Virusrensning på polarens dator

2 augusti, 2012

Nu är det dax igen då. Min polare lyckades med det omöjliga igen.

Kört malbytes,Kaspersky Virus Removal Tool och nod 32 online scan.

Alla loggar kommer med.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 8.0.7601.17514

Run by KENNY at 23:12:34 on 2012-08-02

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.46.1053.18.8086.5618 [GMT 2:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Microsoft Security Essentials *Enabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\atieclxx.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe

C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe

C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe

C:\Windows\SysWOW64\PnkBstrA.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files\Logitech\SetPointP\SetPoint.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\Corsair VENGEANCE 2000\CPL\CAHS2.exe

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files (x86)\Origin\Origin.exe

C:\Program Files (x86)\Steam\Steam.exe

C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe

C:\Program Files (x86)\XFastUSB\XFastUsb.exe

C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE

C:\Program Files (x86)\ekort\ekort.exe

C:\Program Files (x86)\SoliCall\bin\Personal_PBXMate.exe

C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files (x86)\Mdfrzy\mbamgui.exe

C:\Windows\SysWOW64\OBroker.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\PROGRA~2\Raptr\raptr.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files\Belkin\Belkin USB Print and Storage Center\connect.exe

C:\Program Files (x86)\Common Files\Steam\SteamService.exe

C:\PROGRA~2\Raptr\raptr_im.exe

C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinSetup.exe

C:\Program Files (x86)\Belkin\Router Setup and Monitor\dlnaPlugin.exe

C:\Program Files (x86)\Belkin\Router Setup and Monitor\qosPlugin.exe

C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\system32\DllHost.exe

C:\Program Files (x86)\Raptr\raptr_ep64.exe

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Program Files (x86)\Mdfrzy\mbamservice.exe

C:\Windows\system32\AUDIODG.EXE

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_270.exe

C:\Program Files (x86)\Internet Explorer\IELowutil.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://search.babylon.com/?affID=110819&babsrc=HP_ss&mntrId=a6cec5f8000000000000bc5ff41a7d08

uURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll

mURLSearchHooks: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll

mWinlogon: Userinit=userinit.exe,

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: ADDICT-THING Class: {641a48b0-771d-6262-e190-61cc47b15106} - C:\ProgramData\ADDICT-THING\bhoclass.dll

BHO: Incredibar.com Helper Object: {6e13dde1-2b6e-46ce-8b66-dc8bf36f6b99} - C:\Program Files (x86)\Incredibar.com\incredibar\1.5.11.14\bh\incredibar.dll

BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: e-kort Helper Class: {9065e913-4f23-4b47-9b5d-b055d32db1f3} - C:\Program Files (x86)\ekort\EKortHelper.dll

BHO: DealPly: {a6174f27-1fff-e1d6-a93f-ba48ad5dd448} - C:\Program Files (x86)\DealPly\DealPlyIE.dll

BHO: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll

BHO: Yontoo: {fd72061e-9fde-484d-a58a-0bab4151cad8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll

TB: e-kort Toolbar: {8db2b2e8-579f-48a8-a496-18fefcf8f4df} - C:\Program Files (x86)\ekort\EKortToolbar.dll

TB: Incredibar Toolbar: {f9639e4a-801b-4843-aee3-03d9da199e77} - C:\Program Files (x86)\Incredibar.com\incredibar\1.5.11.14\incredibarTlbr.dll

TB: Vuze Remote Toolbar: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files (x86)\Vuze_Remote\prxtbVuze.dll

uRun: [msnmsgr] "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background

uRun: [skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun

uRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

uRun: [EADM] "C:\Program Files (x86)\Origin\Origin.exe" -AutoStart

uRun: [steam] "C:\Program Files (x86)\Steam\steam.exe" -silent

uRun: [Xvid] C:\Program Files (x86)\Xvid\CheckUpdate.exe

uRun: [Raptr] C:\PROGRA~2\Raptr\raptrstub.exe --startup

mRun: [instaLAN] "C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" startup

mRun: [XFastUSB] "C:\Program Files (x86)\XFastUSB\XFastUsb.exe"

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml

mRun: [e-kort] C:\PROGRA~2\ekort\ekort.exe /dontopenmycards /Autostart

mRun: [PersonalPBXMate] "C:\Program Files (x86)\SoliCall\bin\Personal_PBXMate.exe"

mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun: [HTC Sync Loader] "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup

mRun: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Mdfrzy\mbamgui.exe" /starttray

mRunOnce: [GrpConv] grpconv -o

mPolicies-explorer: NoActiveDesktop = 1 (0x1)

mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

TCP: DhcpNameServer = 192.168.2.1

TCP: Interfaces\{292A936C-773C-4FE9-BB24-9D66861CB451} : DhcpNameServer = 192.168.2.1

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

{18DF081C-E8AD-4283-A596-FA578C2EBDC3}

{641A48B0-771D-6262-E190-61CC47B15106}

{6E13DDE1-2B6E-46CE-8B66-DC8BF36F6B99}

{9030D464-4C02-4ABF-8ECC-5164760863C6}

{9065E913-4F23-4B47-9B5D-B055D32DB1F3}

{A6174F27-1FFF-E1D6-A93F-BA48AD5DD448}

{ba14329e-9550-4989-b3f2-9732e92d17cc}

{FD72061E-9FDE-484D-A58A-0BAB4151CAD8}

{8DB2B2E8-579F-48A8-A496-18FEFCF8F4DF}

{F9639E4A-801B-4843-AEE3-03D9DA199E77}

{ba14329e-9550-4989-b3f2-9732e92d17cc}

mRun-x64: [instaLAN] "C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe" startup

mRun-x64: [XFastUSB] "C:\Program Files (x86)\XFastUSB\XFastUsb.exe"

mRun-x64: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

mRun-x64: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun-x64: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml

mRun-x64: [e-kort] C:\PROGRA~2\ekort\ekort.exe /dontopenmycards /Autostart

mRun-x64: [PersonalPBXMate] "C:\Program Files (x86)\SoliCall\bin\Personal_PBXMate.exe"

mRun-x64: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun-x64: [HTC Sync Loader] "C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe" -startup

mRun-x64: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Mdfrzy\mbamgui.exe" /starttray

mRunOnce-x64: [GrpConv] grpconv -o

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\KENNY\AppData\Roaming\Mozilla\Firefox\Profiles\wbktlt3y.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - about:home

FF - prefs.js: keyword.URL - hxxp://mystart.incredibar.com/mb139/?loc=IB_DS&a=6OyJorqj5j&&i=26&search=

FF - plugin: C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\1.116.0\npesnlaunch.dll

FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll

FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll

FF - plugin: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrlui.dll

FF - plugin: C:\Users\KENNY\AppData\Roaming\Mozilla\Firefox\Profiles\wbktlt3y.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}\plugins\np-mswmp.dll

FF - plugin: C:\Users\KENNY\AppData\Roaming\Mozilla\Firefox\Profiles\wbktlt3y.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_270.dll

.

---- FIREFOX POLICIES ----

FF - user.js: extentions.y2layers.installId - 2b37fe5d-c87c-4ae2-8673-4d6b6568c136

FF - user.js: extentions.y2layers.defaultEnableAppsList - ezLooker,pagerage,buzzdock,toprelatedtopics,twittube

.

FF - user.js: extensions.autoDisableScopes - 14

FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=110819

FF - user.js: extensions.BabylonToolbar_i.babExt -

FF - user.js: extensions.BabylonToolbar_i.srcExt - ss

FF - user.js: extensions.BabylonToolbar_i.id - a6cec5f8000000000000bc5ff41a7d08

FF - user.js: extensions.BabylonToolbar_i.hardId - a6cec5f8000000000000bc5ff41a7d08

FF - user.js: extensions.BabylonToolbar_i.instlDay - 15485

FF - user.js: extensions.BabylonToolbar_i.vrsn - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsni - 1.5.3.17

FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.5.3.1711:54:51

FF - user.js: extensions.BabylonToolbar_i.prtnrId - babylon

FF - user.js: extensions.BabylonToolbar_i.prdct - BabylonToolbar

FF - user.js: extensions.BabylonToolbar_i.aflt - babsst

FF - user.js: extensions.BabylonToolbar_i.smplGrp - none

FF - user.js: extensions.BabylonToolbar_i.tlbrId - tb9

FF - user.js: extensions.BabylonToolbar_i.instlRef - sst

.

user_pref('extensions.dealply.partner', 'iron');

.

user_pref('extensions.dealply.channel', 'iron3');

.

user_pref('extensions.dealply.installId', 'v23900276308063248466862012052511544524');

.

user_pref('extensions.dealply.installIdSource', 'inst');

.

user_pref('extensions.dealply.sampleGroup', '4');

FF - user.js: extensions.incredibar_i.newTab - false

FF - user.js: extensions.incredibar_i.tlbrSrchUrl - hxxp://mystart.Incredibar.com/?a=6OyJorqj5j&loc=IB_TB&i=26&search=

FF - user.js: extensions.incredibar_i.id - a6cec5f8000000000000bc5ff41a7d08

FF - user.js: extensions.incredibar_i.instlDay - 15550

FF - user.js: extensions.incredibar_i.vrsn - 1.5.11.14

FF - user.js: extensions.incredibar_i.vrsni - 1.5.11.14

FF - user.js: extensions.incredibar_i.vrsnTs - 1.5.11.1410:39:14

FF - user.js: extensions.incredibar_i.prtnrId - Incredibar

FF - user.js: extensions.incredibar_i.prdct - incredibar

FF - user.js: extensions.incredibar_i.aflt - orgnl

FF - user.js: extensions.incredibar_i.smplGrp - none

FF - user.js: extensions.incredibar_i.tlbrId - base

FF - user.js: extensions.incredibar_i.instlRef -

FF - user.js: extensions.incredibar_i.dfltLng -

FF - user.js: extensions.incredibar_i.excTlbr - false

FF - user.js: extensions.incredibar_i.ms_url_id -

FF - user.js: extensions.incredibar_i.upn2 - 6OyJorqj5j

FF - user.js: extensions.incredibar_i.upn2n - 92261837856457397

FF - user.js: extensions.incredibar_i.productid - 26

FF - user.js: extensions.incredibar_i.installerproductid - 26

FF - user.js: extensions.incredibar_i.did - 10650

FF - user.js: extensions.incredibar_i.ppd - 20%5F5

.

============= SERVICES / DRIVERS ===============

.

R0 MpFilter;Microsoft Malware Protection Driver;C:\Windows\system32\DRIVERS\MpFilter.sys --> C:\Windows\system32\DRIVERS\MpFilter.sys [?]

R1 aswKbd;aswKbd;C:\Windows\system32\drivers\aswKbd.sys --> C:\Windows\system32\drivers\aswKbd.sys [?]

R1 FNETURPX;FNETURPX;C:\Windows\system32\drivers\FNETURPX.SYS --> C:\Windows\system32\drivers\FNETURPX.SYS [?]

R1 MpKslfd16c85b;MpKslfd16c85b;C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{AEDB7EE8-53DB-4DCB-8169-0B34577A3382}\MpKslfd16c85b.sys [2012-8-2 35664]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\system32\atiesrxx.exe --> C:\Windows\system32\atiesrxx.exe [?]

R2 Belkin Local Backup Service;Belkin Local Backup Service;C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe [2012-3-15 181760]

R2 Belkin Network USB Helper;Belkin Network USB Helper;C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe [2012-3-15 55296]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Mdfrzy\mbamservice.exe [2012-8-2 655944]

R2 PassThru Service;Internet Pass-Through Service;C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [2012-3-23 87040]

R2 sxuptp;SXUPTP Driver;C:\Windows\system32\DRIVERS\sxuptp.sys --> C:\Windows\system32\DRIVERS\sxuptp.sys [?]

R3 amdkmdag;amdkmdag;C:\Windows\system32\DRIVERS\atikmdag.sys --> C:\Windows\system32\DRIVERS\atikmdag.sys [?]

R3 amdkmdap;amdkmdap;C:\Windows\system32\DRIVERS\atikmpag.sys --> C:\Windows\system32\DRIVERS\atikmpag.sys [?]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\system32\drivers\AtihdW76.sys --> C:\Windows\system32\drivers\AtihdW76.sys [?]

R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;C:\Windows\system32\DRIVERS\LEqdUsb.Sys --> C:\Windows\system32\DRIVERS\LEqdUsb.Sys [?]

R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;C:\Windows\system32\DRIVERS\LHidEqd.Sys --> C:\Windows\system32\DRIVERS\LHidEqd.Sys [?]

R3 MBAMProtector;MBAMProtector;\??\C:\Windows\system32\drivers\mbam.sys --> C:\Windows\system32\drivers\mbam.sys [?]

R3 MBfilt;MBfilt;C:\Windows\system32\drivers\MBfilt64.sys --> C:\Windows\system32\drivers\MBfilt64.sys [?]

R3 MEIx64;Intel® Management Engine Interface ;C:\Windows\system32\DRIVERS\HECIx64.sys --> C:\Windows\system32\DRIVERS\HECIx64.sys [?]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\system32\DRIVERS\Rt64win7.sys --> C:\Windows\system32\DRIVERS\Rt64win7.sys [?]

R3 SYMPHONY;Corsair USB Headphone Driver;C:\Windows\system32\DRIVERS\Symphony.sys --> C:\Windows\system32\DRIVERS\Symphony.sys [?]

RUnknown 50511128;50511128; [x]

RUnknown 5816898drv;5816898drv; [x]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-3 160944]

S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-3-31 250056]

S3 cphs;Intel® Content Protection HECI Service;C:\Windows\SysWOW64\IntelCpHeciSvc.exe [2012-3-19 276248]

S3 FNETTBOH_305;FNETTBOH_305;C:\Windows\system32\drivers\FNETTBOH_305.SYS --> C:\Windows\system32\drivers\FNETTBOH_305.SYS [?]

S3 HTCAND64;HTC Device Driver;C:\Windows\system32\Drivers\ANDROIDUSB.sys --> C:\Windows\system32\Drivers\ANDROIDUSB.sys [?]

S3 htcnprot;HTC NDIS Protocol Driver;C:\Windows\system32\DRIVERS\htcnprot.sys --> C:\Windows\system32\DRIVERS\htcnprot.sys [?]

S3 MozillaMaintenance;Mozilla Maintenance Service;C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-4-26 113120]

S3 NisDrv;Microsoft Network Inspection System;C:\Windows\system32\DRIVERS\NisDrvWFP.sys --> C:\Windows\system32\DRIVERS\NisDrvWFP.sys [?]

S3 NisSrv;Microsoft Nätverkskontroll;C:\Program Files\Microsoft Security Client\NisSrv.exe [2012-3-26 291696]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\system32\drivers\tsusbflt.sys --> C:\Windows\system32\drivers\tsusbflt.sys [?]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\system32\drivers\TsUsbGD.sys --> C:\Windows\system32\drivers\TsUsbGD.sys [?]

S3 WatAdminSvc;Aktiveringsteknologier för Windows-tjänst;C:\Windows\system32\Wat\WatAdminSvc.exe --> C:\Windows\system32\Wat\WatAdminSvc.exe [?]

.

=============== Created Last 30 ================

.

2012-08-02 20:01:57 35664 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{AEDB7EE8-53DB-4DCB-8169-0B34577A3382}\MpKslfd16c85b.sys

2012-08-02 18:48:28 -------- d-----w- C:\Users\KENNY\AppData\Local\{4DAE4414-8E76-4601-91EB-6C086E18385A}

2012-08-02 18:48:18 -------- d-----w- C:\Users\KENNY\AppData\Local\{A3C98CE1-C5DF-4BC0-8ADD-E15DED2F4E32}

2012-08-02 18:47:42 -------- d-----w- C:\Program Files (x86)\ESET

2012-08-02 18:37:24 -------- d-----w- C:\ProgramData\Kaspersky Lab

2012-08-02 18:33:28 69000 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{AEDB7EE8-53DB-4DCB-8169-0B34577A3382}\offreg.dll

2012-08-02 15:04:16 9133488 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{AEDB7EE8-53DB-4DCB-8169-0B34577A3382}\mpengine.dll

2012-08-02 09:45:01 -------- d-----w- C:\Users\KENNY\AppData\Roaming\Malwarebytes

2012-08-02 09:44:55 -------- d-----w- C:\ProgramData\Malwarebytes

2012-08-02 09:44:54 24904 ----a-w- C:\Windows\System32\drivers\mbam.sys

2012-08-02 09:44:54 -------- d-----w- C:\Program Files (x86)\Mdfrzy

2012-08-02 06:47:47 -------- d-----w- C:\Users\KENNY\AppData\Local\{FACA2EA7-E30E-4E8C-8FAD-B6DCEECA2FFB}

2012-08-02 06:47:35 -------- d-----w- C:\Users\KENNY\AppData\Local\{1670F952-1838-42FB-87F3-B27FB360171E}

2012-08-01 14:47:56 9133488 ----a-w- C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll

2012-08-01 14:39:51 -------- d-----w- C:\Users\KENNY\AppData\Local\{66E625D3-5374-461A-AFD4-F02541507CFF}

2012-08-01 14:39:39 -------- d-----w- C:\Users\KENNY\AppData\Local\{0FDD4A58-8E3A-4CC4-8F6D-C19FD17265E1}

2012-07-31 14:30:02 -------- d-----w- C:\Users\KENNY\AppData\Local\{D661220E-DCF4-4627-AFFD-C9BACE2995A5}

2012-07-31 14:29:52 -------- d-----w- C:\Users\KENNY\AppData\Local\{26A3992D-9394-412B-AD53-357A21D2938C}

2012-07-30 16:29:26 -------- d-----w- C:\Users\KENNY\AppData\Local\DirectDownloader

2012-07-30 14:31:02 -------- d-----w- C:\Users\KENNY\AppData\Local\{B9EAC65B-3941-46E1-AED3-4EC0FF3CFAC4}

2012-07-30 14:30:52 -------- d-----w- C:\Users\KENNY\AppData\Local\{DEC38FC9-D859-4748-8368-E31336DFEC22}

2012-07-29 20:40:11 -------- d-----w- C:\Users\KENNY\AppData\Roaming\Raptr

2012-07-29 20:40:11 -------- d-----w- C:\Program Files (x86)\Raptr

2012-07-29 20:39:17 -------- d-----w- C:\Program Files (x86)\Conduit

2012-07-29 20:39:16 -------- d-----w- C:\Users\KENNY\AppData\Local\Conduit

2012-07-29 20:39:15 -------- d-----w- C:\Program Files (x86)\Vuze_Remote

2012-07-29 08:39:38 -------- d-----w- C:\ProgramData\Premium

2012-07-29 08:39:31 -------- d-----w- C:\ProgramData\OptimizerPro

2012-07-29 08:39:26 -------- d-----w- C:\Program Files (x86)\Optimizer Pro

2012-07-29 08:39:13 -------- d-----w- C:\Program Files (x86)\Incredibar.com

2012-07-29 08:38:36 -------- d-----w- C:\ProgramData\ADDICT-THING

2012-07-29 08:38:17 -------- d-----w- C:\ProgramData\InstallMate

2012-07-29 07:55:18 -------- d-----w- C:\Users\KENNY\AppData\Local\{937F4C4F-E761-4F9D-AFB6-4A85C17478E1}

2012-07-29 07:55:04 -------- d-----w- C:\Users\KENNY\AppData\Local\{7FBC3D22-DC2B-4B4B-A5E7-49D8ED32AD4E}

2012-07-28 18:12:19 -------- d-----w- C:\Program Files (x86)\OpenApp

2012-07-28 18:02:55 -------- d-----w- C:\Program Files (x86)\smartdl

2012-07-28 08:24:50 -------- d-----w- C:\Users\KENNY\AppData\Local\{0A8BA5EB-EFC0-4574-A3E5-DEE8C286B222}

2012-07-28 08:24:40 -------- d-----w- C:\Users\KENNY\AppData\Local\{89803C18-7F08-458E-80B3-9403432092B4}

2012-07-27 10:23:22 -------- d-----w- C:\Users\KENNY\AppData\Local\{7F15B864-FC51-4D77-8255-C0D6AD3AE68E}

2012-07-27 10:23:10 -------- d-----w- C:\Users\KENNY\AppData\Local\{0DD3F77A-7860-452E-9632-FB18BD77E89D}

2012-07-26 17:09:24 -------- d-----w- C:\Users\KENNY\AppData\Roaming\HTC.388BC06ACDAB6261375BCE37FBA2E023C0D7EE34.1

2012-07-26 17:07:39 -------- d-----w- C:\Users\KENNY\AppData\Local\Htc

2012-07-26 17:07:11 -------- d-----w- C:\Users\KENNY\AppData\Roaming\HTC

2012-07-26 17:06:01 -------- d-----w- C:\Users\KENNY\AppData\Local\Downloaded Installations

2012-07-26 17:05:42 -------- d-----w- C:\Program Files (x86)\Spirent Communications

2012-07-26 17:05:29 -------- d-----w- C:\Program Files (x86)\HTC

2012-07-26 17:05:09 -------- d-----w- C:\Program Files (x86)\MSXML 4.0

2012-07-26 08:23:58 -------- d-----w- C:\Users\KENNY\AppData\Local\{254B3108-51CA-41AD-993C-496076E647CB}

2012-07-26 08:23:47 -------- d-----w- C:\Users\KENNY\AppData\Local\{C5B6ED28-9DAB-4D90-ABCD-C4EFB2EFA966}

2012-07-25 14:33:01 -------- d-----w- C:\Users\KENNY\AppData\Local\{AD60E4E9-ED71-4309-8EB7-BE5168CF6E3A}

2012-07-25 14:32:48 -------- d-----w- C:\Users\KENNY\AppData\Local\{C96A861D-DFB1-47B1-A831-73039D760C45}

2012-07-24 14:30:17 -------- d-----w- C:\Users\KENNY\AppData\Local\{42E45AD2-9BBE-4ABE-B467-CB7B0FE5E655}

2012-07-24 14:30:05 -------- d-----w- C:\Users\KENNY\AppData\Local\{D160A798-659A-4A8B-B2FD-30B78FE33C8B}

2012-07-23 16:10:18 -------- d-----w- C:\Users\KENNY\AppData\Local\{996C9540-BE8B-40F5-AD75-4B944C0AD019}

2012-07-23 16:10:07 -------- d-----w- C:\Users\KENNY\AppData\Local\{EDA25C6A-3ABA-42D7-857B-9D63A843B86B}

2012-07-22 09:02:58 -------- d-----w- C:\Users\KENNY\AppData\Local\{4056E71A-47B8-4F3D-9863-A56135C6D29A}

2012-07-22 09:02:47 -------- d-----w- C:\Users\KENNY\AppData\Local\{E79A2B8C-B763-4475-9C8B-7032837619A0}

2012-07-21 08:49:23 -------- d-----w- C:\Users\KENNY\AppData\Local\{0E0D9D90-0354-41DD-87C1-19E5E0C836DB}

2012-07-21 08:49:10 -------- d-----w- C:\Users\KENNY\AppData\Local\{3EE5BC90-8B3F-4247-AC9C-217979B3B501}

2012-07-20 07:05:00 -------- d-----w- C:\Users\KENNY\AppData\Local\{DAF94222-B600-4032-9027-02F003D5272B}

2012-07-20 07:04:49 -------- d-----w- C:\Users\KENNY\AppData\Local\{961ABD14-83B2-4697-8447-3B5E449FAF77}

2012-07-19 08:42:57 -------- d-----w- C:\Users\KENNY\AppData\Local\{E3282096-9DBB-4E73-937F-6AF4A831635F}

2012-07-19 08:42:37 -------- d-----w- C:\Users\KENNY\AppData\Local\{55CF5C16-AFEC-46EB-ABC7-B03FA9126A54}

2012-07-18 08:25:12 -------- d-----w- C:\Users\KENNY\AppData\Local\{9F230861-CF23-4741-A54F-07906AB52A95}

2012-07-18 08:25:01 -------- d-----w- C:\Users\KENNY\AppData\Local\{BDAC4C63-0AAD-471A-BD64-7859FDB5DEEB}

2012-07-17 09:34:02 -------- d-----w- C:\Users\KENNY\AppData\Local\{964F5E17-B185-41FF-8809-1B87E35670B7}

2012-07-17 09:33:51 -------- d-----w- C:\Users\KENNY\AppData\Local\{D17C1D34-C7B7-4794-BD0D-01D5CD07F4B8}

2012-07-16 10:48:32 -------- d-----w- C:\Users\KENNY\AppData\Local\{1C33B996-BB57-41A1-A60A-98A3F461EBBD}

2012-07-16 10:48:21 -------- d-----w- C:\Users\KENNY\AppData\Local\{EE087ECE-29EE-46E2-9F55-2D3AA304B426}

2012-07-15 21:26:00 -------- d-----w- C:\Users\KENNY\AppData\Local\{E90E66A1-7D64-4122-83CC-D8F4FF692712}

2012-07-15 21:25:50 -------- d-----w- C:\Users\KENNY\AppData\Local\{E9B974E9-FA1F-4C71-9C5F-462B927112CD}

2012-07-15 09:25:24 -------- d-----w- C:\Users\KENNY\AppData\Local\{70C10C92-DB8C-4889-9487-8BBAB6F31F5D}

2012-07-15 09:25:14 -------- d-----w- C:\Users\KENNY\AppData\Local\{609A0470-D0D2-4730-B9E1-736CCF8BEF64}

2012-07-14 08:35:29 -------- d-----w- C:\Users\KENNY\AppData\Local\{5A5EDDB3-4729-4AC2-A503-AA7469C03E3B}

2012-07-14 08:35:15 -------- d-----w- C:\Users\KENNY\AppData\Local\{4CDF74AC-2456-4A51-9314-84CF3E60066D}

2012-07-13 09:04:52 -------- d-----w- C:\Users\KENNY\AppData\Local\{23C5B667-4303-4BCF-BB0F-43FD6FCA7FA1}

2012-07-13 09:04:42 -------- d-----w- C:\Users\KENNY\AppData\Local\{FA99EA6C-0624-4541-A0CF-F1DF66A5ADC4}

2012-07-12 16:45:02 -------- d-----w- C:\Users\KENNY\AppData\Local\{48524C18-CAD2-40E4-9B21-798D5C3A8506}

2012-07-12 16:44:49 -------- d-----w- C:\Users\KENNY\AppData\Local\{299AD14B-7920-48EB-BF49-B5F2C5E33B16}

2012-07-11 23:08:09 -------- d-----w- C:\Users\KENNY\AppData\Local\{7F5813FC-8738-4D51-A5C4-0CBD7E9563B8}

2012-07-11 23:07:53 -------- d-----w- C:\Users\KENNY\AppData\Local\{296770BF-45E3-45B1-81EB-8B13EDCDBDE9}

2012-07-11 11:33:35 3148800 ----a-w- C:\Windows\System32\win32k.sys

2012-07-11 09:22:59 805376 ----a-w- C:\Windows\SysWow64\cdosys.dll

2012-07-11 09:22:59 495616 ----a-w- C:\Program Files\Common Files\System\ado\msadox.dll

2012-07-11 09:22:59 466944 ----a-w- C:\Program Files\Common Files\System\ado\msadomd.dll

2012-07-11 09:22:59 258048 ----a-w- C:\Program Files\Common Files\System\msadc\msadco.dll

2012-07-11 09:22:59 1499136 ----a-w- C:\Program Files\Common Files\System\ado\msado15.dll

2012-07-11 09:22:59 1019904 ----a-w- C:\Program Files (x86)\Common Files\System\ado\msado15.dll

2012-07-11 09:22:58 61440 ----a-w- C:\Program Files\Common Files\System\ado\msador15.dll

2012-07-11 09:22:58 57344 ----a-w- C:\Program Files (x86)\Common Files\System\ado\msador15.dll

2012-07-11 09:22:58 372736 ----a-w- C:\Program Files (x86)\Common Files\System\ado\msadox.dll

2012-07-11 09:22:58 352256 ----a-w- C:\Program Files (x86)\Common Files\System\ado\msadomd.dll

2012-07-11 09:22:58 212992 ----a-w- C:\Program Files (x86)\Common Files\System\msadc\msadco.dll

2012-07-11 09:22:58 143360 ----a-w- C:\Program Files (x86)\Common Files\System\ado\msjro.dll

2012-07-11 09:22:58 1133568 ----a-w- C:\Windows\System32\cdosys.dll

2012-07-11 09:20:20 -------- d-----w- C:\Users\KENNY\AppData\Local\{52BF190D-7654-4D67-89D7-49372D6DA68A}

2012-07-11 09:20:03 -------- d-----w- C:\Users\KENNY\AppData\Local\{71A8761E-B4AD-4BEF-BAF7-AB5A71D13F38}

2012-07-10 09:59:35 294912 ----a-w- C:\Windows\System32\browserchoice.exe

2012-07-10 08:28:57 -------- d-----w- C:\Users\KENNY\AppData\Local\{BD78FB45-02C8-49AA-9E00-3554EF86DA71}

2012-07-10 08:28:45 -------- d-----w- C:\Users\KENNY\AppData\Local\{8B175211-2FDE-4A4F-B973-F6C15128D6AF}

2012-07-09 10:21:15 -------- d-----w- C:\Users\KENNY\AppData\Local\{0ACEA0A0-C41B-448D-BCD0-E7494400E2EE}

2012-07-09 10:20:58 -------- d-----w- C:\Users\KENNY\AppData\Local\{9CCBED56-3BAB-44D8-97EE-06612FB8809D}

2012-07-08 09:08:14 -------- d-----w- C:\Users\KENNY\AppData\Local\{EDA905CC-8BB6-4A31-8079-04C0C57EB385}

2012-07-08 09:07:58 -------- d-----w- C:\Users\KENNY\AppData\Local\{E30CBDF4-F4BC-46A9-974D-8DFD7BEDC912}

2012-07-07 09:07:47 -------- d-----w- C:\Users\KENNY\AppData\Local\{637F92B4-E85C-48A4-972C-0E0413CF8ABE}

2012-07-07 09:07:34 -------- d-----w- C:\Users\KENNY\AppData\Local\{B5D23CCA-A914-4FA0-8385-1551B3D87228}

2012-07-06 09:15:53 -------- d-----w- C:\Program Files (x86)\AMD APP

2012-07-06 09:06:37 -------- d-----w- C:\Users\KENNY\AppData\Local\{01D4BCFA-DBB9-4A04-994C-0E8D1DB7FEED}

2012-07-06 09:06:26 -------- d-----w- C:\Users\KENNY\AppData\Local\{63D4259B-7D30-4DB8-86C0-9B68132B133A}

2012-07-05 09:11:20 -------- d-----w- C:\Users\KENNY\AppData\Local\{9E14D3F1-B43F-4613-B3DC-3CA936C3C074}

2012-07-05 09:11:10 -------- d-----w- C:\Users\KENNY\AppData\Local\{B3CBA613-8C48-4ABD-A922-3EE32FF42829}

2012-07-04 07:35:16 -------- d-----w- C:\Users\KENNY\AppData\Local\{512D7BA7-E8C8-47A0-B33C-F68FC03012D5}

2012-07-04 07:35:03 -------- d-----w- C:\Users\KENNY\AppData\Local\{013157CA-FF9D-4D54-92BC-B99BE004D3BC}

.

==================== Find3M ====================

.

2012-08-02 17:28:12 70344 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2012-08-02 17:28:12 426184 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2012-07-26 17:11:12 32320 ----a-w- C:\Windows\System32\drivers\FNETTBOH_305.SYS

2012-07-22 18:25:31 283304 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr

2012-07-22 18:25:31 283304 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe

2012-07-22 09:37:19 283304 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0

2012-06-25 14:04:24 1394248 ----a-w- C:\Windows\SysWow64\msxml4.dll

2012-06-11 18:59:38 10248192 ----a-w- C:\Windows\System32\drivers\atikmdag.sys

2012-06-11 18:35:48 70144 ----a-w- C:\Windows\System32\coinst_8.98.dll

2012-06-11 18:29:34 24826368 ----a-w- C:\Windows\System32\atio6axx.dll

2012-06-11 18:00:32 20467712 ----a-w- C:\Windows\SysWow64\atioglxx.dll

2012-06-11 17:25:06 163840 ----a-w- C:\Windows\System32\atiapfxx.exe

2012-06-11 17:24:58 924160 ----a-w- C:\Windows\SysWow64\aticfx32.dll

2012-06-11 17:23:12 1090560 ----a-w- C:\Windows\System32\aticfx64.dll

2012-06-11 17:20:02 442368 ----a-w- C:\Windows\System32\ATIDEMGX.dll

2012-06-11 17:19:58 532992 ----a-w- C:\Windows\System32\atieclxx.exe

2012-06-11 17:19:14 239616 ----a-w- C:\Windows\System32\atiesrxx.exe

2012-06-11 17:17:56 120320 ----a-w- C:\Windows\System32\atitmm64.dll

2012-06-11 17:17:42 21504 ----a-w- C:\Windows\System32\atimuixx.dll

2012-06-11 17:17:38 59392 ----a-w- C:\Windows\System32\atiedu64.dll

2012-06-11 17:17:32 43520 ----a-w- C:\Windows\SysWow64\ati2edxx.dll

2012-06-11 17:16:48 6301696 ----a-w- C:\Windows\SysWow64\atidxx32.dll

2012-06-11 17:01:56 6914560 ----a-w- C:\Windows\System32\atidxx64.dll

2012-06-11 16:51:54 4246528 ----a-w- C:\Windows\System32\atiumd6a.dll

2012-06-11 16:45:48 51200 ----a-w- C:\Windows\System32\aticalrt64.dll

2012-06-11 16:45:46 46080 ----a-w- C:\Windows\SysWow64\aticalrt.dll

2012-06-11 16:45:44 5480448 ----a-w- C:\Windows\SysWow64\atiumdag.dll

2012-06-11 16:45:40 44544 ----a-w- C:\Windows\System32\aticalcl64.dll

2012-06-11 16:45:38 44032 ----a-w- C:\Windows\SysWow64\aticalcl.dll

2012-06-11 16:45:26 15703040 ----a-w- C:\Windows\System32\aticaldd64.dll

2012-06-11 16:43:18 4729344 ----a-w- C:\Windows\SysWow64\atiumdva.dll

2012-06-11 16:40:58 13277696 ----a-w- C:\Windows\SysWow64\aticaldd.dll

2012-06-11 16:36:56 6605824 ----a-w- C:\Windows\System32\atiumd64.dll

2012-06-11 16:27:02 539136 ----a-w- C:\Windows\System32\atiadlxx.dll

2012-06-11 16:26:52 368640 ----a-w- C:\Windows\SysWow64\atiadlxy.dll

2012-06-11 16:26:40 17920 ----a-w- C:\Windows\System32\atig6pxx.dll

2012-06-11 16:26:36 14848 ----a-w- C:\Windows\SysWow64\atiglpxx.dll

2012-06-11 16:26:36 14848 ----a-w- C:\Windows\System32\atiglpxx.dll

2012-06-11 16:26:30 41984 ----a-w- C:\Windows\System32\atig6txx.dll

2012-06-11 16:26:22 33280 ----a-w- C:\Windows\SysWow64\atigktxx.dll

2012-06-11 16:26:14 367616 ----a-w- C:\Windows\System32\drivers\atikmpag.sys

2012-06-11 16:25:20 54784 ----a-w- C:\Windows\System32\atiuxp64.dll

2012-06-11 16:25:12 42496 ----a-w- C:\Windows\SysWow64\atiuxpag.dll

2012-06-11 16:25:06 45056 ----a-w- C:\Windows\System32\atiu9p64.dll

2012-06-11 16:24:58 32768 ----a-w- C:\Windows\SysWow64\atiu9pag.dll

2012-06-11 16:24:24 53248 ----a-w- C:\Windows\System32\drivers\ati2erec.dll

2012-06-11 16:23:18 56320 ----a-w- C:\Windows\System32\atimpc64.dll

2012-06-11 16:23:18 56320 ----a-w- C:\Windows\System32\amdpcom64.dll

2012-06-11 16:23:10 56832 ----a-w- C:\Windows\SysWow64\atimpc32.dll

2012-06-11 16:23:10 56832 ----a-w- C:\Windows\SysWow64\amdpcom32.dll

2012-06-11 11:50:46 187392 ----a-w- C:\Windows\System32\clinfo.exe

2012-06-11 11:50:30 75264 ----a-w- C:\Windows\System32\OpenVideo64.dll

2012-06-11 11:50:24 65024 ----a-w- C:\Windows\SysWow64\OpenVideo.dll

2012-06-11 11:50:18 63488 ----a-w- C:\Windows\System32\OVDecode64.dll

2012-06-11 11:50:14 56320 ----a-w- C:\Windows\SysWow64\OVDecode.dll

2012-06-11 11:50:06 16457728 ----a-w- C:\Windows\System32\amdocl64.dll

2012-06-11 11:49:22 13008896 ----a-w- C:\Windows\SysWow64\amdocl.dll

2012-06-06 06:06:16 2004480 ----a-w- C:\Windows\System32\msxml6.dll

2012-06-06 06:06:16 1881600 ----a-w- C:\Windows\System32\msxml3.dll

2012-06-06 05:05:52 1390080 ----a-w- C:\Windows\SysWow64\msxml6.dll

2012-06-06 05:05:52 1236992 ----a-w- C:\Windows\SysWow64\msxml3.dll

2012-06-02 22:15:31 2622464 ----a-w- C:\Windows\System32\wucltux.dll

2012-06-02 22:15:08 99840 ----a-w- C:\Windows\System32\wudriver.dll

2012-06-02 13:19:42 186752 ----a-w- C:\Windows\System32\wuwebv.dll

2012-06-02 13:15:12 36864 ----a-w- C:\Windows\System32\wuapp.exe

2012-06-02 05:50:10 458704 ----a-w- C:\Windows\System32\drivers\cng.sys

2012-06-02 05:48:16 95600 ----a-w- C:\Windows\System32\drivers\ksecdd.sys

2012-06-02 05:48:16 151920 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys

2012-06-02 05:45:31 340992 ----a-w- C:\Windows\System32\schannel.dll

2012-06-02 05:44:21 307200 ----a-w- C:\Windows\System32\ncrypt.dll

2012-06-02 04:40:42 22016 ----a-w- C:\Windows\SysWow64\secur32.dll

2012-06-02 04:40:39 225280 ----a-w- C:\Windows\SysWow64\schannel.dll

2012-06-02 04:39:10 219136 ----a-w- C:\Windows\SysWow64\ncrypt.dll

2012-06-02 04:34:09 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll

2012-05-30 17:44:56 466456 ----a-w- C:\Windows\System32\wrap_oal.dll

2012-05-30 17:44:55 444952 ----a-w- C:\Windows\SysWow64\wrap_oal.dll

2012-05-30 17:44:55 122904 ----a-w- C:\Windows\System32\OpenAL32.dll

2012-05-30 17:44:55 109080 ----a-w- C:\Windows\SysWow64\OpenAL32.dll

.

============= FINISH: 23:12:47,07 ===============

ho.txt

log.txt

mbam-log-2012-08-02 (11-46-08).txt

mbam-log-2012-08-02 (20-26-19).txt

mbam-log-2012-08-02 (20-28-16).txt

mbam-log-2012-08-02 (20-32-00).txt

uh.txt

Attach.txt

2 augusti, 2012

Avinstallera:

Incredibar Toolbar on IE orsak: http://www.systemlookup.com/CLSID/74602-incredibarTlbr_dll.html

Vuze Remote Toolbar: http://www.systemlookup.com/CLSID/70253-tbVuze_dll_tbVuz0_dll_tbVuz1_dll_tbVuz2_dll_prxtbVuze_dll_prxtbVuz0_dll_prxtbVuz1_dll_prxtbVuz2_dll.html

DealPly: http://www.systemlookup.com/CLSID/73388-DealPlyIE_dll.html

FLV Player: Se Esets logg

I Firefox lista över installerade tillägg och insticksmoduler, leta efter Babylon, Incredibar, dealply, buzzdock, toprelatedtopics och annat konstigt som inte används. Avinstallera eller inaktivera.

Starta om datorn.

Kör DDS och klistra in en ny DDS.txt.

Finns det annat än alla dessa toolbars som visar att datorn är infekterad?

3 augusti, 2012

Avinstallera:

Incredibar Toolbar on IE orsak: http://www.systemlookup.com/CLSID/74602-incredibarTlbr_dll.html

Vuze Remote Toolbar: http://www.systemlookup.com/CLSID/70253-tbVuze_dll_tbVuz0_dll_tbVuz1_dll_tbVuz2_dll_prxtbVuze_dll_prxtbVuz0_dll_prxtbVuz1_dll_prxtbVuz2_dll.html

DealPly: http://www.systemlookup.com/CLSID/73388-DealPlyIE_dll.html

FLV Player: Se Esets logg

I Firefox lista över installerade tillägg och insticksmoduler, leta efter Babylon, Incredibar, dealply, buzzdock, toprelatedtopics och annat konstigt som inte används. Avinstallera eller inaktivera.

Starta om datorn.

Kör DDS och klistra in en ny DDS.txt.

Finns det annat än alla dessa toolbars som visar att datorn är infekterad?

Jag mistäkte att han fått skit i daorn och han sa att datorn hade blivit seg. Annars finns det inget i datorn som påvisar att den har virus. Han har i för sig fått ett till program nere i vid klockan man man se det (ser ut som ett chatt program). Men har inte namnet i huvudet.

Förstår inte hur han lyckas få in 10 ca tolbars i datorn.

3 augusti, 2012

Okej, då är det kanske bara alla dessa toolbars :rolleyes:

Vi får se hur datorn beter sig när de har blivit avinstallerade och resterna sedan har rensats bort (manuell handpåläggning i Firefox brukar krävas).

3 augusti, 2012

Okej, då är det kanske bara alla dessa toolbars

Vi får se hur datorn beter sig när de har blivit avinstallerade och resterna sedan har rensats bort (manuell handpåläggning i Firefox brukar krävas).

Okej tar bort raptr också (det där konstiga chattprogramet).

yontoo som verkar vara någon trojan/virus mned. Jag får inte bort det häller.

Återkommer med DDS logg snart.

DDS (Ver_2011-08-26.01) - NTFSAMD64

Internet Explorer: 8.0.7601.17514

Run by KENNY at 14:25:58 on 2012-08-03

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.46.1053.18.8086.6165 [GMT 2:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {9765EA51-0D3C-7DFB-6091-10E4E1F341F6}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Microsoft Security Essentials *Enabled/Updated* {2C040BB5-2B06-7275-5A21-2B969A740B4B}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

c:\Program Files\Microsoft Security Client\MsMpEng.exe

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\AUDIODG.EXE

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\atieclxx.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Belkin\Belkin USB Print and Storage Center\BkBackupScheduler.exe

C:\Program Files\Belkin\Belkin USB Print and Storage Center\Bkapcs.exe

C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe

C:\Windows\SysWOW64\PnkBstrA.exe

C:\Program Files (x86)\Skype\Updater\Updater.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\Logitech\SetPointP\SetPoint.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Microsoft Security Client\msseces.exe

C:\Program Files\Corsair VENGEANCE 2000\CPL\CAHS2.exe

C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Program Files\Windows Sidebar\sidebar.exe

C:\Program Files (x86)\Origin\Origin.exe

C:\Program Files (x86)\Steam\Steam.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Common Files\Steam\SteamService.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe

C:\Program Files (x86)\Internet Explorer\IELowutil.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\ekort\ekort.exe

C:\Program Files (x86)\SoliCall\bin\Personal_PBXMate.exe

C:\Windows\SysWOW64\OBroker.exe

C:\Program Files (x86)\HTC\HTC Sync 3.0\htcUPCTLoader.exe

C:\Program Files (x86)\Mdfrzy\mbamgui.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Windows\system32\DllHost.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\sysWOW64\wbem\wmiprvse.exe

C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Belkin\Belkin USB Print and Storage Center\connect.exe

C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinSetup.exe

C:\Program Files (x86)\Belkin\Router Setup and Monitor\dlnaPlugin.exe

C:\Program Files (x86)\Belkin\Router Setup and Monitor\qosPlugin.exe

C:\Windows\system32\DllHost.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\conhost.exe

C:\Windows\SysWOW64\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://search.babylon.com/?affID=110819&babsrc=HP_ss&mntrId=a6cec5f8000000000000bc5ff41a7d08

uURLSearchHooks: H - No File