4B4D-A4F5-084B71F3BB89}

2011-11-22 11:17:21 -------- d-----w- c:\users\henke\appdata\local\{E80694B3-59D2-46D3-A13F-CBB4E1CDACD8}

2011-11-22 02:09:35 -------- d-----w- c:\users\henke\appdata\local\{991F0823-87BE-441D-95EB-A61428282C66}

2011-11-21 15:53:01 -------- d-----w- c:\users\henke\riotsGamesLogs

2011-11-21 15:47:09 -------- d-----w- c:\users\henke\appdata\roaming\LolClient

2011-11-21 15:03:02 -------- d-----w- c:\users\henke\appdata\local\{ED8272DE-C6D7-4694-B14F-0279E9E1414B}

2011-11-19 14:26:53 -------- d-----w- c:\users\henke\appdata\local\{958475D8-F509-473E-AD25-9DAC97B99315}

2011-11-18 15:52:23 -------- d-----w- c:\users\henke\appdata\local\{1C6AF40F-8E57-4803-88E2-A223F045FCCC}

2011-11-18 15:52:08 -------- d-----w- c:\users\henke\appdata\local\{14B483A7-9B25-4DB7-8E09-BC2595EA6858}

2011-11-17 15:09:21 -------- d-----w- c:\users\henke\appdata\local\{F99CCFDA-675E-4174-AC7D-1B8CDB13A440}

2011-11-16 15:51:55 -------- d-----w- c:\users\henke\appdata\local\{A85E4439-E76A-455F-B97E-D56B25F63472}

2011-11-16 15:51:41 -------- d-----w- c:\users\henke\appdata\local\{CD6F4491-D5FB-4C1D-8CC6-DA7188375FB2}

2011-11-15 16:28:02 -------- d-----w- c:\users\henke\appdata\local\{397E9747-5ADC-4481-AFFF-145B6D377890}

2011-11-15 16:27:48 -------- d-----w- c:\users\henke\appdata\local\{A311CBE0-C740-40AF-9030-3A1A9B0C14CA}

2011-11-14 14:58:18 -------- d-----w- c:\users\henke\appdata\local\{15BE3F5A-E94D-4680-89EA-0A8EC8EF9268}

2011-11-13 08:53:49 -------- d-----w- c:\users\henke\appdata\local\{4A70C832-2159-4613-808C-61ED54862C80}

2011-11-12 12:04:35 -------- d-----w- c:\users\henke\appdata\local\{C674131E-2F3A-441D-9E4D-4349193AB7F0}

2011-11-12 12:04:23 -------- d-----w- c:\users\henke\appdata\local\{3D9B3751-0D45-4740-A676-E2B440E337B3}

2011-11-12 10:08:39 -------- d-----w- c:\users\henke\appdata\local\{BABAB8D5-64AA-4744-B790-9205440C9F48}

2011-11-11 14:49:12 -------- d-----w- c:\users\henke\appdata\local\{09C68858-A1F5-4839-9418-D6EBCDF42005}

2011-11-11 14:48:54 -------- d-----w- c:\users\henke\appdata\local\{37B81026-B84D-4DB6-8F2E-5FC4A922966E}

2011-11-10 17:45:46 -------- d-----w- c:\users\henke\appdata\local\{1B01A7A6-A5AC-429F-8D74-0FD92113BD9B}

2011-11-10 17:45:32 -------- d-----w- c:\users\henke\appdata\local\{F800BC2B-1018-42E2-AA4E-6C420F986DB7}

.

==================== Find3M ====================

.

2011-12-04 10:31:23 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-10-01 02:59:14 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2011-09-29 15:43:37 1285488 ----a-w- c:\windows\system32\drivers\tcpip.sys

2011-09-29 04:20:25 2339840 ----a-w- c:\windows\system32\win32k.sys

2011-09-13 19:58:46 444952 ----a-w- c:\windows\system32\wrap_oal.dll

2011-09-13 19:58:46 109080 ----a-w- c:\windows\system32\OpenAL32.dll

.

============= FINISH: 11:50:21,06 ===============

[evolancer12]

och ja det fungerer i normalt läge nu

[Cecilia]

1.

Avinstallera:

Conduit Engine

DAEMON Tools Toolbar

uTorrentBar Toolbar

 

2.

Spara aswMBR på skrivbordet: http://public.avast.com/~gmerek/aswMBR.exe

Starta om datorn och låt bli att starta några program.

Dubbel-klicka på aswMBR.exe för att köra programmet.

Klicka på Scan-knappen för att börja genomsökningen.

När den är klar så spara (Save) loggen på skrivbordet.

Klistra in loggen i ditt svar här.

 

3.

Spara TDSSKiller på Skrivbordet:

http://support.kaspersky.com/downloads/utils/tdsskiller.zip

 

Högerklicka och välj Extrahera alla. Kom ihåg var du packar upp filen.

Stäng av dina vanliga program, men du kan lämna antivirusprogram och liknande igång.

Kör programmet TDSSKiller.exe som finns i mappen där du packade upp filerna.

 

Klicka på Start Scan.

 

Om några hot hittas så välj Cure och klicka på Continue. Om inte Cure finns så välj Skip. Välj INTE Quarantine eller Delete. Eventuellt behöver datorn startas om.

 

Klistra in innehållet i loggen som du hittar i C:\ med namnet TDSSKiller följt av version och tidpunkt.

[evolancer12]

aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software

Run date: 2011-12-10 12:29:54

-----------------------------

12:29:54.958 OS Version: Windows 6.1.7600

12:29:54.958 Number of processors: 2 586 0x170A

12:29:54.958 ComputerName: HENKE-DATOR UserName: henke

12:30:36.345 Initialize success

12:30:42.649 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

12:30:42.664 Disk 0 Vendor: ST9500325AS 0002SDM1 Size: 476940MB BusType: 11

12:30:44.708 Disk 0 MBR read successfully

12:30:44.708 Disk 0 MBR scan

12:30:44.708 Disk 0 Windows 7 default MBR code

12:30:44.723 Disk 0 scanning sectors +976768065

12:30:44.817 Disk 0 scanning C:\Windows\system32\drivers

12:30:53.615 Service scanning

12:30:55.909 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32

12:30:56.548 Modules scanning

12:31:19.792 Disk 0 trace - called modules:

12:31:19.823 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x85d021f8]<<

12:31:19.823 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86bd97c8]

12:31:19.839 3 CLASSPNP.SYS[8cf2659e] -> nt!IofCallDriver -> [0x86ace918]

12:31:20.354 5 ACPI.sys[83b4d3b2] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x86a58030]

12:31:20.354 \Driver\atapi[0x86a54438] -> IRP_MJ_CREATE -> 0x85d021f8

12:31:20.369 Scan finished successfully

12:31:46.733 Disk 0 MBR has been saved successfully to "C:\Users\henke\Desktop\MBR.dat"

12:31:46.733 The log file has been saved successfully to "C:\Users\henke\Desktop\aswMBR.txt"

[evolancer12]

12:35:50.0866 4960 TDSS rootkit removing tool 2.6.22.0 Dec 7 2011 13:21:06

12:35:51.0030 4960 ============================================================

12:35:51.0030 4960 Current date / time: 2011/12/10 12:35:51.0030

12:35:51.0030 4960 SystemInfo:

12:35:51.0030 4960

12:35:51.0030 4960 OS Version: 6.1.7600 ServicePack: 0.0

12:35:51.0030 4960 Product type: Workstation

12:35:51.0030 4960 ComputerName: HENKE-DATOR

12:35:51.0030 4960 UserName: henke

12:35:51.0030 4960 Windows directory: C:\Windows

12:35:51.0030 4960 System windows directory: C:\Windows

12:35:51.0031 4960 Processor architecture: Intel x86

12:35:51.0031 4960 Number of processors: 2

12:35:51.0031 4960 Page size: 0x1000

12:35:51.0031 4960 Boot type: Normal boot

12:35:51.0031 4960 ============================================================

12:35:52.0062 4960 Initialize success

12:36:07.0524 4404 ============================================================

12:36:07.0524 4404 Scan started

12:36:07.0524 4404 Mode: Manual;

12:36:07.0524 4404 ============================================================

12:36:08.0678 4404 1394ohci (6d2aca41739bfe8cb86ee8e85f29697d) C:\Windows\system32\DRIVERS\1394ohci.sys

12:36:08.0682 4404 1394ohci - ok

12:36:08.0709 4404 ACPI (f0e07d144c8685b8774bc32fc8da4df0) C:\Windows\system32\DRIVERS\ACPI.sys

12:36:08.0713 4404 ACPI - ok

12:36:08.0739 4404 AcpiPmi (98d81ca942d19f7d9153b095162ac013) C:\Windows\system32\DRIVERS\acpipmi.sys

12:36:08.0742 4404 AcpiPmi - ok

12:36:08.0878 4404 adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys

12:36:08.0887 4404 adp94xx - ok

12:36:08.0911 4404 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys

12:36:08.0918 4404 adpahci - ok

12:36:08.0961 4404 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys

12:36:08.0966 4404 adpu320 - ok

12:36:09.0089 4404 AFD (0db7a48388d54d154ebec120461a0fcd) C:\Windows\system32\drivers\afd.sys

12:36:09.0093 4404 AFD - ok

12:36:09.0161 4404 agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\DRIVERS\agp440.sys

12:36:09.0163 4404 agp440 - ok

12:36:09.0290 4404 aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys

12:36:09.0292 4404 aic78xx - ok

12:36:09.0415 4404 aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\DRIVERS\aliide.sys

12:36:09.0416 4404 aliide - ok

12:36:09.0470 4404 amdagp (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\DRIVERS\amdagp.sys

12:36:09.0472 4404 amdagp - ok

12:36:09.0522 4404 amdide (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\DRIVERS\amdide.sys

12:36:09.0524 4404 amdide - ok

12:36:09.0637 4404 AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys

12:36:09.0639 4404 AmdK8 - ok

12:36:09.0662 4404 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys

12:36:09.0664 4404 AmdPPM - ok

12:36:09.0739 4404 amdsata (19ce906b4cdc11fc4fef5745f33a63b6) C:\Windows\system32\drivers\amdsata.sys

12:36:09.0741 4404 amdsata - ok

12:36:09.0876 4404 amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys

12:36:09.0881 4404 amdsbs - ok

12:36:09.0914 4404 amdxata (869e67d66be326a5a9159fba8746fa70) C:\Windows\system32\drivers\amdxata.sys

12:36:09.0915 4404 amdxata - ok

12:36:09.0944 4404 AppID (feb834c02ce1e84b6a38f953ca067706) C:\Windows\system32\drivers\appid.sys

12:36:09.0946 4404 AppID - ok

12:36:10.0103 4404 arc (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys

12:36:10.0105 4404 arc - ok

12:36:10.0139 4404 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys

12:36:10.0141 4404 arcsas - ok

12:36:10.0291 4404 AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys

12:36:10.0293 4404 AsyncMac - ok

12:36:10.0319 4404 atapi (338c86357871c167a96ab976519bf59e) C:\Windows\system32\DRIVERS\atapi.sys

12:36:10.0320 4404 atapi - ok

12:36:10.0425 4404 athr (b01751cc563aecac09bbe36aaa21fbef) C:\Windows\system32\DRIVERS\athr.sys

12:36:10.0439 4404 athr - ok

12:36:10.0602 4404 b06bdrv (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys

12:36:10.0610 4404 b06bdrv - ok

12:36:10.0657 4404 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys

12:36:10.0662 4404 b57nd60x - ok

12:36:10.0764 4404 Beep (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys

12:36:10.0765 4404 Beep - ok

12:36:10.0851 4404 blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys

12:36:10.0853 4404 blbdrive - ok

12:36:10.0944 4404 bowser (9a5c671b7fbae4865149bb11f59b91b2) C:\Windows\system32\DRIVERS\bowser.sys

12:36:10.0946 4404 bowser - ok

12:36:11.0004 4404 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys

12:36:11.0005 4404 BrFiltLo - ok

12:36:11.0149 4404 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys

12:36:11.0150 4404 BrFiltUp - ok

12:36:11.0327 4404 Brserid (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys

12:36:11.0341 4404 Brserid - ok

12:36:11.0403 4404 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys

12:36:11.0405 4404 BrSerWdm - ok

12:36:11.0479 4404 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys

12:36:11.0481 4404 BrUsbMdm - ok

12:36:11.0569 4404 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys

12:36:11.0570 4404 BrUsbSer - ok

12:36:11.0592 4404 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys

12:36:11.0594 4404 BTHMODEM - ok

12:36:11.0729 4404 cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys

12:36:11.0731 4404 cdfs - ok

12:36:11.0773 4404 cdrom (ba6e70aa0e6091bc39de29477d866a77) C:\Windows\system32\DRIVERS\cdrom.sys

12:36:11.0775 4404 cdrom - ok

12:36:11.0904 4404 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys

12:36:11.0905 4404 circlass - ok

12:36:11.0956 4404 CLFS (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys

12:36:11.0960 4404 CLFS - ok

12:36:12.0094 4404 CmBatt (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys

12:36:12.0095 4404 CmBatt - ok

12:36:12.0121 4404 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\DRIVERS\cmdide.sys

12:36:12.0123 4404 cmdide - ok

12:36:12.0208 4404 CNG (1b675691ed940766149c93e8f4488d68) C:\Windows\system32\Drivers\cng.sys

12:36:12.0213 4404 CNG - ok

12:36:12.0305 4404 Compbatt (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys

12:36:12.0307 4404 Compbatt - ok

12:36:12.0354 4404 CompositeBus (f1724ba27e97d627f808fb0ba77a28a6) C:\Windows\system32\DRIVERS\CompositeBus.sys

12:36:12.0357 4404 CompositeBus - ok

12:36:12.0457 4404 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys

12:36:12.0459 4404 crcdisk - ok

12:36:12.0607 4404 DfsC (83d1ecea8faae75604c0fa49ac7ad996) C:\Windows\system32\Drivers\dfsc.sys

12:36:12.0609 4404 DfsC - ok

12:36:12.0652 4404 discache (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys

12:36:12.0654 4404 discache - ok

12:36:12.0785 4404 Disk (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys

12:36:12.0787 4404 Disk - ok

12:36:12.0891 4404 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys

12:36:12.0893 4404 drmkaud - ok

12:36:12.0989 4404 dtsoftbus01 (555e54ac2f601a8821cef58961653991) C:\Windows\system32\DRIVERS\dtsoftbus01.sys

12:36:12.0993 4404 dtsoftbus01 - ok

12:36:13.0053 4404 DXGKrnl (1679a4669326cb1a67cc95658d273234) C:\Windows\System32\drivers\dxgkrnl.sys

12:36:13.0062 4404 DXGKrnl - ok

12:36:13.0265 4404 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys

12:36:13.0355 4404 ebdrv - ok

12:36:13.0475 4404 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys

12:36:13.0484 4404 elxstor - ok

12:36:13.0507 4404 ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\DRIVERS\errdev.sys

12:36:13.0508 4404 ErrDev - ok

12:36:13.0572 4404 exfat (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys

12:36:13.0576 4404 exfat - ok

12:36:13.0680 4404 F-Secure Gatekeeper (29d12e1e45d93b45d2598e2663bbeff4) C:\Program Files\F-Secure\Anti-Virus\minifilter\fsgk.sys

12:36:13.0683 4404 F-Secure Gatekeeper - ok

12:36:13.0830 4404 fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys

12:36:13.0833 4404 fastfat - ok

12:36:13.0972 4404 fdc (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys

12:36:13.0974 4404 fdc - ok

12:36:14.0020 4404 FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys

12:36:14.0022 4404 FileInfo - ok

12:36:14.0048 4404 Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys

12:36:14.0049 4404 Filetrace - ok

12:36:14.0164 4404 flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys

12:36:14.0166 4404 flpydisk - ok

12:36:14.0194 4404 FltMgr (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys

12:36:14.0197 4404 FltMgr - ok

12:36:14.0313 4404 fsbts (343786e182b9c9ae3066e00dec650f50) C:\Windows\system32\Drivers\fsbts.sys

12:36:14.0315 4404 fsbts - ok

12:36:14.0350 4404 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys

12:36:14.0352 4404 FsDepends - ok

12:36:14.0485 4404 Fs_Rec (a574b4360e438977038aae4bf60d79a2) C:\Windows\system32\drivers\Fs_Rec.sys

12:36:14.0487 4404 Fs_Rec - ok

12:36:14.0554 4404 fvevol (dafbd9fe39197495aed6d51f3b85b5d2) C:\Windows\system32\DRIVERS\fvevol.sys

12:36:14.0557 4404 fvevol - ok

12:36:14.0678 4404 gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys

12:36:14.0680 4404 gagp30kx - ok

12:36:14.0855 4404 hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys

12:36:14.0857 4404 hcw85cir - ok

12:36:14.0910 4404 HdAudAddService (3530cad25deba7dc7de8bb51632cbc5f) C:\Windows\system32\drivers\HdAudio.sys

12:36:14.0915 4404 HdAudAddService - ok

12:36:15.0023 4404 HDAudBus (717a2207fd6f13ad3e664c7d5a43c7bf) C:\Windows\system32\DRIVERS\HDAudBus.sys

12:36:15.0025 4404 HDAudBus - ok

12:36:15.0048 4404 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys

12:36:15.0050 4404 HidBatt - ok

12:36:15.0135 4404 HidBth (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys

12:36:15.0137 4404 HidBth - ok

12:36:15.0193 4404 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys

12:36:15.0195 4404 HidIr - ok

12:36:15.0327 4404 HidUsb (25072fb35ac90b25f9e4e3bacf774102) C:\Windows\system32\DRIVERS\hidusb.sys

12:36:15.0328 4404 HidUsb - ok

12:36:15.0436 4404 HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\DRIVERS\HpSAMD.sys

12:36:15.0438 4404 HpSAMD - ok

12:36:15.0488 4404 HTTP (c531c7fd9e8b62021112787c4e2c5a5a) C:\Windows\system32\drivers\HTTP.sys

12:36:15.0494 4404 HTTP - ok

12:36:15.0636 4404 hwdatacard (988c0a49f09d75d3341cb419141793c1) C:\Windows\system32\DRIVERS\ewusbmdm.sys

12:36:15.0638 4404 hwdatacard - ok

12:36:15.0664 4404 hwpolicy (8305f33cde89ad6c7a0763ed0b5a8d42) C:\Windows\system32\drivers\hwpolicy.sys

12:36:15.0666 4404 hwpolicy - ok

12:36:15.0822 4404 hwusbdev (ac6b4aabf92867584445d0c435b9248f) C:\Windows\system32\DRIVERS\ewusbdev.sys

12:36:15.0826 4404 hwusbdev - ok

12:36:15.0971 4404 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\DRIVERS\i8042prt.sys

12:36:15.0973 4404 i8042prt - ok

12:36:16.0105 4404 iaStorV (71f1a494fedf4b33c02c4a6a28d6d9e9) C:\Windows\system32\drivers\iaStorV.sys

12:36:16.0111 4404 iaStorV - ok

12:36:16.0270 4404 iirsp (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys

12:36:16.0272 4404 iirsp - ok

12:36:16.0345 4404 intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\DRIVERS\intelide.sys

12:36:16.0347 4404 intelide - ok

12:36:16.0463 4404 intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys

12:36:16.0465 4404 intelppm - ok

12:36:16.0500 4404 IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys

12:36:16.0502 4404 IpFilterDriver - ok

12:36:16.0600 4404 IPMIDRV (e4454b6c37d7ffd5649611f6496308a7) C:\Windows\system32\DRIVERS\IPMIDrv.sys

12:36:16.0602 4404 IPMIDRV - ok

12:36:16.0616 4404 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys

12:36:16.0619 4404 IPNAT - ok

12:36:16.0670 4404 IRENUM (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys

12:36:16.0671 4404 IRENUM - ok

12:36:16.0729 4404 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\DRIVERS\isapnp.sys

12:36:16.0731 4404 isapnp - ok

12:36:16.0806 4404 iScsiPrt (ed46c223ae46c6866ab77cdc41c404b7) C:\Windows\system32\DRIVERS\msiscsi.sys

12:36:16.0811 4404 iScsiPrt - ok

12:36:16.0849 4404 kbdclass (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys

12:36:16.0851 4404 kbdclass - ok

12:36:16.0959 4404 kbdhid (3d9f0ebf350edcfd6498057301455964) C:\Windows\system32\DRIVERS\kbdhid.sys

12:36:16.0961 4404 kbdhid - ok

12:36:16.0983 4404 KSecDD (e36a061ec11b373826905b21be10948f) C:\Windows\system32\Drivers\ksecdd.sys

12:36:16.0985 4404 KSecDD - ok

12:36:17.0094 4404 KSecPkg (365c6154bbbc5377173f1ca7bfb6cc59) C:\Windows\system32\Drivers\ksecpkg.sys

12:36:17.0097 4404 KSecPkg - ok

12:36:17.0274 4404 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys

12:36:17.0276 4404 lltdio - ok

12:36:17.0348 4404 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys

12:36:17.0352 4404 LSI_FC - ok

12:36:17.0411 4404 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys

12:36:17.0413 4404 LSI_SAS - ok

12:36:17.0472 4404 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys

12:36:17.0474 4404 LSI_SAS2 - ok

12:36:17.0519 4404 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys

12:36:17.0522 4404 LSI_SCSI - ok

12:36:17.0600 4404 luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys

12:36:17.0602 4404 luafv - ok

12:36:17.0738 4404 MBAMProtector (69a6268d7f81e53d568ab4e7e991caf3) C:\Windows\system32\drivers\mbam.sys

12:36:17.0740 4404 MBAMProtector - ok

12:36:17.0795 4404 MBAMSwissArmy - ok

12:36:17.0916 4404 megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys

12:36:17.0918 4404 megasas - ok

12:36:17.0974 4404 MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys

12:36:17.0979 4404 MegaSR - ok

12:36:18.0031 4404 Modem (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys

12:36:18.0033 4404 Modem - ok

12:36:18.0061 4404 monitor (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys

12:36:18.0063 4404 monitor - ok

12:36:18.0192 4404 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys

12:36:18.0194 4404 mouclass - ok

12:36:18.0316 4404 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys

12:36:18.0318 4404 mouhid - ok

12:36:18.0344 4404 mountmgr (921c18727c5920d6c0300736646931c2) C:\Windows\system32\drivers\mountmgr.sys

12:36:18.0346 4404 mountmgr - ok

12:36:18.0487 4404 mpio (2af5997438c55fb79d33d015c30e1974) C:\Windows\system32\DRIVERS\mpio.sys

12:36:18.0490 4404 mpio - ok

12:36:18.0520 4404 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys

12:36:18.0522 4404 mpsdrv - ok

12:36:18.0629 4404 MRxDAV (b1be47008d20e43da3adc37c24cdb89d) C:\Windows\system32\drivers\mrxdav.sys

12:36:18.0631 4404 MRxDAV - ok

12:36:18.0680 4404 mrxsmb (ca7570e42522e24324a12161db14ec02) C:\Windows\system32\DRIVERS\mrxsmb.sys

12:36:18.0683 4404 mrxsmb - ok

12:36:18.0723 4404 mrxsmb10 (f965c3ab2b2ae5c378f4562486e35051) C:\Windows\system32\DRIVERS\mrxsmb10.sys

12:36:18.0726 4404 mrxsmb10 - ok

12:36:18.0775 4404 mrxsmb20 (25c38264a3c72594dd21d355d70d7a5d) C:\Windows\system32\DRIVERS\mrxsmb20.sys

12:36:18.0778 4404 mrxsmb20 - ok

12:36:18.0904 4404 msahci (4326d168944123f38dd3b2d9c37a0b12) C:\Windows\system32\DRIVERS\msahci.sys

12:36:18.0905 4404 msahci - ok

12:36:18.0943 4404 msdsm (455029c7174a2dbb03dba8a0d8bddd9a) C:\Windows\system32\DRIVERS\msdsm.sys

12:36:18.0945 4404 msdsm - ok

12:36:18.0984 4404 Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys

12:36:18.0986 4404 Msfs - ok

12:36:19.0003 4404 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys

12:36:19.0004 4404 mshidkmdf - ok

12:36:19.0021 4404 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\DRIVERS\msisadrv.sys

12:36:19.0023 4404 msisadrv - ok

12:36:19.0158 4404 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys

12:36:19.0160 4404 MSKSSRV - ok

12:36:19.0186 4404 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys

12:36:19.0188 4404 MSPCLOCK - ok

12:36:19.0307 4404 MSPQM (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys

12:36:19.0309 4404 MSPQM - ok

12:36:19.0333 4404 MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys

12:36:19.0336 4404 MsRPC - ok

12:36:19.0364 4404 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\DRIVERS\mssmbios.sys

12:36:19.0366 4404 mssmbios - ok

12:36:19.0498 4404 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys

12:36:19.0500 4404 MSTEE - ok

12:36:19.0526 4404 MTConfig (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys

12:36:19.0527 4404 MTConfig - ok

12:36:19.0653 4404 MTsensor (97affa9d95ffe20eee6229bc6be166cf) C:\Windows\system32\DRIVERS\ATKACPI.sys

12:36:19.0654 4404 MTsensor - ok

12:36:19.0695 4404 Mup (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys

12:36:19.0697 4404 Mup - ok

12:36:19.0828 4404 NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys

12:36:19.0832 4404 NativeWifiP - ok

12:36:19.0994 4404 NDIS (23759d175a0a9baaf04d05047bc135a8) C:\Windows\system32\drivers\ndis.sys

12:36:20.0002 4404 NDIS - ok

12:36:20.0126 4404 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys

12:36:20.0128 4404 NdisCap - ok

12:36:20.0225 4404 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys

12:36:20.0226 4404 NdisTapi - ok

12:36:20.0258 4404 Ndisuio (b30ae7f2b6d7e343b0df32e6c08fce75) C:\Windows\system32\DRIVERS\ndisuio.sys

12:36:20.0260 4404 Ndisuio - ok

12:36:20.0333 4404 NdisWan (267c415eadcbe53c9ca873dee39cf3a4) C:\Windows\system32\DRIVERS\ndiswan.sys

12:36:20.0335 4404 NdisWan - ok

12:36:20.0367 4404 NDProxy (af7e7c63dcef3f8772726f86039d6eb4) C:\Windows\system32\drivers\NDProxy.sys

12:36:20.0369 4404 NDProxy - ok

12:36:20.0483 4404 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys

12:36:20.0485 4404 NetBIOS - ok

12:36:20.0515 4404 NetBT (dd52a733bf4ca5af84562a5e2f963b91) C:\Windows\system32\DRIVERS\netbt.sys

12:36:20.0518 4404 NetBT - ok

12:36:20.0688 4404 netr28u (27ee4b406e2f26f6117a9a420bd4cb65) C:\Windows\system32\DRIVERS\netr28u.sys

12:36:20.0700 4404 netr28u - ok

12:36:20.0845 4404 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys

12:36:20.0847 4404 nfrd960 - ok

12:36:20.0971 4404 Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys

12:36:20.0973 4404 Npfs - ok

12:36:20.0994 4404 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys

12:36:20.0996 4404 nsiproxy - ok

12:36:21.0118 4404 Ntfs (187002ce05693c306f43c873f821381f) C:\Windows\system32\drivers\Ntfs.sys

12:36:21.0131 4404 Ntfs - ok

12:36:21.0172 4404 Null (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys

12:36:21.0174 4404 Null - ok

12:36:21.0526 4404 nvlddmkm (5ce5b23855262acabaecce156f48dd88) C:\Windows\system32\DRIVERS\nvlddmkm.sys

12:36:21.0757 4404 nvlddmkm - ok

12:36:21.0831 4404 nvraid (f1b0bed906f97e16f6d0c3629d2f21c6) C:\Windows\system32\drivers\nvraid.sys

12:36:21.0833 4404 nvraid - ok

12:36:21.0902 4404 nvstor (4520b63899e867f354ee012d34e11536) C:\Windows\system32\drivers\nvstor.sys

12:36:21.0906 4404 nvstor - ok

12:36:22.0027 4404 nv_agp (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\DRIVERS\nv_agp.sys

12:36:22.0029 4404 nv_agp - ok

12:36:22.0080 4404 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\DRIVERS\ohci1394.sys

12:36:22.0082 4404 ohci1394 - ok

12:36:22.0246 4404 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys

12:36:22.0248 4404 Parport - ok

12:36:22.0270 4404 partmgr (ff4218952b51de44fe910953a3e686b9) C:\Windows\system32\drivers\partmgr.sys

12:36:22.0272 4404 partmgr - ok

12:36:22.0385 4404 Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys

12:36:22.0387 4404 Parvdm - ok

12:36:22.0447 4404 pci (c858cb77c577780ecc456a892e7e7d0f) C:\Windows\system32\DRIVERS\pci.sys

12:36:22.0450 4404 pci - ok

12:36:22.0547 4404 pciide (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\DRIVERS\pciide.sys

12:36:22.0549 4404 pciide - ok

12:36:22.0579 4404 pcmcia (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys

12:36:22.0582 4404 pcmcia - ok

12:36:22.0702 4404 pcw (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys

12:36:22.0704 4404 pcw - ok

12:36:22.0739 4404 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys

12:36:22.0746 4404 PEAUTH - ok

12:36:22.0909 4404 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys

12:36:22.0912 4404 PptpMiniport - ok

12:36:22.0953 4404 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys

12:36:22.0955 4404 Processor - ok

12:36:23.0059 4404 Psched (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys

12:36:23.0061 4404 Psched - ok

12:36:23.0118 4404 PxHelp20 (40fedd328f98245ad201cf5f9f311724) C:\Windows\system32\Drivers\PxHelp20.sys

12:36:23.0120 4404 PxHelp20 - ok

12:36:23.0257 4404 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys

12:36:23.0292 4404 ql2300 - ok

12:36:23.0319 4404 ql40xx (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys

12:36:23.0321 4404 ql40xx - ok

12:36:23.0351 4404 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys

12:36:23.0353 4404 QWAVEdrv - ok

12:36:23.0376 4404 RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys

12:36:23.0378 4404 RasAcd - ok

12:36:23.0475 4404 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys

12:36:23.0477 4404 RasAgileVpn - ok

12:36:23.0563 4404 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys

12:36:23.0566 4404 Rasl2tp - ok

12:36:23.0659 4404 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys

12:36:23.0662 4404 RasPppoe - ok

12:36:23.0743 4404 RasSstp (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys

12:36:23.0745 4404 RasSstp - ok

12:36:23.0771 4404 rdbss (835d7e81bf517a3b72384bdcc85e1ce6) C:\Windows\system32\DRIVERS\rdbss.sys

12:36:23.0775 4404 rdbss - ok

12:36:23.0808 4404 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys

12:36:23.0811 4404 rdpbus - ok

12:36:23.0840 4404 RDPCDD (1e016846895b15a99f9a176a05029075) C:\Windows\system32\DRIVERS\RDPCDD.sys

12:36:23.0841 4404 RDPCDD - ok

12:36:23.0942 4404 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys

12:36:23.0944 4404 RDPENCDD - ok

12:36:23.0973 4404 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys

12:36:23.0975 4404 RDPREFMP - ok

12:36:23.0999 4404 RDPWD (801371ba9782282892d00aadb08ee367) C:\Windows\system32\drivers\RDPWD.sys

12:36:24.0003 4404 RDPWD - ok

12:36:24.0042 4404 rdyboost (4ea225bf1cf05e158853f30a99ca29a7) C:\Windows\system32\drivers\rdyboost.sys

12:36:24.0045 4404 rdyboost - ok

12:36:24.0140 4404 rspndr (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys

12:36:24.0142 4404 rspndr - ok

12:36:24.0247 4404 RTL8167 (7dfd48e24479b68b258d8770121155a0) C:\Windows\system32\DRIVERS\Rt86win7.sys

12:36:24.0250 4404 RTL8167 - ok

12:36:24.0330 4404 sbp2port (34ee0c44b724e3e4ce2eff29126de5b5) C:\Windows\system32\DRIVERS\sbp2port.sys

12:36:24.0332 4404 sbp2port - ok

12:36:24.0364 4404 scfilter (a95c54b2ac3cc9c73fcdf9e51a1d6b51) C:\Windows\system32\DRIVERS\scfilter.sys

12:36:24.0366 4404 scfilter - ok

12:36:24.0466 4404 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys

12:36:24.0468 4404 secdrv - ok

12:36:24.0533 4404 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys

12:36:24.0535 4404 Serenum - ok

12:36:24.0592 4404 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys

12:36:24.0594 4404 Serial - ok

12:36:24.0715 4404 sermouse (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys

12:36:24.0717 4404 sermouse - ok

12:36:24.0885 4404 sfdrv01 (00de597b81b381053cb5b21a7f20e365) C:\Windows\system32\drivers\sfdrv01.sys

12:36:24.0891 4404 sfdrv01 - ok

12:36:24.0933 4404 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\DRIVERS\sffdisk.sys

12:36:24.0935 4404 sffdisk - ok

12:36:24.0960 4404 sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\DRIVERS\sffp_mmc.sys

12:36:24.0962 4404 sffp_mmc - ok

12:36:24.0989 4404 sffp_sd (4f1e5b0fe7c8050668dbfade8999aefb) C:\Windows\system32\DRIVERS\sffp_sd.sys

12:36:24.0991 4404 sffp_sd - ok

12:36:25.0108 4404 sfhlp02 (64b9ab76f1b16eb059cb6cdd906c067a) C:\Windows\system32\drivers\sfhlp02.sys

12:36:25.0112 4404 sfhlp02 - ok

12:36:25.0152 4404 sfloppy (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys

12:36:25.0153 4404 sfloppy - ok

12:36:25.0283 4404 sfsync02 (798d918d8f20380008277ce3ce5319d1) C:\Windows\system32\drivers\sfsync02.sys

12:36:25.0287 4404 sfsync02 - ok

12:36:25.0370 4404 sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\DRIVERS\sisagp.sys

12:36:25.0372 4404 sisagp - ok

12:36:25.0464 4404 SiSGbeLH (6f0c643c7f49f2091b01d014eae72e1a) C:\Windows\system32\DRIVERS\SiSGB6.sys

12:36:25.0466 4404 SiSGbeLH - ok

12:36:25.0515 4404 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys

12:36:25.0517 4404 SiSRaid2 - ok

12:36:25.0544 4404 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys

12:36:25.0546 4404 SiSRaid4 - ok

12:36:25.0670 4404 Smb (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys

12:36:25.0674 4404 Smb - ok

12:36:25.0725 4404 spldr (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys

12:36:25.0727 4404 spldr - ok

12:36:25.0886 4404 sptd (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys

12:36:25.0887 4404 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505

12:36:25.0889 4404 sptd ( LockedFile.Multi.Generic ) - warning

12:36:25.0890 4404 sptd - detected LockedFile.Multi.Generic (1)

12:36:25.0942 4404 srv (c4a027b8c0bd3fc0699f41fa5e9e0c87) C:\Windows\system32\DRIVERS\srv.sys

12:36:25.0946 4404 srv - ok

12:36:25.0975 4404 srv2 (414bb592cad8a79649d01f9d94318fb3) C:\Windows\system32\DRIVERS\srv2.sys

12:36:25.0979 4404 srv2 - ok

12:36:26.0012 4404 srvnet (ff207d67700aa18242aaf985d3e7d8f4) C:\Windows\system32\DRIVERS\srvnet.sys

12:36:26.0015 4404 srvnet - ok

12:36:26.0184 4404 stexstor (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys

12:36:26.0186 4404 stexstor - ok

12:36:26.0228 4404 swenum (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\DRIVERS\swenum.sys

12:36:26.0229 4404 swenum - ok

12:36:26.0399 4404 Tcpip (56c198ac82efa622dd93e9e43575f79c) C:\Windows\system32\drivers\tcpip.sys

12:36:26.0413 4404 Tcpip - ok

12:36:26.0487 4404 TCPIP6 (56c198ac82efa622dd93e9e43575f79c) C:\Windows\system32\DRIVERS\tcpip.sys

12:36:26.0500 4404 TCPIP6 - ok

12:36:26.0547 4404 tcpipreg (e64444523add154f86567c469bc0b17f) C:\Windows\system32\drivers\tcpipreg.sys

12:36:26.0548 4404 tcpipreg - ok

12:36:26.0581 4404 TDPIPE (1875c1490d99e70e449e3afae9fcbadf) C:\Windows\system32\drivers\tdpipe.sys

12:36:26.0583 4404 TDPIPE - ok

12:36:26.0608 4404 TDTCP (7551e91ea999ee9a8e9c331d5a9c31f3) C:\Windows\system32\drivers\tdtcp.sys

12:36:26.0610 4404 TDTCP - ok

12:36:26.0641 4404 tdx (cb39e896a2a83702d1737bfd402b3542) C:\Windows\system32\DRIVERS\tdx.sys

12:36:26.0643 4404 tdx - ok

12:36:26.0662 4404 TermDD (c36f41ee20e6999dbf4b0425963268a5) C:\Windows\system32\DRIVERS\termdd.sys

12:36:26.0664 4404 TermDD - ok

12:36:26.0716 4404 tssecsrv (98ae6fa07d12cb4ec5cf4a9bfa5f4242) C:\Windows\system32\DRIVERS\tssecsrv.sys

12:36:26.0717 4404 tssecsrv - ok

12:36:26.0851 4404 tunnel (3e461d890a97f9d4c168f5fda36e1d00) C:\Windows\system32\DRIVERS\tunnel.sys

12:36:26.0853 4404 tunnel - ok

12:36:26.0881 4404 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys

12:36:26.0883 4404 uagp35 - ok

12:36:26.0916 4404 udfs (09cc3e16f8e5ee7168e01cf8fcbe061a) C:\Windows\system32\DRIVERS\udfs.sys

12:36:26.0921 4404 udfs - ok

12:36:27.0047 4404 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\DRIVERS\uliagpkx.sys

12:36:27.0050 4404 uliagpkx - ok

12:36:27.0093 4404 umbus (049b3a50b3d646baeeee9eec9b0668dc) C:\Windows\system32\DRIVERS\umbus.sys

12:36:27.0095 4404 umbus - ok

12:36:27.0164 4404 UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys

12:36:27.0166 4404 UmPass - ok

12:36:27.0213 4404 usbccgp (c31ae588e403042632dc796cf09e30b0) C:\Windows\system32\DRIVERS\usbccgp.sys

12:36:27.0215 4404 usbccgp - ok

12:36:27.0245 4404 usbcir (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\DRIVERS\usbcir.sys

12:36:27.0247 4404 usbcir - ok

12:36:27.0292 4404 usbehci (e4c436d914768ce965d5e659ba7eebd8) C:\Windows\system32\DRIVERS\usbehci.sys

12:36:27.0294 4404 usbehci - ok

12:36:27.0411 4404 usbhub (bdcd7156ec37448f08633fd899823620) C:\Windows\system32\DRIVERS\usbhub.sys

12:36:27.0415 4404 usbhub - ok

12:36:27.0436 4404 usbohci (eb2d819a639015253c871cda09d91d58) C:\Windows\system32\DRIVERS\usbohci.sys

12:36:27.0438 4404 usbohci - ok

12:36:27.0481 4404 usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys

12:36:27.0483 4404 usbprint - ok

12:36:27.0520 4404 USBSTOR (1c4287739a93594e57e2a9e6a3ed7353) C:\Windows\system32\DRIVERS\USBSTOR.SYS

12:36:27.0522 4404 USBSTOR - ok

12:36:27.0565 4404 usbuhci (22480bf4e5a09192e5e30ba4dde79fa4) C:\Windows\system32\drivers\usbuhci.sys

12:36:27.0567 4404 usbuhci - ok

12:36:27.0682 4404 usbvideo (b5f6a992d996282b7fae7048e50af83a) C:\Windows\System32\Drivers\usbvideo.sys

12:36:27.0685 4404 usbvideo - ok

12:36:27.0807 4404 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\DRIVERS\vdrvroot.sys

12:36:27.0809 4404 vdrvroot - ok

12:36:27.0857 4404 vga (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys

12:36:27.0859 4404 vga - ok

12:36:27.0897 4404 VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys

12:36:27.0899 4404 VgaSave - ok

12:36:27.0935 4404 vhdmp (3be6e1f3a4f1afec8cee0d7883f93583) C:\Windows\system32\DRIVERS\vhdmp.sys

12:36:27.0939 4404 vhdmp - ok

12:36:27.0983 4404 viaagp (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\DRIVERS\viaagp.sys

12:36:27.0986 4404 viaagp - ok

12:36:28.0009 4404 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys

12:36:28.0011 4404 ViaC7 - ok

12:36:28.0039 4404 viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\DRIVERS\viaide.sys

12:36:28.0041 4404 viaide - ok

12:36:28.0065 4404 volmgr (384e5a2aa49934295171e499f86ba6f3) C:\Windows\system32\DRIVERS\volmgr.sys

12:36:28.0068 4404 volmgr - ok

12:36:28.0096 4404 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys

12:36:28.0101 4404 volmgrx - ok

12:36:28.0125 4404 volsnap (58df9d2481a56edde167e51b334d44fd) C:\Windows\system32\DRIVERS\volsnap.sys

12:36:28.0129 4404 volsnap - ok

12:36:28.0240 4404 vsmraid (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys

12:36:28.0244 4404 vsmraid - ok

12:36:28.0316 4404 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\system32\DRIVERS\vwifibus.sys

12:36:28.0318 4404 vwifibus - ok

12:36:28.0360 4404 vwififlt (7090d3436eeb4e7da3373090a23448f7) C:\Windows\system32\DRIVERS\vwififlt.sys

12:36:28.0362 4404 vwififlt - ok

12:36:28.0449 4404 vwifimp (a3f04cbea6c2a10e6cb01f8b47611882) C:\Windows\system32\DRIVERS\vwifimp.sys

12:36:28.0451 4404 vwifimp - ok

12:36:28.0502 4404 WacomPen (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys

12:36:28.0504 4404 WacomPen - ok

12:36:28.0548 4404 WANARP (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys

12:36:28.0551 4404 WANARP - ok

12:36:28.0558 4404 Wanarpv6 (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys

12:36:28.0560 4404 Wanarpv6 - ok

12:36:28.0712 4404 Wd (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys

12:36:28.0714 4404 Wd - ok

12:36:28.0749 4404 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys

12:36:28.0755 4404 Wdf01000 - ok

12:36:28.0898 4404 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys

12:36:28.0901 4404 WfpLwf - ok

12:36:28.0932 4404 WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys

12:36:28.0933 4404 WIMMount - ok

12:36:29.0104 4404 WinUsb (30fc6e5448d0cbaaa95280eeef7fedae) C:\Windows\system32\DRIVERS\WinUsb.sys

12:36:29.0106 4404 WinUsb - ok

12:36:29.0242 4404 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\DRIVERS\wmiacpi.sys

12:36:29.0244 4404 WmiAcpi - ok

12:36:29.0308 4404 ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys

12:36:29.0310 4404 ws2ifsl - ok

12:36:29.0355 4404 WudfPf (6f9b6c0c93232cff47d0f72d6db1d21e) C:\Windows\system32\drivers\WudfPf.sys

12:36:29.0358 4404 WudfPf - ok

12:36:29.0474 4404 WUDFRd (f91ff1e51fca30b3c3981db7d5924252) C:\Windows\system32\DRIVERS\WUDFRd.sys

12:36:29.0478 4404 WUDFRd - ok

12:36:29.0543 4404 MBR (0x1B8) (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0

12:36:29.0562 4404 \Device\Harddisk0\DR0 - ok

12:36:29.0572 4404 Boot (0x1200) (69345b9b8ba1057630dafe3ec86b0106) \Device\Harddisk0\DR0\Partition0

12:36:29.0575 4404 \Device\Harddisk0\DR0\Partition0 - ok

12:36:29.0598 4404 Boot (0x1200) (193f1cba752ae2b56b4660c84d359a45) \Device\Harddisk0\DR0\Partition1

12:36:29.0600 4404 \Device\Harddisk0\DR0\Partition1 - ok

12:36:29.0601 4404 ============================================================

12:36:29.0601 4404 Scan finished

12:36:29.0601 4404 ============================================================

12:36:29.0618 3688 Detected object count: 1

12:36:29.0618 3688 Actual detected object count: 1

12:37:02.0476 3688 sptd ( LockedFile.Multi.Generic ) - skipped by user

12:37:02.0476 3688 sptd ( LockedFile.Multi.Generic ) - User select action: Skip

12:37:07.0538 4656 Deinitialize success

[Cecilia]

1.

Spara DeFogger by jpshortstuff http://www.jpshortstuff.247fixes.com/Defogger.exe på Skrivbordet.

 

Starta DeFogger.

När programmets fönster kommer upp trycker du på knappen Disable för att inaktivera drivrutinerna som hör ihop med ditt installerade CD-emuleringsprogram.

Tryck på Yes/Ja för att fortsätta.

När programmet är klart kommer det upp ett meddelande 'Finished!'.

Tryck på OK.

Programmet ber om omstart av datorn, tryck på OK. Om datorn inte startas om automatiskt så gör det själv.

 

VIKTIGT! Om du får ett felmeddelande medan DeFogger kör, så klistra in loggen defogger_disable som då skapas på Skrivbordet.

 

Aktivera inte dessa drivrutiner innan rensningen är helt klar.

 

2.

Kör aswMBR igen på samma sätt.

Om någon rad är röd så berätta vilken rad det gäller samt om det går att klicka på knappen "Fix" när raden är vald.

 

3.

Skanna datorn online på http://www.eset.com/onlinescan/

För att inte skannern ska ta för lång tid på sig stäng av ditt antivirusprogram under tiden.

 

Avbocka alternativet Remove found threats

Bocka för Scan Archives

 

Klicka på Advanced Settings

Bocka för:

Scan for potentially unwanted applications

Scan for potentially unsafe applications

Enable Anti-Stealth Technology

 

Klicka på Scan

 

När skanningen är klar skapas loggfilen C:\Program\Eset\Eset Online Scanner\log.txt. Öppna den i Anteckningar och klistra sedan in innehållet i ditt svar.

[evolancer12]

förstog inte om jag skulle skicka defogger loggen men gjorde de iaf...

 

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 13:40 on 10/12/2011 (henke)

 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.

HKCU:DAEMON Tools Lite -> Removed

 

Checking for services/drivers...

Unable to read sptd.sys

SPTD -> Disabled (Service running -> reboot required)

 

 

-=E.O.F=-

[evolancer12]

ingen rad var röd när jag skannade med aswMBR.

 

scannar med ESET nu. hur långt tid skall det ta? 99 % och det har gått tre timmar.

[evolancer12]

Alltså, jag har scannat med ESET i fyra timmar nu!! skall det ta så långt tid??

[Cecilia]

Har Esets skanner hittat något skadligt?

Det verkar ju lite konstigt om den sista procenten ska ta mer än en timme, så avsluta. Om det står vilken fil den håller på med så skriv det här.

Om något skadligt har hittats så är det bäst att du skriver ner allt du ser om det för det är inte säkert att någon loggfil sparas när du avbryter.

 

Klistra in den nya loggfilen från aswMBR, dvs aswMBR.txt som finns på Skrivbordet.

[evolancer12]

ESETSmartInstaller@High as downloader log:

all ok

# version=7

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=5f51369f18950345a693f27b07264536

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=true

# unsafe_checked=true

# antistealth_checked=true

# utc_time=2011-12-10 05:42:20

# local_time=2011-12-10 06:42:20 (+0100, Västeuropa, normaltid)

# country="Sweden"

# lang=1033

# osver=6.1.7600 NT

# compatibility_mode=2304 16777215 100 0 0 0 0 0

# compatibility_mode=5893 16776573 100 94 4260 75152971 0 0

# compatibility_mode=8192 67108863 100 0 3866 3866 0 0

# scanned=494878

# found=14

# cleaned=0

# scan_time=17160

C:\Program Files\Codemasters\DiRT 3\paul.dll a variant of Win32/Packed.VMProtect.AAA trojan (unable to clean) 00000000000000000000000000000000 I

C:\Program Files\Codemasters\DiRT 3\SKIDROW.dll a variant of Win32/Packed.VMProtect.AAA trojan (unable to clean) 00000000000000000000000000000000 I

C:\Program Files\Codemasters\DiRT 3\sr-dirt3.iso a variant of Win32/Packed.VMProtect.AAA trojan (unable to clean) 00000000000000000000000000000000 I

C:\Users\henke\AppData\Local\Temp\CheatEngine55.exe multiple threats (unable to clean) 00000000000000000000000000000000 I

C:\Users\henke\AppData\Local\Temp\ICReinstall\Facemoods.exe probably a variant of Win32/InstallCore.A application (unable to clean) 00000000000000000000000000000000 I

C:\Users\henke\AppData\Local\VirtualStore\Windows\infocard.exb a variant of Win32/Injector.AYA trojan (unable to clean) 00000000000000000000000000000000 I

C:\Users\henke\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\6a8641d-27aa1ec5 a variant of Win32/Kryptik.XAM trojan (unable to clean) 00000000000000000000000000000000 I

C:\Users\henke\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\52855476-388ca7e7 multiple threats (unable to clean) 00000000000000000000000000000000 I

C:\Users\henke\Downloads\Facemoods.exe probably a variant of Win32/InstallCore.A application (unable to clean) 00000000000000000000000000000000 I

C:\Users\henke\Downloads\flstudio_10.0_online.exe Win32/OpenCandy application (unable to clean) 00000000000000000000000000000000 I

C:\Users\henke\Downloads\Dirt.3 SKIDROW - Crack Only\paul.dll a variant of Win32/Packed.VMProtect.AAA trojan (unable to clean) 00000000000000000000000000000000 I

C:\Users\henke\Downloads\Dirt.3 SKIDROW - Crack Only\SKIDROW.dll a variant of Win32/Packed.VMProtect.AAA trojan (unable to clean) 00000000000000000000000000000000 I

C:\Users\henke\Downloads\FL.Studio Edition v10.0.0-nikolas\Setup.exe Win32/OpenCandy application (unable to clean) 00000000000000000000000000000000 I

D:\Adobe.Creative.Suite.5.Master.Collection.ESD.ISO-CORE\keygen.exe a variant of Win32/Keygen.BH application (unable to clean) 00000000000000000000000000000000 I

[The Computer Fanatiker]

Verkar som att det är en trojan på datorn... Kör F-Secures online-anti-virus och ta bort trojanen...

[evolancer12]

nya från aswMBR:

 

13:47:44.856 OS Version: Windows 6.1.7600

13:47:44.856 Number of processors: 2 586 0x170A

13:47:44.856 ComputerName: HENKE-DATOR UserName: henke

13:47:52.687 Initialize success

13:47:58.494 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

13:47:58.494 Disk 0 Vendor: ST9500325AS 0002SDM1 Size: 476940MB BusType: 11

13:48:00.709 Disk 0 MBR read successfully

13:48:00.725 Disk 0 MBR scan

13:48:00.725 Disk 0 Windows 7 default MBR code

13:48:00.740 Disk 0 scanning sectors +976768065

13:48:00.849 Disk 0 scanning C:\Windows\system32\drivers

13:48:09.507 Service scanning

13:48:13.439 Modules scanning

13:48:33.610 Disk 0 trace - called modules:

13:48:33.641 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS PCIIDEX.SYS msahci.sys

13:48:33.641 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85b478f0]

13:48:33.657 3 CLASSPNP.SYS[8c9b759e] -> nt!IofCallDriver -> [0x864b8918]

13:48:33.657 5 ACPI.sys[83a193b2] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x8645d030]

13:48:34.187 Scan finished successfully

13:49:23.702 Disk 0 MBR has been saved successfully to "C:\Users\henke\Desktop\MBR.dat"

13:49:23.733 The log file has been saved successfully to "C:\Users\henke\Desktop\aswMBR.txt"

[evolancer12]

Verkar som att det är en trojan på datorn... Kör F-Secures online-anti-virus och ta bort trojanen...

 

skall jag köra snabb eller fullständig?

[evolancer12]

Verkar som att det är en trojan på datorn... Kör F-Secures online-anti-virus och ta bort trojanen...

 

går inte att ränsa filerna

[Cecilia]

Det är allt lite riskfyllt att installera crackade program.

 

På sidan http://www.virustotal.com klickar du på Bläddra -knappen och klistrar in följande filnamn i rutan, klicka på Öppna och sedan på Skicka Fil. Vänta tills resultatet är klart (Närvarande status blir genomförd). Klistra in länken till resultatet här.

C:\Users\henke\AppData\Local\VirtualStore\Windows\infocard.exb

[evolancer12]

Det är allt lite riskfyllt att installera crackade program.

 

På sidan http://www.virustotal.com klickar du på Bläddra -knappen och klistrar in följande filnamn i rutan, klicka på Öppna och sedan på Skicka Fil. Vänta tills resultatet är klart (Närvarande status blir genomförd). Klistra in länken till resultatet här.

C:\Users\henke\AppData\Local\VirtualStore\Windows\infocard.exb

 

det går inte att hitta filen står det